Windows Analysis Report nowy przyk#U0142adowy katalog.exe

Overview

General Information

Sample Name: nowy przyk#U0142adowy katalog.exe
Analysis ID: 515499
MD5: cbe0e49106fad96b2c1c155ce5b22abd
SHA1: 25a9a38c80446b631fc1de30440caba41ff8ec74
SHA256: a13cc23d40c93805a7305e090f5faf55d60b440e6d674ac333980ecd6c94bc60
Tags: exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
System process connects to network (likely due to code injection or exploit)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Machine Learning detection for sample
Performs DNS queries to domains with low reputation
Self deletion via cmd delete
Injects a PE file into a foreign processes
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Sigma detected: CMSTP Execution Process Creation
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Uses a Windows Living Off The Land Binaries (LOL bins)
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to call native functions
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Extensive use of GetProcAddress (often used to hide API calls)
PE file contains strange resources
Drops PE files
Contains functionality to read the PEB
Checks if the current process is being debugged
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000001.00000002.426662087.0000000000CE0000.00000040.00020000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.bezhantrading.com/wtcv/"], "decoy": ["snowwisdom.com", "metaverseforecast.com", "mbc2digital.net", "palmspringsgolfacademy.com", "ff4cdhffx.xyz", "webdailysports.com", "alles-abgedeckt.com", "dempseynutrition.com", "egicsac.com", "nutrioclinic.com", "applebroog.industries", "trup.club", "937451.com", "cococutiecosmetics.store", "purwojati.com", "qeefame.com", "wbtqfuck.xyz", "huazhansat.com", "harada-insatsu.com", "thankugreece.com", "matthewandjessica.com", "giusepperosafio.com", "mhtqph.club", "clickcopywriting.com", "pausupport.com", "iccsukltd.com", "dtechmagento.com", "cplbet168.xyz", "leads-mania.club", "clairebuildsonline.com", "americanvisionvinyl.com", "ningyue.xyz", "cyfercode.com", "jasonjasura.com", "perspectiveofthepalm.com", "goodneighborurgentcare.com", "umityasarengin.com", "6016011.com", "percentrostered.com", "braveget.com", "skphoolmakhana.com", "uso4.com", "i7saan.com", "anderlecht.immo", "lurkingfilms.net", "affiliatemarketingproducts.xyz", "latiquecm.com", "tankomixing.com", "fatmochi.com", "terrisercovich.com", "melhoresdomessempretemm.com", "refugelarpsanfransico.com", "worryterrible.space", "0chong2.net", "bundleco.top", "lelegianstudies.com", "mreux.com", "charxprime.com", "sddn13.xyz", "luckychoice.net", "pluspace.com", "ibizguide.com", "lmdang.com", "rastipponmkh.com"]}
Multi AV Scanner detection for submitted file
Source: nowy przyk#U0142adowy katalog.exe ReversingLabs: Detection: 29%
Yara detected FormBook
Source: Yara match File source: 1.1.nowy przyk#U0142adowy katalog.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.nowy przyk#U0142adowy katalog.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.nowy przyk#U0142adowy katalog.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.nowy przyk#U0142adowy katalog.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.nowy przyk#U0142adowy katalog.exe.e840000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.nowy przyk#U0142adowy katalog.exe.e840000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.426662087.0000000000CE0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.426692042.0000000000D10000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.618855079.0000000002860000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.361409947.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.618002873.0000000000180000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.364413709.000000000E840000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.412735019.000000000F6E6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.425753060.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.395866901.000000000F6E6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.358925915.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.619144149.0000000002960000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.360578387.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Multi AV Scanner detection for domain / URL
Source: bezhantrading.com Virustotal: Detection: 5% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\nss48B9.tmp\rarelsbsy.dll ReversingLabs: Detection: 13%
Machine Learning detection for sample
Source: nowy przyk#U0142adowy katalog.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 1.2.nowy przyk#U0142adowy katalog.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.5.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen2
Source: 1.1.nowy przyk#U0142adowy katalog.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 11.2.cmstp.exe.4b5796c.4.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.3.unpack Avira: Label: TR/Patched.Ren.Gen2
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.1.unpack Avira: Label: TR/Patched.Ren.Gen2
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.2.unpack Avira: Label: TR/Patched.Ren.Gen2
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.6.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 0.2.nowy przyk#U0142adowy katalog.exe.e840000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 11.2.cmstp.exe.3bbc28.1.unpack Avira: Label: TR/Patched.Ren.Gen

Compliance:

barindex
Uses 32bit PE files
Source: nowy przyk#U0142adowy katalog.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: Binary string: cmstp.pdbGCTL source: nowy przyk#U0142adowy katalog.exe, 00000001.00000002.427125481.0000000002690000.00000040.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: nowy przyk#U0142adowy katalog.exe, 00000000.00000003.355596507.000000000E880000.00000004.00000001.sdmp, nowy przyk#U0142adowy katalog.exe, 00000001.00000002.426022117.0000000000990000.00000040.00000001.sdmp, cmstp.exe, 0000000B.00000002.619509927.0000000004620000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: nowy przyk#U0142adowy katalog.exe, cmstp.exe
Source: Binary string: cmstp.pdb source: nowy przyk#U0142adowy katalog.exe, 00000001.00000002.427125481.0000000002690000.00000040.00020000.sdmp
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_00405EC2 FindFirstFileA,FindClose, 0_2_00405EC2
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_004054EC DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 0_2_004054EC
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_00402671 FindFirstFileA, 0_2_00402671
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_10002F80 lstrcpyW,lstrlenW,lstrcpyW,lstrcatW,FindFirstFileW,wsprintfW,_GetThemeDocumentationProperty@16,_GetThemeDocumentationProperty@16,FindNextFileW,FindClose, 0_2_10002F80

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 4x nop then pop esi 1_2_00415854
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 4x nop then pop edi 1_2_004162C4
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 4x nop then pop esi 1_1_00415854
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 4x nop then pop edi 1_1_004162C4
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 4x nop then pop edi 11_2_029762C4
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 4x nop then pop esi 11_2_02975854

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49766 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49766 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49766 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49773 -> 153.127.214.206:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49773 -> 153.127.214.206:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49773 -> 153.127.214.206:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 104.248.163.187 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.tankomixing.com
Source: C:\Windows\explorer.exe Domain query: www.leads-mania.club
Source: C:\Windows\explorer.exe Network Connect: 217.160.0.33 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.bezhantrading.com
Source: C:\Windows\explorer.exe Domain query: www.americanvisionvinyl.com
Source: C:\Windows\explorer.exe Network Connect: 46.38.243.234 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.iccsukltd.com
Source: C:\Windows\explorer.exe Network Connect: 35.246.6.109 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.affiliatemarketingproducts.xyz
Source: C:\Windows\explorer.exe Network Connect: 153.127.214.206 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 138.68.74.116 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 172.67.184.156 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.worryterrible.space
Source: C:\Windows\explorer.exe Domain query: www.alles-abgedeckt.com
Source: C:\Windows\explorer.exe Domain query: www.dempseynutrition.com
Source: C:\Windows\explorer.exe Domain query: www.harada-insatsu.com
Performs DNS queries to domains with low reputation
Source: C:\Windows\explorer.exe DNS query: www.affiliatemarketingproducts.xyz
Source: DNS query: www.sddn13.xyz
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.bezhantrading.com/wtcv/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
Source: Joe Sandbox View ASN Name: SAKURA-ASAKURAInternetIncJP SAKURA-ASAKURAInternetIncJP
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /wtcv/?g2ML=crBLeffhPhH0&6lpD=T+sBBhD+jNCXQwtHdmguBNleR0ygENBETJPwbdwO/+mZKIq0Z0gdUrlML9Z9p+t2mZBgFheVMw== HTTP/1.1Host: www.worryterrible.spaceConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /wtcv/?6lpD=S1gCkNmaG9RWB/pKREaVLOJX/KdzA8KUzxvMSJydFpcLjSWhmPt8MQ7tAXeYu3xo2zwBelgJSg==&g2ML=crBLeffhPhH0 HTTP/1.1Host: www.americanvisionvinyl.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /wtcv/?g2ML=crBLeffhPhH0&6lpD=avBZXYWwHS+0cE4x4OhaeduPUSE/+pj8feHEWqkpfSZeSdEeZDPav/r/n85naepg7UJMR8VNdw== HTTP/1.1Host: www.iccsukltd.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /wtcv/?6lpD=3PEHh71NGJ6azwdPIaKj9SJxQ5GIvylohbG4MidSx9GNzMWuTZ2Cml2qwvbSyEbxmGLLoGUQ/A==&g2ML=crBLeffhPhH0 HTTP/1.1Host: www.harada-insatsu.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /wtcv/?6lpD=n99BCbv8t7R76U7aWl+Y4jwhCBMXqFH3Ss3s1uofAFeCknYKTX6A2ZhN+sblY4y892kijutCfw==&g2ML=crBLeffhPhH0 HTTP/1.1Host: www.affiliatemarketingproducts.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /wtcv/?6lpD=U8NG9FaSD2kxZB2OJ0E9golv5lIIWRC0uShqIwpBJZHTTqOYZoxmZrRB+XQzKwloE4eQBzh5Yg==&g2ML=crBLeffhPhH0 HTTP/1.1Host: www.bezhantrading.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /wtcv/?g2ML=crBLeffhPhH0&6lpD=7rFvx+oOkIknJeLSGT6zdpK11SNx3XmCJl3+oL6bUqBoSOO899RABoVcVaGdEbUjg6Jp245BoA== HTTP/1.1Host: www.alles-abgedeckt.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /wtcv/?6lpD=6uadF/xtp6SIEZXRejc5eEgqqida81Lycer078wuaqskBH7+Y9BHXTO8hpDHVP52SXbct0O1Gw==&g2ML=crBLeffhPhH0 HTTP/1.1Host: www.leads-mania.clubConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /wtcv/?g2ML=crBLeffhPhH0&6lpD=ydnZOtJN4rL7t+2rr2QP2l64KaWWig+O10p3BIFftvtUQta9c9OEvE67gAwElgS+ahtVnBS/Rg== HTTP/1.1Host: www.tankomixing.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Thu, 04 Nov 2021 10:49:10 GMTContent-Type: text/htmlContent-Length: 275ETag: "6182ae77-113"Via: 1.1 googleConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Thu, 04 Nov 2021 10:49:15 GMTContent-Type: text/htmlContent-Length: 275ETag: "6182b3d6-113"Via: 1.1 googleConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 04 Nov 2021 10:48:29 GMTServer: Apache/2.4.10 (Debian)Content-Length: 285Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 61 6c 6c 65 73 2d 61 62 67 65 64 65 63 6b 74 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.10 (Debian) Server at www.alles-abgedeckt.com Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 04 Nov 2021 10:50:03 GMTContent-Type: text/html; charset=utf-8Content-Length: 2963Connection: closex-wix-request-id: 1636023003.449130355506120675Age: 0Server-Timing: cache;desc=miss, varnish;desc=miss, dc;desc=euw2X-Seen-By: sHU62EDOGnH2FBkJkG/Wx8EeXWsWdHrhlvbxtlynkVjVnh5Kklh0tOjeXRNYui2I,qquldgcFrj2n046g4RNSVOc9uRR3b9ESRFQmutE6otVYgeUJqUXtid+86vZww+nL,2d58ifebGbosy5xc+FRalt5/ToY82z3f1Iadd1mDV+wfoIgWdv1pdEYpwcIu9suB3fKEXQvQlSAkB/lstal9R17zYLyYyrK+fg616qIKE8c=,2UNV7KOq4oGjA5+PKsX47IJCkNcL1UXXT2AxlbYijuBYgeUJqUXtid+86vZww+nL,2+8df7/86SpxIBpm+VHpf+i/fkkIKkD/fZgnosx7etd9pAiCxHhredE3m8SaSeMp,l7Ey5khejq81S7sxGe5NkxC4MYanLpg+PuBnb2R7HRGTzRA6xkSHdTdM1EufzDIPWIHlCalF7YnfvOr2cMPpyw==,9y9YchCOVZDNGbMpBN9NeuuXxLvkVaG5VQb5mydxWWiYfoPtReGns7o6BqA+77AHvGQ2Otd3B2C27oTTIAKJtQ==Vary: Accept-EncodingX-Content-Type-Options: nosniffServer: Pepyaka/1.19.10Data Raw: 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f Data Ascii: <!-- --><!doctype html><!-- --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-scale=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' | translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width"> <meta name="robo
Source: cmstp.exe, 0000000B.00000002.620985574.0000000004CD2000.00000004.00020000.sdmp String found in binary or memory: http://browsehappy.com/
Source: nowy przyk#U0142adowy katalog.exe String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: nowy przyk#U0142adowy katalog.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000005.00000000.364768188.000000000095C000.00000004.00000020.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: unknown DNS traffic detected: queries for: www.worryterrible.space
Source: global traffic HTTP traffic detected: GET /wtcv/?g2ML=crBLeffhPhH0&6lpD=T+sBBhD+jNCXQwtHdmguBNleR0ygENBETJPwbdwO/+mZKIq0Z0gdUrlML9Z9p+t2mZBgFheVMw== HTTP/1.1Host: www.worryterrible.spaceConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /wtcv/?6lpD=S1gCkNmaG9RWB/pKREaVLOJX/KdzA8KUzxvMSJydFpcLjSWhmPt8MQ7tAXeYu3xo2zwBelgJSg==&g2ML=crBLeffhPhH0 HTTP/1.1Host: www.americanvisionvinyl.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /wtcv/?g2ML=crBLeffhPhH0&6lpD=avBZXYWwHS+0cE4x4OhaeduPUSE/+pj8feHEWqkpfSZeSdEeZDPav/r/n85naepg7UJMR8VNdw== HTTP/1.1Host: www.iccsukltd.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /wtcv/?6lpD=3PEHh71NGJ6azwdPIaKj9SJxQ5GIvylohbG4MidSx9GNzMWuTZ2Cml2qwvbSyEbxmGLLoGUQ/A==&g2ML=crBLeffhPhH0 HTTP/1.1Host: www.harada-insatsu.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /wtcv/?6lpD=n99BCbv8t7R76U7aWl+Y4jwhCBMXqFH3Ss3s1uofAFeCknYKTX6A2ZhN+sblY4y892kijutCfw==&g2ML=crBLeffhPhH0 HTTP/1.1Host: www.affiliatemarketingproducts.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /wtcv/?6lpD=U8NG9FaSD2kxZB2OJ0E9golv5lIIWRC0uShqIwpBJZHTTqOYZoxmZrRB+XQzKwloE4eQBzh5Yg==&g2ML=crBLeffhPhH0 HTTP/1.1Host: www.bezhantrading.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /wtcv/?g2ML=crBLeffhPhH0&6lpD=7rFvx+oOkIknJeLSGT6zdpK11SNx3XmCJl3+oL6bUqBoSOO899RABoVcVaGdEbUjg6Jp245BoA== HTTP/1.1Host: www.alles-abgedeckt.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /wtcv/?6lpD=6uadF/xtp6SIEZXRejc5eEgqqida81Lycer078wuaqskBH7+Y9BHXTO8hpDHVP52SXbct0O1Gw==&g2ML=crBLeffhPhH0 HTTP/1.1Host: www.leads-mania.clubConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /wtcv/?g2ML=crBLeffhPhH0&6lpD=ydnZOtJN4rL7t+2rr2QP2l64KaWWig+O10p3BIFftvtUQta9c9OEvE67gAwElgS+ahtVnBS/Rg== HTTP/1.1Host: www.tankomixing.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: nowy przyk#U0142adowy katalog.exe, 00000000.00000002.362117708.000000000077A000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_00404FF1 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_00404FF1

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 1.1.nowy przyk#U0142adowy katalog.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.nowy przyk#U0142adowy katalog.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.nowy przyk#U0142adowy katalog.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.nowy przyk#U0142adowy katalog.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.nowy przyk#U0142adowy katalog.exe.e840000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.nowy przyk#U0142adowy katalog.exe.e840000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.426662087.0000000000CE0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.426692042.0000000000D10000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.618855079.0000000002860000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.361409947.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.618002873.0000000000180000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.364413709.000000000E840000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.412735019.000000000F6E6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.425753060.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.395866901.000000000F6E6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.358925915.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.619144149.0000000002960000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.360578387.0000000000400000.00000040.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 1.1.nowy przyk#U0142adowy katalog.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.nowy przyk#U0142adowy katalog.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.nowy przyk#U0142adowy katalog.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.nowy przyk#U0142adowy katalog.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.1.nowy przyk#U0142adowy katalog.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.nowy przyk#U0142adowy katalog.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.nowy przyk#U0142adowy katalog.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.nowy przyk#U0142adowy katalog.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.nowy przyk#U0142adowy katalog.exe.e840000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.nowy przyk#U0142adowy katalog.exe.e840000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.nowy przyk#U0142adowy katalog.exe.e840000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.nowy przyk#U0142adowy katalog.exe.e840000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.426662087.0000000000CE0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.426662087.0000000000CE0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.426692042.0000000000D10000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.426692042.0000000000D10000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.618855079.0000000002860000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.618855079.0000000002860000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000001.361409947.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000001.361409947.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.618002873.0000000000180000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.618002873.0000000000180000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.364413709.000000000E840000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.364413709.000000000E840000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.412735019.000000000F6E6000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.412735019.000000000F6E6000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.425753060.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.425753060.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.395866901.000000000F6E6000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.395866901.000000000F6E6000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.358925915.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000000.358925915.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.619144149.0000000002960000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.619144149.0000000002960000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.360578387.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000000.360578387.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: nowy przyk#U0142adowy katalog.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Uses a Windows Living Off The Land Binaries (LOL bins)
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cmstp.exe C:\Windows\SysWOW64\cmstp.exe
Yara signature match
Source: 1.1.nowy przyk#U0142adowy katalog.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.nowy przyk#U0142adowy katalog.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.nowy przyk#U0142adowy katalog.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.nowy przyk#U0142adowy katalog.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.1.nowy przyk#U0142adowy katalog.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.nowy przyk#U0142adowy katalog.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.nowy przyk#U0142adowy katalog.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.nowy przyk#U0142adowy katalog.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.nowy przyk#U0142adowy katalog.exe.e840000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.nowy przyk#U0142adowy katalog.exe.e840000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.nowy przyk#U0142adowy katalog.exe.e840000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.nowy przyk#U0142adowy katalog.exe.e840000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.426662087.0000000000CE0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.426662087.0000000000CE0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.426692042.0000000000D10000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.426692042.0000000000D10000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.618855079.0000000002860000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.618855079.0000000002860000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000001.361409947.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000001.361409947.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.618002873.0000000000180000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.618002873.0000000000180000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.364413709.000000000E840000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.364413709.000000000E840000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.412735019.000000000F6E6000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.412735019.000000000F6E6000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.425753060.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.425753060.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.395866901.000000000F6E6000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.395866901.000000000F6E6000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.358925915.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000000.358925915.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.619144149.0000000002960000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.619144149.0000000002960000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.360578387.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000000.360578387.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_0040312A EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 0_2_0040312A
Detected potential crypto function
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_00406354 0_2_00406354
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_00404802 0_2_00404802
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_00406B2B 0_2_00406B2B
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_10004E3E 0_2_10004E3E
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_10003770 0_2_10003770
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_1000C461 0_2_1000C461
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_1000AC82 0_2_1000AC82
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_10009574 0_2_10009574
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_1000B1F4 0_2_1000B1F4
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_10015A1A 0_2_10015A1A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_10015A29 0_2_10015A29
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_1000A710 0_2_1000A710
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_1000D3CD 0_2_1000D3CD
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00401027 1_2_00401027
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00401030 1_2_00401030
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_0041C94E 1_2_0041C94E
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_0041BA19 1_2_0041BA19
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_0041C3F9 1_2_0041C3F9
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00408C90 1_2_00408C90
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00402D90 1_2_00402D90
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_0041BF22 1_2_0041BF22
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00402FB0 1_2_00402FB0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A820A8 1_2_00A820A8
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009CB090 1_2_009CB090
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E20A0 1_2_009E20A0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A828EC 1_2_00A828EC
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A71002 1_2_00A71002
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009BF900 1_2_009BF900
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009D4120 1_2_009D4120
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A822AE 1_2_00A822AE
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009EEBB0 1_2_009EEBB0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A7DBD2 1_2_00A7DBD2
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A82B28 1_2_00A82B28
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C841F 1_2_009C841F
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A7D466 1_2_00A7D466
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E2581 1_2_009E2581
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A825DD 1_2_00A825DD
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009CD5E0 1_2_009CD5E0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A82D07 1_2_00A82D07
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B0D20 1_2_009B0D20
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A81D55 1_2_00A81D55
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A82EF7 1_2_00A82EF7
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009D6E30 1_2_009D6E30
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A81FF1 1_2_00A81FF1
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_00401027 1_1_00401027
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_00401030 1_1_00401030
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_0041C94E 1_1_0041C94E
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_0041BA19 1_1_0041BA19
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_0041C3F9 1_1_0041C3F9
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_00408C90 1_1_00408C90
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_00402D90 1_1_00402D90
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_0041BF22 1_1_0041BF22
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_00402FB0 1_1_00402FB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0470D466 11_2_0470D466
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04701002 11_2_04701002
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0465841F 11_2_0465841F
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_047128EC 11_2_047128EC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046720A0 11_2_046720A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_047120A8 11_2_047120A8
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0465B090 11_2_0465B090
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04711D55 11_2_04711D55
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04640D20 11_2_04640D20
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04664120 11_2_04664120
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0464F900 11_2_0464F900
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04712D07 11_2_04712D07
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0465D5E0 11_2_0465D5E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_047125DD 11_2_047125DD
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04672581 11_2_04672581
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04666E30 11_2_04666E30
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04712EF7 11_2_04712EF7
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_047122AE 11_2_047122AE
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04712B28 11_2_04712B28
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04711FF1 11_2_04711FF1
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0470DBD2 11_2_0470DBD2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0467EBB0 11_2_0467EBB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0297C94E 11_2_0297C94E
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_02962FB0 11_2_02962FB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_02968C90 11_2_02968C90
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_02962D90 11_2_02962D90
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: String function: 0041A4B0 appears 38 times
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: String function: 009BB150 appears 35 times
Source: C:\Windows\SysWOW64\cmstp.exe Code function: String function: 0464B150 appears 35 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_004185D0 NtCreateFile, 1_2_004185D0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00418680 NtReadFile, 1_2_00418680
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00418700 NtClose, 1_2_00418700
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_004187B0 NtAllocateVirtualMemory, 1_2_004187B0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_004185CD NtCreateFile, 1_2_004185CD
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_0041867E NtReadFile, 1_2_0041867E
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_004186FA NtClose, 1_2_004186FA
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_004187AA NtAllocateVirtualMemory, 1_2_004187AA
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F98F0 NtReadVirtualMemory,LdrInitializeThunk, 1_2_009F98F0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9840 NtDelayExecution,LdrInitializeThunk, 1_2_009F9840
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9860 NtQuerySystemInformation,LdrInitializeThunk, 1_2_009F9860
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F99A0 NtCreateSection,LdrInitializeThunk, 1_2_009F99A0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 1_2_009F9910
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9A00 NtProtectVirtualMemory,LdrInitializeThunk, 1_2_009F9A00
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9A20 NtResumeThread,LdrInitializeThunk, 1_2_009F9A20
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9A50 NtCreateFile,LdrInitializeThunk, 1_2_009F9A50
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F95D0 NtClose,LdrInitializeThunk, 1_2_009F95D0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9540 NtReadFile,LdrInitializeThunk, 1_2_009F9540
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F96E0 NtFreeVirtualMemory,LdrInitializeThunk, 1_2_009F96E0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9660 NtAllocateVirtualMemory,LdrInitializeThunk, 1_2_009F9660
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9780 NtMapViewOfSection,LdrInitializeThunk, 1_2_009F9780
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F97A0 NtUnmapViewOfSection,LdrInitializeThunk, 1_2_009F97A0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9FE0 NtCreateMutant,LdrInitializeThunk, 1_2_009F9FE0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9710 NtQueryInformationToken,LdrInitializeThunk, 1_2_009F9710
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F98A0 NtWriteVirtualMemory, 1_2_009F98A0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9820 NtEnumerateKey, 1_2_009F9820
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009FB040 NtSuspendThread, 1_2_009FB040
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F99D0 NtCreateProcessEx, 1_2_009F99D0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9950 NtQueueApcThread, 1_2_009F9950
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9A80 NtOpenDirectoryObject, 1_2_009F9A80
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9A10 NtQuerySection, 1_2_009F9A10
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009FA3B0 NtGetContextThread, 1_2_009FA3B0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9B00 NtSetValueKey, 1_2_009F9B00
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F95F0 NtQueryInformationFile, 1_2_009F95F0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009FAD30 NtSetContextThread, 1_2_009FAD30
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9520 NtWaitForSingleObject, 1_2_009F9520
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9560 NtWriteFile, 1_2_009F9560
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F96D0 NtCreateKey, 1_2_009F96D0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9610 NtEnumerateValueKey, 1_2_009F9610
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9650 NtQueryValueKey, 1_2_009F9650
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9670 NtQueryInformationProcess, 1_2_009F9670
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009FA710 NtOpenProcessToken, 1_2_009FA710
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9730 NtQueryVirtualMemory, 1_2_009F9730
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9770 NtSetInformationFile, 1_2_009F9770
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009FA770 NtOpenThread, 1_2_009FA770
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F9760 NtOpenProcess, 1_2_009F9760
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_004185D0 NtCreateFile, 1_1_004185D0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_00418680 NtReadFile, 1_1_00418680
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_00418700 NtClose, 1_1_00418700
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_004187B0 NtAllocateVirtualMemory, 1_1_004187B0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_004185CD NtCreateFile, 1_1_004185CD
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_0041867E NtReadFile, 1_1_0041867E
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_004186FA NtClose, 1_1_004186FA
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_004187AA NtAllocateVirtualMemory, 1_1_004187AA
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689860 NtQuerySystemInformation,LdrInitializeThunk, 11_2_04689860
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689840 NtDelayExecution,LdrInitializeThunk, 11_2_04689840
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689540 NtReadFile,LdrInitializeThunk, 11_2_04689540
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689910 NtAdjustPrivilegesToken,LdrInitializeThunk, 11_2_04689910
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046895D0 NtClose,LdrInitializeThunk, 11_2_046895D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046899A0 NtCreateSection,LdrInitializeThunk, 11_2_046899A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689660 NtAllocateVirtualMemory,LdrInitializeThunk, 11_2_04689660
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689650 NtQueryValueKey,LdrInitializeThunk, 11_2_04689650
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689A50 NtCreateFile,LdrInitializeThunk, 11_2_04689A50
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046896E0 NtFreeVirtualMemory,LdrInitializeThunk, 11_2_046896E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046896D0 NtCreateKey,LdrInitializeThunk, 11_2_046896D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689710 NtQueryInformationToken,LdrInitializeThunk, 11_2_04689710
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689FE0 NtCreateMutant,LdrInitializeThunk, 11_2_04689FE0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689780 NtMapViewOfSection,LdrInitializeThunk, 11_2_04689780
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0468B040 NtSuspendThread, 11_2_0468B040
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689820 NtEnumerateKey, 11_2_04689820
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046898F0 NtReadVirtualMemory, 11_2_046898F0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046898A0 NtWriteVirtualMemory, 11_2_046898A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689560 NtWriteFile, 11_2_04689560
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689950 NtQueueApcThread, 11_2_04689950
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689520 NtWaitForSingleObject, 11_2_04689520
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0468AD30 NtSetContextThread, 11_2_0468AD30
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046895F0 NtQueryInformationFile, 11_2_046895F0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046899D0 NtCreateProcessEx, 11_2_046899D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689670 NtQueryInformationProcess, 11_2_04689670
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689A20 NtResumeThread, 11_2_04689A20
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689A00 NtProtectVirtualMemory, 11_2_04689A00
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689610 NtEnumerateValueKey, 11_2_04689610
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689A10 NtQuerySection, 11_2_04689A10
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689A80 NtOpenDirectoryObject, 11_2_04689A80
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689760 NtOpenProcess, 11_2_04689760
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689770 NtSetInformationFile, 11_2_04689770
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0468A770 NtOpenThread, 11_2_0468A770
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689730 NtQueryVirtualMemory, 11_2_04689730
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04689B00 NtSetValueKey, 11_2_04689B00
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0468A710 NtOpenProcessToken, 11_2_0468A710
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046897A0 NtUnmapViewOfSection, 11_2_046897A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0468A3B0 NtGetContextThread, 11_2_0468A3B0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_02978680 NtReadFile, 11_2_02978680
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_029787B0 NtAllocateVirtualMemory, 11_2_029787B0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_02978700 NtClose, 11_2_02978700
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_029785D0 NtCreateFile, 11_2_029785D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_029786FA NtClose, 11_2_029786FA
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0297867E NtReadFile, 11_2_0297867E
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_029787AA NtAllocateVirtualMemory, 11_2_029787AA
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_029785CD NtCreateFile, 11_2_029785CD
Sample file is different than original file name gathered from version info
Source: nowy przyk#U0142adowy katalog.exe, 00000000.00000003.360157911.000000000EB2F000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs nowy przyk#U0142adowy katalog.exe
Source: nowy przyk#U0142adowy katalog.exe, 00000001.00000002.426560618.0000000000C3F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs nowy przyk#U0142adowy katalog.exe
Source: nowy przyk#U0142adowy katalog.exe, 00000001.00000002.427125481.0000000002690000.00000040.00020000.sdmp Binary or memory string: OriginalFilenameCMSTP.EXE` vs nowy przyk#U0142adowy katalog.exe
PE file contains strange resources
Source: nowy przyk#U0142adowy katalog.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: nowy przyk#U0142adowy katalog.exe ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe File read: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Jump to behavior
Source: nowy przyk#U0142adowy katalog.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe "C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe"
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Process created: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe "C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe"
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cmstp.exe C:\Windows\SysWOW64\cmstp.exe
Source: C:\Windows\SysWOW64\cmstp.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Process created: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe "C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe" Jump to behavior
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe File created: C:\Users\user\AppData\Local\Temp\nsi487A.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/2@11/9
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_00402053 CoCreateInstance,MultiByteToWideChar, 0_2_00402053
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_004042C1 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 0_2_004042C1
Source: nowy przyk#U0142adowy katalog.exe Joe Sandbox Cloud Basic: Detection: clean Score: 0 Perma Link
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5548:120:WilError_01
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Binary string: cmstp.pdbGCTL source: nowy przyk#U0142adowy katalog.exe, 00000001.00000002.427125481.0000000002690000.00000040.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: nowy przyk#U0142adowy katalog.exe, 00000000.00000003.355596507.000000000E880000.00000004.00000001.sdmp, nowy przyk#U0142adowy katalog.exe, 00000001.00000002.426022117.0000000000990000.00000040.00000001.sdmp, cmstp.exe, 0000000B.00000002.619509927.0000000004620000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: nowy przyk#U0142adowy katalog.exe, cmstp.exe
Source: Binary string: cmstp.pdb source: nowy przyk#U0142adowy katalog.exe, 00000001.00000002.427125481.0000000002690000.00000040.00020000.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_10005CC5 push ecx; ret 0_2_10005CD8
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_0041B87C push eax; ret 1_2_0041B882
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_0041B812 push eax; ret 1_2_0041B818
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_0041B81B push eax; ret 1_2_0041B882
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00416036 push cs; ret 1_2_0041604B
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_0041A988 push cs; ret 1_2_0041A989
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00415C85 push 0000003Eh; ret 1_2_00415C87
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00414EBC push ecx; retf 1_2_00414EBD
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_0041B7C5 push eax; ret 1_2_0041B818
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A0D0D1 push ecx; ret 1_2_00A0D0E4
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_0041B87C push eax; ret 1_1_0041B882
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_0041B812 push eax; ret 1_1_0041B818
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_0041B81B push eax; ret 1_1_0041B882
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_00416036 push cs; ret 1_1_0041604B
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_0041A988 push cs; ret 1_1_0041A989
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_00415C85 push 0000003Eh; ret 1_1_00415C87
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_00414EBC push ecx; retf 1_1_00414EBD
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_1_0041B7C5 push eax; ret 1_1_0041B818
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0469D0D1 push ecx; ret 11_2_0469D0E4
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0297B812 push eax; ret 11_2_0297B818
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0297B81B push eax; ret 11_2_0297B882
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_02976036 push cs; ret 11_2_0297604B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0297B87C push eax; ret 11_2_0297B882
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0297A988 push cs; ret 11_2_0297A989
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_02974EBC push ecx; retf 11_2_02974EBD
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0297B7C5 push eax; ret 11_2_0297B818
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_02975C85 push 0000003Eh; ret 11_2_02975C87

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe File created: C:\Users\user\AppData\Local\Temp\nss48B9.tmp\rarelsbsy.dll Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Self deletion via cmd delete
Source: C:\Windows\SysWOW64\cmstp.exe Process created: /c del "C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe"
Source: C:\Windows\SysWOW64\cmstp.exe Process created: /c del "C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe" Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_10004E3E RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_10004E3E
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe RDTSC instruction interceptor: First address: 0000000000408614 second address: 000000000040861A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe RDTSC instruction interceptor: First address: 00000000004089AE second address: 00000000004089B4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmstp.exe RDTSC instruction interceptor: First address: 0000000002968614 second address: 000000000296861A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmstp.exe RDTSC instruction interceptor: First address: 00000000029689AE second address: 00000000029689B4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 5448 Thread sleep time: -40000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe TID: 776 Thread sleep time: -42000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmstp.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmstp.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_004088E0 rdtsc 1_2_004088E0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_00405EC2 FindFirstFileA,FindClose, 0_2_00405EC2
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_004054EC DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 0_2_004054EC
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_00402671 FindFirstFileA, 0_2_00402671
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_10002F80 lstrcpyW,lstrlenW,lstrcpyW,lstrcatW,FindFirstFileW,wsprintfW,_GetThemeDocumentationProperty@16,_GetThemeDocumentationProperty@16,FindNextFileW,FindClose, 0_2_10002F80
Source: explorer.exe, 00000005.00000000.371834942.00000000083E0000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000005.00000000.409164821.0000000008430000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000005.00000000.403585689.0000000006420000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.371834942.00000000083E0000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000005.00000000.408833360.00000000082E2000.00000004.00000001.sdmp Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Y
Source: explorer.exe, 00000005.00000000.403585689.0000000006420000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.408833360.00000000082E2000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 00000005.00000000.382841011.000000000461E000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Y
Source: explorer.exe, 00000005.00000000.408833360.00000000082E2000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000005.00000000.409164821.0000000008430000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: explorer.exe, 00000005.00000000.364768188.000000000095C000.00000004.00000020.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_10008417 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 0_2_10008417
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_10008417 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 0_2_10008417
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_10003770 rtrystwqtc,GetProcessHeap,RtlAllocateHeap,VirtualProtect, 0_2_10003770
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_004088E0 rdtsc 1_2_004088E0
Enables debug privileges
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_10015406 mov eax, dword ptr fs:[00000030h] 0_2_10015406
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_1001561A mov eax, dword ptr fs:[00000030h] 0_2_1001561A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_100156CB mov eax, dword ptr fs:[00000030h] 0_2_100156CB
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_1001570A mov eax, dword ptr fs:[00000030h] 0_2_1001570A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_10015748 mov eax, dword ptr fs:[00000030h] 0_2_10015748
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B9080 mov eax, dword ptr fs:[00000030h] 1_2_009B9080
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009EF0BF mov ecx, dword ptr fs:[00000030h] 1_2_009EF0BF
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009EF0BF mov eax, dword ptr fs:[00000030h] 1_2_009EF0BF
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009EF0BF mov eax, dword ptr fs:[00000030h] 1_2_009EF0BF
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A33884 mov eax, dword ptr fs:[00000030h] 1_2_00A33884
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A33884 mov eax, dword ptr fs:[00000030h] 1_2_00A33884
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F90AF mov eax, dword ptr fs:[00000030h] 1_2_009F90AF
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E20A0 mov eax, dword ptr fs:[00000030h] 1_2_009E20A0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E20A0 mov eax, dword ptr fs:[00000030h] 1_2_009E20A0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E20A0 mov eax, dword ptr fs:[00000030h] 1_2_009E20A0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E20A0 mov eax, dword ptr fs:[00000030h] 1_2_009E20A0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E20A0 mov eax, dword ptr fs:[00000030h] 1_2_009E20A0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E20A0 mov eax, dword ptr fs:[00000030h] 1_2_009E20A0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A4B8D0 mov eax, dword ptr fs:[00000030h] 1_2_00A4B8D0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A4B8D0 mov ecx, dword ptr fs:[00000030h] 1_2_00A4B8D0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A4B8D0 mov eax, dword ptr fs:[00000030h] 1_2_00A4B8D0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A4B8D0 mov eax, dword ptr fs:[00000030h] 1_2_00A4B8D0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A4B8D0 mov eax, dword ptr fs:[00000030h] 1_2_00A4B8D0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A4B8D0 mov eax, dword ptr fs:[00000030h] 1_2_00A4B8D0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B58EC mov eax, dword ptr fs:[00000030h] 1_2_009B58EC
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E002D mov eax, dword ptr fs:[00000030h] 1_2_009E002D
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E002D mov eax, dword ptr fs:[00000030h] 1_2_009E002D
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E002D mov eax, dword ptr fs:[00000030h] 1_2_009E002D
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E002D mov eax, dword ptr fs:[00000030h] 1_2_009E002D
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E002D mov eax, dword ptr fs:[00000030h] 1_2_009E002D
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A37016 mov eax, dword ptr fs:[00000030h] 1_2_00A37016
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A37016 mov eax, dword ptr fs:[00000030h] 1_2_00A37016
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A37016 mov eax, dword ptr fs:[00000030h] 1_2_00A37016
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009CB02A mov eax, dword ptr fs:[00000030h] 1_2_009CB02A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009CB02A mov eax, dword ptr fs:[00000030h] 1_2_009CB02A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009CB02A mov eax, dword ptr fs:[00000030h] 1_2_009CB02A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009CB02A mov eax, dword ptr fs:[00000030h] 1_2_009CB02A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A84015 mov eax, dword ptr fs:[00000030h] 1_2_00A84015
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A84015 mov eax, dword ptr fs:[00000030h] 1_2_00A84015
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009D0050 mov eax, dword ptr fs:[00000030h] 1_2_009D0050
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009D0050 mov eax, dword ptr fs:[00000030h] 1_2_009D0050
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A72073 mov eax, dword ptr fs:[00000030h] 1_2_00A72073
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A81074 mov eax, dword ptr fs:[00000030h] 1_2_00A81074
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A369A6 mov eax, dword ptr fs:[00000030h] 1_2_00A369A6
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E2990 mov eax, dword ptr fs:[00000030h] 1_2_009E2990
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009EA185 mov eax, dword ptr fs:[00000030h] 1_2_009EA185
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A351BE mov eax, dword ptr fs:[00000030h] 1_2_00A351BE
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A351BE mov eax, dword ptr fs:[00000030h] 1_2_00A351BE
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A351BE mov eax, dword ptr fs:[00000030h] 1_2_00A351BE
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A351BE mov eax, dword ptr fs:[00000030h] 1_2_00A351BE
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009DC182 mov eax, dword ptr fs:[00000030h] 1_2_009DC182
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E61A0 mov eax, dword ptr fs:[00000030h] 1_2_009E61A0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E61A0 mov eax, dword ptr fs:[00000030h] 1_2_009E61A0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A441E8 mov eax, dword ptr fs:[00000030h] 1_2_00A441E8
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009BB1E1 mov eax, dword ptr fs:[00000030h] 1_2_009BB1E1
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009BB1E1 mov eax, dword ptr fs:[00000030h] 1_2_009BB1E1
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009BB1E1 mov eax, dword ptr fs:[00000030h] 1_2_009BB1E1
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B9100 mov eax, dword ptr fs:[00000030h] 1_2_009B9100
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B9100 mov eax, dword ptr fs:[00000030h] 1_2_009B9100
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B9100 mov eax, dword ptr fs:[00000030h] 1_2_009B9100
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E513A mov eax, dword ptr fs:[00000030h] 1_2_009E513A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E513A mov eax, dword ptr fs:[00000030h] 1_2_009E513A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009D4120 mov eax, dword ptr fs:[00000030h] 1_2_009D4120
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009D4120 mov eax, dword ptr fs:[00000030h] 1_2_009D4120
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009D4120 mov eax, dword ptr fs:[00000030h] 1_2_009D4120
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009D4120 mov eax, dword ptr fs:[00000030h] 1_2_009D4120
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009D4120 mov ecx, dword ptr fs:[00000030h] 1_2_009D4120
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009DB944 mov eax, dword ptr fs:[00000030h] 1_2_009DB944
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009DB944 mov eax, dword ptr fs:[00000030h] 1_2_009DB944
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009BB171 mov eax, dword ptr fs:[00000030h] 1_2_009BB171
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009BB171 mov eax, dword ptr fs:[00000030h] 1_2_009BB171
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009BC962 mov eax, dword ptr fs:[00000030h] 1_2_009BC962
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009ED294 mov eax, dword ptr fs:[00000030h] 1_2_009ED294
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009ED294 mov eax, dword ptr fs:[00000030h] 1_2_009ED294
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009CAAB0 mov eax, dword ptr fs:[00000030h] 1_2_009CAAB0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009CAAB0 mov eax, dword ptr fs:[00000030h] 1_2_009CAAB0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009EFAB0 mov eax, dword ptr fs:[00000030h] 1_2_009EFAB0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B52A5 mov eax, dword ptr fs:[00000030h] 1_2_009B52A5
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B52A5 mov eax, dword ptr fs:[00000030h] 1_2_009B52A5
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B52A5 mov eax, dword ptr fs:[00000030h] 1_2_009B52A5
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B52A5 mov eax, dword ptr fs:[00000030h] 1_2_009B52A5
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B52A5 mov eax, dword ptr fs:[00000030h] 1_2_009B52A5
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E2ACB mov eax, dword ptr fs:[00000030h] 1_2_009E2ACB
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E2AE4 mov eax, dword ptr fs:[00000030h] 1_2_009E2AE4
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009D3A1C mov eax, dword ptr fs:[00000030h] 1_2_009D3A1C
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B5210 mov eax, dword ptr fs:[00000030h] 1_2_009B5210
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B5210 mov ecx, dword ptr fs:[00000030h] 1_2_009B5210
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B5210 mov eax, dword ptr fs:[00000030h] 1_2_009B5210
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B5210 mov eax, dword ptr fs:[00000030h] 1_2_009B5210
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009BAA16 mov eax, dword ptr fs:[00000030h] 1_2_009BAA16
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009BAA16 mov eax, dword ptr fs:[00000030h] 1_2_009BAA16
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C8A0A mov eax, dword ptr fs:[00000030h] 1_2_009C8A0A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F4A2C mov eax, dword ptr fs:[00000030h] 1_2_009F4A2C
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F4A2C mov eax, dword ptr fs:[00000030h] 1_2_009F4A2C
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A6B260 mov eax, dword ptr fs:[00000030h] 1_2_00A6B260
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A6B260 mov eax, dword ptr fs:[00000030h] 1_2_00A6B260
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A88A62 mov eax, dword ptr fs:[00000030h] 1_2_00A88A62
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B9240 mov eax, dword ptr fs:[00000030h] 1_2_009B9240
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B9240 mov eax, dword ptr fs:[00000030h] 1_2_009B9240
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B9240 mov eax, dword ptr fs:[00000030h] 1_2_009B9240
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B9240 mov eax, dword ptr fs:[00000030h] 1_2_009B9240
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F927A mov eax, dword ptr fs:[00000030h] 1_2_009F927A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A7EA55 mov eax, dword ptr fs:[00000030h] 1_2_00A7EA55
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A44257 mov eax, dword ptr fs:[00000030h] 1_2_00A44257
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E2397 mov eax, dword ptr fs:[00000030h] 1_2_009E2397
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A85BA5 mov eax, dword ptr fs:[00000030h] 1_2_00A85BA5
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009EB390 mov eax, dword ptr fs:[00000030h] 1_2_009EB390
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C1B8F mov eax, dword ptr fs:[00000030h] 1_2_009C1B8F
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C1B8F mov eax, dword ptr fs:[00000030h] 1_2_009C1B8F
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A6D380 mov ecx, dword ptr fs:[00000030h] 1_2_00A6D380
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A7138A mov eax, dword ptr fs:[00000030h] 1_2_00A7138A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E4BAD mov eax, dword ptr fs:[00000030h] 1_2_009E4BAD
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E4BAD mov eax, dword ptr fs:[00000030h] 1_2_009E4BAD
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E4BAD mov eax, dword ptr fs:[00000030h] 1_2_009E4BAD
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A353CA mov eax, dword ptr fs:[00000030h] 1_2_00A353CA
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A353CA mov eax, dword ptr fs:[00000030h] 1_2_00A353CA
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009DDBE9 mov eax, dword ptr fs:[00000030h] 1_2_009DDBE9
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E03E2 mov eax, dword ptr fs:[00000030h] 1_2_009E03E2
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E03E2 mov eax, dword ptr fs:[00000030h] 1_2_009E03E2
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E03E2 mov eax, dword ptr fs:[00000030h] 1_2_009E03E2
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E03E2 mov eax, dword ptr fs:[00000030h] 1_2_009E03E2
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E03E2 mov eax, dword ptr fs:[00000030h] 1_2_009E03E2
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E03E2 mov eax, dword ptr fs:[00000030h] 1_2_009E03E2
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A7131B mov eax, dword ptr fs:[00000030h] 1_2_00A7131B
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009BF358 mov eax, dword ptr fs:[00000030h] 1_2_009BF358
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009BDB40 mov eax, dword ptr fs:[00000030h] 1_2_009BDB40
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E3B7A mov eax, dword ptr fs:[00000030h] 1_2_009E3B7A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E3B7A mov eax, dword ptr fs:[00000030h] 1_2_009E3B7A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A88B58 mov eax, dword ptr fs:[00000030h] 1_2_00A88B58
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009BDB60 mov ecx, dword ptr fs:[00000030h] 1_2_009BDB60
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C849B mov eax, dword ptr fs:[00000030h] 1_2_009C849B
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A36CF0 mov eax, dword ptr fs:[00000030h] 1_2_00A36CF0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A36CF0 mov eax, dword ptr fs:[00000030h] 1_2_00A36CF0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A36CF0 mov eax, dword ptr fs:[00000030h] 1_2_00A36CF0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A714FB mov eax, dword ptr fs:[00000030h] 1_2_00A714FB
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A88CD6 mov eax, dword ptr fs:[00000030h] 1_2_00A88CD6
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A71C06 mov eax, dword ptr fs:[00000030h] 1_2_00A71C06
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A71C06 mov eax, dword ptr fs:[00000030h] 1_2_00A71C06
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A71C06 mov eax, dword ptr fs:[00000030h] 1_2_00A71C06
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A71C06 mov eax, dword ptr fs:[00000030h] 1_2_00A71C06
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A71C06 mov eax, dword ptr fs:[00000030h] 1_2_00A71C06
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A71C06 mov eax, dword ptr fs:[00000030h] 1_2_00A71C06
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A71C06 mov eax, dword ptr fs:[00000030h] 1_2_00A71C06
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A71C06 mov eax, dword ptr fs:[00000030h] 1_2_00A71C06
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A71C06 mov eax, dword ptr fs:[00000030h] 1_2_00A71C06
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A71C06 mov eax, dword ptr fs:[00000030h] 1_2_00A71C06
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A71C06 mov eax, dword ptr fs:[00000030h] 1_2_00A71C06
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A71C06 mov eax, dword ptr fs:[00000030h] 1_2_00A71C06
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A71C06 mov eax, dword ptr fs:[00000030h] 1_2_00A71C06
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A71C06 mov eax, dword ptr fs:[00000030h] 1_2_00A71C06
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A8740D mov eax, dword ptr fs:[00000030h] 1_2_00A8740D
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A8740D mov eax, dword ptr fs:[00000030h] 1_2_00A8740D
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A8740D mov eax, dword ptr fs:[00000030h] 1_2_00A8740D
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A36C0A mov eax, dword ptr fs:[00000030h] 1_2_00A36C0A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A36C0A mov eax, dword ptr fs:[00000030h] 1_2_00A36C0A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A36C0A mov eax, dword ptr fs:[00000030h] 1_2_00A36C0A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A36C0A mov eax, dword ptr fs:[00000030h] 1_2_00A36C0A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009EBC2C mov eax, dword ptr fs:[00000030h] 1_2_009EBC2C
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009EA44B mov eax, dword ptr fs:[00000030h] 1_2_009EA44B
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009D746D mov eax, dword ptr fs:[00000030h] 1_2_009D746D
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A4C450 mov eax, dword ptr fs:[00000030h] 1_2_00A4C450
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A4C450 mov eax, dword ptr fs:[00000030h] 1_2_00A4C450
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A805AC mov eax, dword ptr fs:[00000030h] 1_2_00A805AC
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A805AC mov eax, dword ptr fs:[00000030h] 1_2_00A805AC
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009EFD9B mov eax, dword ptr fs:[00000030h] 1_2_009EFD9B
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009EFD9B mov eax, dword ptr fs:[00000030h] 1_2_009EFD9B
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B2D8A mov eax, dword ptr fs:[00000030h] 1_2_009B2D8A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B2D8A mov eax, dword ptr fs:[00000030h] 1_2_009B2D8A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B2D8A mov eax, dword ptr fs:[00000030h] 1_2_009B2D8A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B2D8A mov eax, dword ptr fs:[00000030h] 1_2_009B2D8A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B2D8A mov eax, dword ptr fs:[00000030h] 1_2_009B2D8A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E2581 mov eax, dword ptr fs:[00000030h] 1_2_009E2581
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E2581 mov eax, dword ptr fs:[00000030h] 1_2_009E2581
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E2581 mov eax, dword ptr fs:[00000030h] 1_2_009E2581
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E2581 mov eax, dword ptr fs:[00000030h] 1_2_009E2581
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E1DB5 mov eax, dword ptr fs:[00000030h] 1_2_009E1DB5
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E1DB5 mov eax, dword ptr fs:[00000030h] 1_2_009E1DB5
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E1DB5 mov eax, dword ptr fs:[00000030h] 1_2_009E1DB5
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E35A1 mov eax, dword ptr fs:[00000030h] 1_2_009E35A1
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A7FDE2 mov eax, dword ptr fs:[00000030h] 1_2_00A7FDE2
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A7FDE2 mov eax, dword ptr fs:[00000030h] 1_2_00A7FDE2
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A7FDE2 mov eax, dword ptr fs:[00000030h] 1_2_00A7FDE2
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A7FDE2 mov eax, dword ptr fs:[00000030h] 1_2_00A7FDE2
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A68DF1 mov eax, dword ptr fs:[00000030h] 1_2_00A68DF1
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A36DC9 mov eax, dword ptr fs:[00000030h] 1_2_00A36DC9
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A36DC9 mov eax, dword ptr fs:[00000030h] 1_2_00A36DC9
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A36DC9 mov eax, dword ptr fs:[00000030h] 1_2_00A36DC9
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A36DC9 mov ecx, dword ptr fs:[00000030h] 1_2_00A36DC9
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A36DC9 mov eax, dword ptr fs:[00000030h] 1_2_00A36DC9
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A36DC9 mov eax, dword ptr fs:[00000030h] 1_2_00A36DC9
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009CD5E0 mov eax, dword ptr fs:[00000030h] 1_2_009CD5E0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009CD5E0 mov eax, dword ptr fs:[00000030h] 1_2_009CD5E0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A3A537 mov eax, dword ptr fs:[00000030h] 1_2_00A3A537
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A88D34 mov eax, dword ptr fs:[00000030h] 1_2_00A88D34
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A7E539 mov eax, dword ptr fs:[00000030h] 1_2_00A7E539
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E4D3B mov eax, dword ptr fs:[00000030h] 1_2_009E4D3B
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E4D3B mov eax, dword ptr fs:[00000030h] 1_2_009E4D3B
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E4D3B mov eax, dword ptr fs:[00000030h] 1_2_009E4D3B
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C3D34 mov eax, dword ptr fs:[00000030h] 1_2_009C3D34
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C3D34 mov eax, dword ptr fs:[00000030h] 1_2_009C3D34
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C3D34 mov eax, dword ptr fs:[00000030h] 1_2_009C3D34
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C3D34 mov eax, dword ptr fs:[00000030h] 1_2_009C3D34
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C3D34 mov eax, dword ptr fs:[00000030h] 1_2_009C3D34
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C3D34 mov eax, dword ptr fs:[00000030h] 1_2_009C3D34
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C3D34 mov eax, dword ptr fs:[00000030h] 1_2_009C3D34
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C3D34 mov eax, dword ptr fs:[00000030h] 1_2_009C3D34
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C3D34 mov eax, dword ptr fs:[00000030h] 1_2_009C3D34
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C3D34 mov eax, dword ptr fs:[00000030h] 1_2_009C3D34
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C3D34 mov eax, dword ptr fs:[00000030h] 1_2_009C3D34
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C3D34 mov eax, dword ptr fs:[00000030h] 1_2_009C3D34
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C3D34 mov eax, dword ptr fs:[00000030h] 1_2_009C3D34
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009BAD30 mov eax, dword ptr fs:[00000030h] 1_2_009BAD30
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009D7D50 mov eax, dword ptr fs:[00000030h] 1_2_009D7D50
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F3D43 mov eax, dword ptr fs:[00000030h] 1_2_009F3D43
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A33540 mov eax, dword ptr fs:[00000030h] 1_2_00A33540
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009DC577 mov eax, dword ptr fs:[00000030h] 1_2_009DC577
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009DC577 mov eax, dword ptr fs:[00000030h] 1_2_009DC577
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A346A7 mov eax, dword ptr fs:[00000030h] 1_2_00A346A7
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A80EA5 mov eax, dword ptr fs:[00000030h] 1_2_00A80EA5
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A80EA5 mov eax, dword ptr fs:[00000030h] 1_2_00A80EA5
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A80EA5 mov eax, dword ptr fs:[00000030h] 1_2_00A80EA5
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A4FE87 mov eax, dword ptr fs:[00000030h] 1_2_00A4FE87
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E36CC mov eax, dword ptr fs:[00000030h] 1_2_009E36CC
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F8EC7 mov eax, dword ptr fs:[00000030h] 1_2_009F8EC7
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A6FEC0 mov eax, dword ptr fs:[00000030h] 1_2_00A6FEC0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E16E0 mov ecx, dword ptr fs:[00000030h] 1_2_009E16E0
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A88ED6 mov eax, dword ptr fs:[00000030h] 1_2_00A88ED6
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C76E2 mov eax, dword ptr fs:[00000030h] 1_2_009C76E2
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009EA61C mov eax, dword ptr fs:[00000030h] 1_2_009EA61C
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009EA61C mov eax, dword ptr fs:[00000030h] 1_2_009EA61C
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A6FE3F mov eax, dword ptr fs:[00000030h] 1_2_00A6FE3F
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009BC600 mov eax, dword ptr fs:[00000030h] 1_2_009BC600
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009BC600 mov eax, dword ptr fs:[00000030h] 1_2_009BC600
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009BC600 mov eax, dword ptr fs:[00000030h] 1_2_009BC600
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009E8E00 mov eax, dword ptr fs:[00000030h] 1_2_009E8E00
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A71608 mov eax, dword ptr fs:[00000030h] 1_2_00A71608
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009BE620 mov eax, dword ptr fs:[00000030h] 1_2_009BE620
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C7E41 mov eax, dword ptr fs:[00000030h] 1_2_009C7E41
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C7E41 mov eax, dword ptr fs:[00000030h] 1_2_009C7E41
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C7E41 mov eax, dword ptr fs:[00000030h] 1_2_009C7E41
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C7E41 mov eax, dword ptr fs:[00000030h] 1_2_009C7E41
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C7E41 mov eax, dword ptr fs:[00000030h] 1_2_009C7E41
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C7E41 mov eax, dword ptr fs:[00000030h] 1_2_009C7E41
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A7AE44 mov eax, dword ptr fs:[00000030h] 1_2_00A7AE44
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A7AE44 mov eax, dword ptr fs:[00000030h] 1_2_00A7AE44
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009DAE73 mov eax, dword ptr fs:[00000030h] 1_2_009DAE73
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009DAE73 mov eax, dword ptr fs:[00000030h] 1_2_009DAE73
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009DAE73 mov eax, dword ptr fs:[00000030h] 1_2_009DAE73
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009DAE73 mov eax, dword ptr fs:[00000030h] 1_2_009DAE73
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009DAE73 mov eax, dword ptr fs:[00000030h] 1_2_009DAE73
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C766D mov eax, dword ptr fs:[00000030h] 1_2_009C766D
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009C8794 mov eax, dword ptr fs:[00000030h] 1_2_009C8794
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A37794 mov eax, dword ptr fs:[00000030h] 1_2_00A37794
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A37794 mov eax, dword ptr fs:[00000030h] 1_2_00A37794
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A37794 mov eax, dword ptr fs:[00000030h] 1_2_00A37794
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009F37F5 mov eax, dword ptr fs:[00000030h] 1_2_009F37F5
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009DF716 mov eax, dword ptr fs:[00000030h] 1_2_009DF716
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009EA70E mov eax, dword ptr fs:[00000030h] 1_2_009EA70E
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009EA70E mov eax, dword ptr fs:[00000030h] 1_2_009EA70E
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A8070D mov eax, dword ptr fs:[00000030h] 1_2_00A8070D
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A8070D mov eax, dword ptr fs:[00000030h] 1_2_00A8070D
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009EE730 mov eax, dword ptr fs:[00000030h] 1_2_009EE730
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A4FF10 mov eax, dword ptr fs:[00000030h] 1_2_00A4FF10
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A4FF10 mov eax, dword ptr fs:[00000030h] 1_2_00A4FF10
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B4F2E mov eax, dword ptr fs:[00000030h] 1_2_009B4F2E
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009B4F2E mov eax, dword ptr fs:[00000030h] 1_2_009B4F2E
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00A88F6A mov eax, dword ptr fs:[00000030h] 1_2_00A88F6A
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009CEF40 mov eax, dword ptr fs:[00000030h] 1_2_009CEF40
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_009CFF60 mov eax, dword ptr fs:[00000030h] 1_2_009CFF60
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04702073 mov eax, dword ptr fs:[00000030h] 11_2_04702073
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04711074 mov eax, dword ptr fs:[00000030h] 11_2_04711074
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0466746D mov eax, dword ptr fs:[00000030h] 11_2_0466746D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0467A44B mov eax, dword ptr fs:[00000030h] 11_2_0467A44B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04660050 mov eax, dword ptr fs:[00000030h] 11_2_04660050
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04660050 mov eax, dword ptr fs:[00000030h] 11_2_04660050
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046DC450 mov eax, dword ptr fs:[00000030h] 11_2_046DC450
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046DC450 mov eax, dword ptr fs:[00000030h] 11_2_046DC450
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0467002D mov eax, dword ptr fs:[00000030h] 11_2_0467002D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0467002D mov eax, dword ptr fs:[00000030h] 11_2_0467002D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0467002D mov eax, dword ptr fs:[00000030h] 11_2_0467002D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0467002D mov eax, dword ptr fs:[00000030h] 11_2_0467002D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0467002D mov eax, dword ptr fs:[00000030h] 11_2_0467002D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0467BC2C mov eax, dword ptr fs:[00000030h] 11_2_0467BC2C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0465B02A mov eax, dword ptr fs:[00000030h] 11_2_0465B02A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0465B02A mov eax, dword ptr fs:[00000030h] 11_2_0465B02A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0465B02A mov eax, dword ptr fs:[00000030h] 11_2_0465B02A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0465B02A mov eax, dword ptr fs:[00000030h] 11_2_0465B02A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04714015 mov eax, dword ptr fs:[00000030h] 11_2_04714015
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04714015 mov eax, dword ptr fs:[00000030h] 11_2_04714015
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C6C0A mov eax, dword ptr fs:[00000030h] 11_2_046C6C0A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C6C0A mov eax, dword ptr fs:[00000030h] 11_2_046C6C0A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C6C0A mov eax, dword ptr fs:[00000030h] 11_2_046C6C0A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C6C0A mov eax, dword ptr fs:[00000030h] 11_2_046C6C0A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04701C06 mov eax, dword ptr fs:[00000030h] 11_2_04701C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04701C06 mov eax, dword ptr fs:[00000030h] 11_2_04701C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04701C06 mov eax, dword ptr fs:[00000030h] 11_2_04701C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04701C06 mov eax, dword ptr fs:[00000030h] 11_2_04701C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04701C06 mov eax, dword ptr fs:[00000030h] 11_2_04701C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04701C06 mov eax, dword ptr fs:[00000030h] 11_2_04701C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04701C06 mov eax, dword ptr fs:[00000030h] 11_2_04701C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04701C06 mov eax, dword ptr fs:[00000030h] 11_2_04701C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04701C06 mov eax, dword ptr fs:[00000030h] 11_2_04701C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04701C06 mov eax, dword ptr fs:[00000030h] 11_2_04701C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04701C06 mov eax, dword ptr fs:[00000030h] 11_2_04701C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04701C06 mov eax, dword ptr fs:[00000030h] 11_2_04701C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04701C06 mov eax, dword ptr fs:[00000030h] 11_2_04701C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04701C06 mov eax, dword ptr fs:[00000030h] 11_2_04701C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C7016 mov eax, dword ptr fs:[00000030h] 11_2_046C7016
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C7016 mov eax, dword ptr fs:[00000030h] 11_2_046C7016
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C7016 mov eax, dword ptr fs:[00000030h] 11_2_046C7016
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0471740D mov eax, dword ptr fs:[00000030h] 11_2_0471740D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0471740D mov eax, dword ptr fs:[00000030h] 11_2_0471740D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0471740D mov eax, dword ptr fs:[00000030h] 11_2_0471740D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046458EC mov eax, dword ptr fs:[00000030h] 11_2_046458EC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_047014FB mov eax, dword ptr fs:[00000030h] 11_2_047014FB
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C6CF0 mov eax, dword ptr fs:[00000030h] 11_2_046C6CF0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C6CF0 mov eax, dword ptr fs:[00000030h] 11_2_046C6CF0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C6CF0 mov eax, dword ptr fs:[00000030h] 11_2_046C6CF0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04718CD6 mov eax, dword ptr fs:[00000030h] 11_2_04718CD6
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046DB8D0 mov eax, dword ptr fs:[00000030h] 11_2_046DB8D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046DB8D0 mov ecx, dword ptr fs:[00000030h] 11_2_046DB8D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046DB8D0 mov eax, dword ptr fs:[00000030h] 11_2_046DB8D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046DB8D0 mov eax, dword ptr fs:[00000030h] 11_2_046DB8D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046DB8D0 mov eax, dword ptr fs:[00000030h] 11_2_046DB8D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046DB8D0 mov eax, dword ptr fs:[00000030h] 11_2_046DB8D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046890AF mov eax, dword ptr fs:[00000030h] 11_2_046890AF
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046720A0 mov eax, dword ptr fs:[00000030h] 11_2_046720A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046720A0 mov eax, dword ptr fs:[00000030h] 11_2_046720A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046720A0 mov eax, dword ptr fs:[00000030h] 11_2_046720A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046720A0 mov eax, dword ptr fs:[00000030h] 11_2_046720A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046720A0 mov eax, dword ptr fs:[00000030h] 11_2_046720A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046720A0 mov eax, dword ptr fs:[00000030h] 11_2_046720A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0467F0BF mov ecx, dword ptr fs:[00000030h] 11_2_0467F0BF
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0467F0BF mov eax, dword ptr fs:[00000030h] 11_2_0467F0BF
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0467F0BF mov eax, dword ptr fs:[00000030h] 11_2_0467F0BF
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04649080 mov eax, dword ptr fs:[00000030h] 11_2_04649080
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C3884 mov eax, dword ptr fs:[00000030h] 11_2_046C3884
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C3884 mov eax, dword ptr fs:[00000030h] 11_2_046C3884
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0465849B mov eax, dword ptr fs:[00000030h] 11_2_0465849B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0464C962 mov eax, dword ptr fs:[00000030h] 11_2_0464C962
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0466C577 mov eax, dword ptr fs:[00000030h] 11_2_0466C577
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0466C577 mov eax, dword ptr fs:[00000030h] 11_2_0466C577
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0464B171 mov eax, dword ptr fs:[00000030h] 11_2_0464B171
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0464B171 mov eax, dword ptr fs:[00000030h] 11_2_0464B171
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0466B944 mov eax, dword ptr fs:[00000030h] 11_2_0466B944
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0466B944 mov eax, dword ptr fs:[00000030h] 11_2_0466B944
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04683D43 mov eax, dword ptr fs:[00000030h] 11_2_04683D43
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C3540 mov eax, dword ptr fs:[00000030h] 11_2_046C3540
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04667D50 mov eax, dword ptr fs:[00000030h] 11_2_04667D50
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04718D34 mov eax, dword ptr fs:[00000030h] 11_2_04718D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04664120 mov eax, dword ptr fs:[00000030h] 11_2_04664120
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04664120 mov eax, dword ptr fs:[00000030h] 11_2_04664120
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04664120 mov eax, dword ptr fs:[00000030h] 11_2_04664120
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04664120 mov eax, dword ptr fs:[00000030h] 11_2_04664120
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04664120 mov ecx, dword ptr fs:[00000030h] 11_2_04664120
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0470E539 mov eax, dword ptr fs:[00000030h] 11_2_0470E539
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04653D34 mov eax, dword ptr fs:[00000030h] 11_2_04653D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04653D34 mov eax, dword ptr fs:[00000030h] 11_2_04653D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04653D34 mov eax, dword ptr fs:[00000030h] 11_2_04653D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04653D34 mov eax, dword ptr fs:[00000030h] 11_2_04653D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04653D34 mov eax, dword ptr fs:[00000030h] 11_2_04653D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04653D34 mov eax, dword ptr fs:[00000030h] 11_2_04653D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04653D34 mov eax, dword ptr fs:[00000030h] 11_2_04653D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04653D34 mov eax, dword ptr fs:[00000030h] 11_2_04653D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04653D34 mov eax, dword ptr fs:[00000030h] 11_2_04653D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04653D34 mov eax, dword ptr fs:[00000030h] 11_2_04653D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04653D34 mov eax, dword ptr fs:[00000030h] 11_2_04653D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04653D34 mov eax, dword ptr fs:[00000030h] 11_2_04653D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04653D34 mov eax, dword ptr fs:[00000030h] 11_2_04653D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0464AD30 mov eax, dword ptr fs:[00000030h] 11_2_0464AD30
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046CA537 mov eax, dword ptr fs:[00000030h] 11_2_046CA537
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04674D3B mov eax, dword ptr fs:[00000030h] 11_2_04674D3B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04674D3B mov eax, dword ptr fs:[00000030h] 11_2_04674D3B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04674D3B mov eax, dword ptr fs:[00000030h] 11_2_04674D3B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0467513A mov eax, dword ptr fs:[00000030h] 11_2_0467513A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0467513A mov eax, dword ptr fs:[00000030h] 11_2_0467513A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04649100 mov eax, dword ptr fs:[00000030h] 11_2_04649100
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04649100 mov eax, dword ptr fs:[00000030h] 11_2_04649100
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04649100 mov eax, dword ptr fs:[00000030h] 11_2_04649100
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0464B1E1 mov eax, dword ptr fs:[00000030h] 11_2_0464B1E1
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0464B1E1 mov eax, dword ptr fs:[00000030h] 11_2_0464B1E1
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0464B1E1 mov eax, dword ptr fs:[00000030h] 11_2_0464B1E1
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046D41E8 mov eax, dword ptr fs:[00000030h] 11_2_046D41E8
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0465D5E0 mov eax, dword ptr fs:[00000030h] 11_2_0465D5E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0465D5E0 mov eax, dword ptr fs:[00000030h] 11_2_0465D5E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0470FDE2 mov eax, dword ptr fs:[00000030h] 11_2_0470FDE2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0470FDE2 mov eax, dword ptr fs:[00000030h] 11_2_0470FDE2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0470FDE2 mov eax, dword ptr fs:[00000030h] 11_2_0470FDE2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0470FDE2 mov eax, dword ptr fs:[00000030h] 11_2_0470FDE2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046F8DF1 mov eax, dword ptr fs:[00000030h] 11_2_046F8DF1
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C6DC9 mov eax, dword ptr fs:[00000030h] 11_2_046C6DC9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C6DC9 mov eax, dword ptr fs:[00000030h] 11_2_046C6DC9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C6DC9 mov eax, dword ptr fs:[00000030h] 11_2_046C6DC9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C6DC9 mov ecx, dword ptr fs:[00000030h] 11_2_046C6DC9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C6DC9 mov eax, dword ptr fs:[00000030h] 11_2_046C6DC9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C6DC9 mov eax, dword ptr fs:[00000030h] 11_2_046C6DC9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046735A1 mov eax, dword ptr fs:[00000030h] 11_2_046735A1
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046761A0 mov eax, dword ptr fs:[00000030h] 11_2_046761A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046761A0 mov eax, dword ptr fs:[00000030h] 11_2_046761A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C69A6 mov eax, dword ptr fs:[00000030h] 11_2_046C69A6
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04671DB5 mov eax, dword ptr fs:[00000030h] 11_2_04671DB5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04671DB5 mov eax, dword ptr fs:[00000030h] 11_2_04671DB5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04671DB5 mov eax, dword ptr fs:[00000030h] 11_2_04671DB5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C51BE mov eax, dword ptr fs:[00000030h] 11_2_046C51BE
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C51BE mov eax, dword ptr fs:[00000030h] 11_2_046C51BE
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C51BE mov eax, dword ptr fs:[00000030h] 11_2_046C51BE
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C51BE mov eax, dword ptr fs:[00000030h] 11_2_046C51BE
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_047105AC mov eax, dword ptr fs:[00000030h] 11_2_047105AC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_047105AC mov eax, dword ptr fs:[00000030h] 11_2_047105AC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0467A185 mov eax, dword ptr fs:[00000030h] 11_2_0467A185
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0466C182 mov eax, dword ptr fs:[00000030h] 11_2_0466C182
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04672581 mov eax, dword ptr fs:[00000030h] 11_2_04672581
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04672581 mov eax, dword ptr fs:[00000030h] 11_2_04672581
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04672581 mov eax, dword ptr fs:[00000030h] 11_2_04672581
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04672581 mov eax, dword ptr fs:[00000030h] 11_2_04672581
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04642D8A mov eax, dword ptr fs:[00000030h] 11_2_04642D8A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04642D8A mov eax, dword ptr fs:[00000030h] 11_2_04642D8A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04642D8A mov eax, dword ptr fs:[00000030h] 11_2_04642D8A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04642D8A mov eax, dword ptr fs:[00000030h] 11_2_04642D8A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04642D8A mov eax, dword ptr fs:[00000030h] 11_2_04642D8A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04672990 mov eax, dword ptr fs:[00000030h] 11_2_04672990
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0467FD9B mov eax, dword ptr fs:[00000030h] 11_2_0467FD9B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0467FD9B mov eax, dword ptr fs:[00000030h] 11_2_0467FD9B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0465766D mov eax, dword ptr fs:[00000030h] 11_2_0465766D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046FB260 mov eax, dword ptr fs:[00000030h] 11_2_046FB260
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046FB260 mov eax, dword ptr fs:[00000030h] 11_2_046FB260
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0468927A mov eax, dword ptr fs:[00000030h] 11_2_0468927A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04718A62 mov eax, dword ptr fs:[00000030h] 11_2_04718A62
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0466AE73 mov eax, dword ptr fs:[00000030h] 11_2_0466AE73
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0466AE73 mov eax, dword ptr fs:[00000030h] 11_2_0466AE73
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0466AE73 mov eax, dword ptr fs:[00000030h] 11_2_0466AE73
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0466AE73 mov eax, dword ptr fs:[00000030h] 11_2_0466AE73
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0466AE73 mov eax, dword ptr fs:[00000030h] 11_2_0466AE73
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04649240 mov eax, dword ptr fs:[00000030h] 11_2_04649240
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04649240 mov eax, dword ptr fs:[00000030h] 11_2_04649240
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04649240 mov eax, dword ptr fs:[00000030h] 11_2_04649240
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04649240 mov eax, dword ptr fs:[00000030h] 11_2_04649240
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04657E41 mov eax, dword ptr fs:[00000030h] 11_2_04657E41
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04657E41 mov eax, dword ptr fs:[00000030h] 11_2_04657E41
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04657E41 mov eax, dword ptr fs:[00000030h] 11_2_04657E41
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04657E41 mov eax, dword ptr fs:[00000030h] 11_2_04657E41
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04657E41 mov eax, dword ptr fs:[00000030h] 11_2_04657E41
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04657E41 mov eax, dword ptr fs:[00000030h] 11_2_04657E41
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0470EA55 mov eax, dword ptr fs:[00000030h] 11_2_0470EA55
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0470AE44 mov eax, dword ptr fs:[00000030h] 11_2_0470AE44
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0470AE44 mov eax, dword ptr fs:[00000030h] 11_2_0470AE44
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046D4257 mov eax, dword ptr fs:[00000030h] 11_2_046D4257
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0464E620 mov eax, dword ptr fs:[00000030h] 11_2_0464E620
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04684A2C mov eax, dword ptr fs:[00000030h] 11_2_04684A2C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04684A2C mov eax, dword ptr fs:[00000030h] 11_2_04684A2C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046FFE3F mov eax, dword ptr fs:[00000030h] 11_2_046FFE3F
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0464C600 mov eax, dword ptr fs:[00000030h] 11_2_0464C600
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0464C600 mov eax, dword ptr fs:[00000030h] 11_2_0464C600
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0464C600 mov eax, dword ptr fs:[00000030h] 11_2_0464C600
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04678E00 mov eax, dword ptr fs:[00000030h] 11_2_04678E00
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04658A0A mov eax, dword ptr fs:[00000030h] 11_2_04658A0A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0464AA16 mov eax, dword ptr fs:[00000030h] 11_2_0464AA16
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0464AA16 mov eax, dword ptr fs:[00000030h] 11_2_0464AA16
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04645210 mov eax, dword ptr fs:[00000030h] 11_2_04645210
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04645210 mov ecx, dword ptr fs:[00000030h] 11_2_04645210
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04645210 mov eax, dword ptr fs:[00000030h] 11_2_04645210
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04645210 mov eax, dword ptr fs:[00000030h] 11_2_04645210
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04701608 mov eax, dword ptr fs:[00000030h] 11_2_04701608
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04663A1C mov eax, dword ptr fs:[00000030h] 11_2_04663A1C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0467A61C mov eax, dword ptr fs:[00000030h] 11_2_0467A61C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0467A61C mov eax, dword ptr fs:[00000030h] 11_2_0467A61C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04672AE4 mov eax, dword ptr fs:[00000030h] 11_2_04672AE4
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046716E0 mov ecx, dword ptr fs:[00000030h] 11_2_046716E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046576E2 mov eax, dword ptr fs:[00000030h] 11_2_046576E2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04718ED6 mov eax, dword ptr fs:[00000030h] 11_2_04718ED6
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046736CC mov eax, dword ptr fs:[00000030h] 11_2_046736CC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04672ACB mov eax, dword ptr fs:[00000030h] 11_2_04672ACB
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046FFEC0 mov eax, dword ptr fs:[00000030h] 11_2_046FFEC0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04688EC7 mov eax, dword ptr fs:[00000030h] 11_2_04688EC7
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046452A5 mov eax, dword ptr fs:[00000030h] 11_2_046452A5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046452A5 mov eax, dword ptr fs:[00000030h] 11_2_046452A5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046452A5 mov eax, dword ptr fs:[00000030h] 11_2_046452A5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046452A5 mov eax, dword ptr fs:[00000030h] 11_2_046452A5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046452A5 mov eax, dword ptr fs:[00000030h] 11_2_046452A5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046C46A7 mov eax, dword ptr fs:[00000030h] 11_2_046C46A7
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04710EA5 mov eax, dword ptr fs:[00000030h] 11_2_04710EA5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04710EA5 mov eax, dword ptr fs:[00000030h] 11_2_04710EA5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04710EA5 mov eax, dword ptr fs:[00000030h] 11_2_04710EA5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0465AAB0 mov eax, dword ptr fs:[00000030h] 11_2_0465AAB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0465AAB0 mov eax, dword ptr fs:[00000030h] 11_2_0465AAB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0467FAB0 mov eax, dword ptr fs:[00000030h] 11_2_0467FAB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_046DFE87 mov eax, dword ptr fs:[00000030h] 11_2_046DFE87
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0467D294 mov eax, dword ptr fs:[00000030h] 11_2_0467D294
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0467D294 mov eax, dword ptr fs:[00000030h] 11_2_0467D294
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0464DB60 mov ecx, dword ptr fs:[00000030h] 11_2_0464DB60
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0465FF60 mov eax, dword ptr fs:[00000030h] 11_2_0465FF60
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04718F6A mov eax, dword ptr fs:[00000030h] 11_2_04718F6A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04673B7A mov eax, dword ptr fs:[00000030h] 11_2_04673B7A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04673B7A mov eax, dword ptr fs:[00000030h] 11_2_04673B7A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0464DB40 mov eax, dword ptr fs:[00000030h] 11_2_0464DB40
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0465EF40 mov eax, dword ptr fs:[00000030h] 11_2_0465EF40
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04718B58 mov eax, dword ptr fs:[00000030h] 11_2_04718B58
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_0464F358 mov eax, dword ptr fs:[00000030h] 11_2_0464F358
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04644F2E mov eax, dword ptr fs:[00000030h] 11_2_04644F2E
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 11_2_04644F2E mov eax, dword ptr fs:[00000030h] 11_2_04644F2E
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 1_2_00409B50 LdrLoadDll, 1_2_00409B50
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_100057F4 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_100057F4

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 104.248.163.187 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.tankomixing.com
Source: C:\Windows\explorer.exe Domain query: www.leads-mania.club
Source: C:\Windows\explorer.exe Network Connect: 217.160.0.33 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.bezhantrading.com
Source: C:\Windows\explorer.exe Domain query: www.americanvisionvinyl.com
Source: C:\Windows\explorer.exe Network Connect: 46.38.243.234 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.iccsukltd.com
Source: C:\Windows\explorer.exe Network Connect: 35.246.6.109 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.affiliatemarketingproducts.xyz
Source: C:\Windows\explorer.exe Network Connect: 153.127.214.206 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 138.68.74.116 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 172.67.184.156 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.worryterrible.space
Source: C:\Windows\explorer.exe Domain query: www.alles-abgedeckt.com
Source: C:\Windows\explorer.exe Domain query: www.dempseynutrition.com
Source: C:\Windows\explorer.exe Domain query: www.harada-insatsu.com
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Section unmapped: C:\Windows\SysWOW64\cmstp.exe base address: D0000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Section loaded: unknown target: C:\Windows\SysWOW64\cmstp.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Section loaded: unknown target: C:\Windows\SysWOW64\cmstp.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Memory written: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe base: 400000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Thread register set: target process: 3440 Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Thread register set: target process: 3440 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Process created: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe "C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe" Jump to behavior
Source: explorer.exe, 00000005.00000000.380351943.0000000000EE0000.00000002.00020000.sdmp, cmstp.exe, 0000000B.00000002.619338483.0000000002ED0000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.380351943.0000000000EE0000.00000002.00020000.sdmp, cmstp.exe, 0000000B.00000002.619338483.0000000002ED0000.00000002.00020000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.380351943.0000000000EE0000.00000002.00020000.sdmp, cmstp.exe, 0000000B.00000002.619338483.0000000002ED0000.00000002.00020000.sdmp Binary or memory string: &Program Manager
Source: explorer.exe, 00000005.00000000.380351943.0000000000EE0000.00000002.00020000.sdmp, cmstp.exe, 0000000B.00000002.619338483.0000000002ED0000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_10004343 cpuid 0_2_10004343
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_1000568B GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_1000568B
Source: C:\Users\user\Desktop\nowy przyk#U0142adowy katalog.exe Code function: 0_2_0040312A EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 0_2_0040312A

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 1.1.nowy przyk#U0142adowy katalog.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.nowy przyk#U0142adowy katalog.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.nowy przyk#U0142adowy katalog.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.nowy przyk#U0142adowy katalog.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.nowy przyk#U0142adowy katalog.exe.e840000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.nowy przyk#U0142adowy katalog.exe.e840000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.426662087.0000000000CE0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.426692042.0000000000D10000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.618855079.0000000002860000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.361409947.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.618002873.0000000000180000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.364413709.000000000E840000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.412735019.000000000F6E6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.425753060.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.395866901.000000000F6E6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.358925915.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.619144149.0000000002960000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.360578387.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 1.1.nowy przyk#U0142adowy katalog.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.nowy przyk#U0142adowy katalog.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.nowy przyk#U0142adowy katalog.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.nowy przyk#U0142adowy katalog.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.nowy przyk#U0142adowy katalog.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.nowy przyk#U0142adowy katalog.exe.e840000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.nowy przyk#U0142adowy katalog.exe.e840000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.426662087.0000000000CE0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.426692042.0000000000D10000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.618855079.0000000002860000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.361409947.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.618002873.0000000000180000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.364413709.000000000E840000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.412735019.000000000F6E6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.425753060.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.395866901.000000000F6E6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.358925915.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.619144149.0000000002960000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.360578387.0000000000400000.00000040.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 515499 Sample: nowy przyk#U0142adowy katalog.exe Startdate: 04/11/2021 Architecture: WINDOWS Score: 100 32 www.sddn13.xyz 2->32 34 sddn13.xyz 2->34 52 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->52 54 Multi AV Scanner detection for domain / URL 2->54 56 Found malware configuration 2->56 58 9 other signatures 2->58 11 nowy przyk#U0142adowy katalog.exe 17 2->11         started        signatures3 process4 dnsIp5 42 192.168.2.1 unknown unknown 11->42 30 C:\Users\user\AppData\Local\...\rarelsbsy.dll, PE32 11->30 dropped 72 Injects a PE file into a foreign processes 11->72 16 nowy przyk#U0142adowy katalog.exe 11->16         started        file6 signatures7 process8 signatures9 44 Modifies the context of a thread in another process (thread injection) 16->44 46 Maps a DLL or memory area into another process 16->46 48 Sample uses process hollowing technique 16->48 50 Queues an APC in another process (thread injection) 16->50 19 explorer.exe 16->19 injected process10 dnsIp11 36 harada-insatsu.com 153.127.214.206, 49773, 80 SAKURA-ASAKURAInternetIncJP Japan 19->36 38 www.iccsukltd.com 217.160.0.33, 49770, 80 ONEANDONE-ASBrauerstrasse48DE Germany 19->38 40 17 other IPs or domains 19->40 60 System process connects to network (likely due to code injection or exploit) 19->60 62 Performs DNS queries to domains with low reputation 19->62 23 cmstp.exe 19->23         started        signatures12 process13 signatures14 64 Self deletion via cmd delete 23->64 66 Modifies the context of a thread in another process (thread injection) 23->66 68 Maps a DLL or memory area into another process 23->68 70 Tries to detect virtualization through RDTSC time measurements 23->70 26 cmd.exe 1 23->26         started        process15 process16 28 conhost.exe 26->28         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.248.163.187
 bezhantrading.com United States
14061 DIGITALOCEAN-ASNUS true
35.246.6.109
 td-balancer-euw2-6-109.wixdns.net United States
15169 GOOGLEUS false
153.127.214.206
 harada-insatsu.com Japan 7684 SAKURA-ASAKURAInternetIncJP true
138.68.74.116
 leads-mania.club United States
14061 DIGITALOCEAN-ASNUS true
34.102.136.180
 americanvisionvinyl.com United States
15169 GOOGLEUS false
172.67.184.156
 www.affiliatemarketingproducts.xyz United States
13335 CLOUDFLARENETUS true
217.160.0.33
 www.iccsukltd.com Germany
8560 ONEANDONE-ASBrauerstrasse48DE true
46.38.243.234
 www.alles-abgedeckt.com Germany
197540 NETCUP-ASnetcupGmbHDE true

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
harada-insatsu.com 153.127.214.206 true
bezhantrading.com 104.248.163.187 true
www.iccsukltd.com 217.160.0.33 true
td-balancer-euw2-6-109.wixdns.net 35.246.6.109 true
americanvisionvinyl.com 34.102.136.180 true
www.affiliatemarketingproducts.xyz 172.67.184.156 true
sddn13.xyz 50.118.182.205 true
worryterrible.space 34.102.136.180 true
www.alles-abgedeckt.com 46.38.243.234 true
leads-mania.club 138.68.74.116 true
www.tankomixing.com unknown unknown
www.sddn13.xyz unknown unknown
www.leads-mania.club unknown unknown
www.worryterrible.space unknown unknown
www.bezhantrading.com unknown unknown
www.americanvisionvinyl.com unknown unknown
www.dempseynutrition.com unknown unknown
www.harada-insatsu.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.affiliatemarketingproducts.xyz/wtcv/?6lpD=n99BCbv8t7R76U7aWl+Y4jwhCBMXqFH3Ss3s1uofAFeCknYKTX6A2ZhN+sblY4y892kijutCfw==&g2ML=crBLeffhPhH0 true
  • Avira URL Cloud: safe
 unknown
http://www.bezhantrading.com/wtcv/?6lpD=U8NG9FaSD2kxZB2OJ0E9golv5lIIWRC0uShqIwpBJZHTTqOYZoxmZrRB+XQzKwloE4eQBzh5Yg==&g2ML=crBLeffhPhH0 true
  • Avira URL Cloud: safe
 unknown
www.bezhantrading.com/wtcv/ true
  • Avira URL Cloud: safe
 low
http://www.worryterrible.space/wtcv/?g2ML=crBLeffhPhH0&6lpD=T+sBBhD+jNCXQwtHdmguBNleR0ygENBETJPwbdwO/+mZKIq0Z0gdUrlML9Z9p+t2mZBgFheVMw== false
  • Avira URL Cloud: safe
 unknown
http://www.harada-insatsu.com/wtcv/?6lpD=3PEHh71NGJ6azwdPIaKj9SJxQ5GIvylohbG4MidSx9GNzMWuTZ2Cml2qwvbSyEbxmGLLoGUQ/A==&g2ML=crBLeffhPhH0 true
  • Avira URL Cloud: safe
 unknown
http://www.tankomixing.com/wtcv/?g2ML=crBLeffhPhH0&6lpD=ydnZOtJN4rL7t+2rr2QP2l64KaWWig+O10p3BIFftvtUQta9c9OEvE67gAwElgS+ahtVnBS/Rg== false
  • Avira URL Cloud: safe
 unknown
http://www.alles-abgedeckt.com/wtcv/?g2ML=crBLeffhPhH0&6lpD=7rFvx+oOkIknJeLSGT6zdpK11SNx3XmCJl3+oL6bUqBoSOO899RABoVcVaGdEbUjg6Jp245BoA== true
  • Avira URL Cloud: safe
 unknown
http://www.americanvisionvinyl.com/wtcv/?6lpD=S1gCkNmaG9RWB/pKREaVLOJX/KdzA8KUzxvMSJydFpcLjSWhmPt8MQ7tAXeYu3xo2zwBelgJSg==&g2ML=crBLeffhPhH0 false
  • Avira URL Cloud: safe
 unknown
http://www.leads-mania.club/wtcv/?6lpD=6uadF/xtp6SIEZXRejc5eEgqqida81Lycer078wuaqskBH7+Y9BHXTO8hpDHVP52SXbct0O1Gw==&g2ML=crBLeffhPhH0 true
  • Avira URL Cloud: safe
 unknown
http://www.iccsukltd.com/wtcv/?g2ML=crBLeffhPhH0&6lpD=avBZXYWwHS+0cE4x4OhaeduPUSE/+pj8feHEWqkpfSZeSdEeZDPav/r/n85naepg7UJMR8VNdw== true
  • Avira URL Cloud: safe
 unknown