Windows Analysis Report
SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe

Overview

General Information

Sample name: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe
Analysis ID: 1501379
MD5: fdc2585397f6e5daa7368d90bd4c1818
SHA1: 87bcde6fe5aff75e27ba27d63e5ba6ae9c5a31da
SHA256: c5a4b944207f26a6625931bffe1cd9565bb20202ad1f49612342edf8df7995c4
Tags: exe
Infos:

Detection

FormBook
Score: 88
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
AI detected suspicious sample
Injects a PE file into a foreign processes
Machine Learning detection for sample
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe ReversingLabs: Detection: 26%
Yara detected FormBook
Source: Yara match File source: 3.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.2328494578.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: xseT.pdb source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe
Source: Binary string: xseT.pdbSHA256BnK source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe
Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe, 00000003.00000002.2328972056.0000000002E20000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe, SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe, 00000003.00000002.2328972056.0000000002E20000.00000040.00001000.00020000.00000000.sdmp
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe String found in binary or memory: http://tempuri.org/DataSet1.xsdSAll
Source: Amcache.hve.7.dr String found in binary or memory: http://upx.sf.net

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 3.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.2328494578.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 3.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 3.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.2328494578.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Contains functionality to call native functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_0042CCA7 NtClose, 3_2_0042CCA7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92DF0 NtQuerySystemInformation,LdrInitializeThunk, 3_2_02E92DF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E94340 NtSetContextThread, 3_2_02E94340
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E94650 NtSuspendThread, 3_2_02E94650
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92AF0 NtWriteFile, 3_2_02E92AF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92AD0 NtReadFile, 3_2_02E92AD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92AB0 NtWaitForSingleObject, 3_2_02E92AB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92BE0 NtQueryValueKey, 3_2_02E92BE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92BF0 NtAllocateVirtualMemory, 3_2_02E92BF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92BA0 NtEnumerateValueKey, 3_2_02E92BA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92B80 NtQueryInformationFile, 3_2_02E92B80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92B60 NtClose, 3_2_02E92B60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92EE0 NtQueueApcThread, 3_2_02E92EE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92EA0 NtAdjustPrivilegesToken, 3_2_02E92EA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92E80 NtReadVirtualMemory, 3_2_02E92E80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92E30 NtWriteVirtualMemory, 3_2_02E92E30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92FE0 NtCreateFile, 3_2_02E92FE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92FA0 NtQuerySection, 3_2_02E92FA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92FB0 NtResumeThread, 3_2_02E92FB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92F90 NtProtectVirtualMemory, 3_2_02E92F90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92F60 NtCreateProcessEx, 3_2_02E92F60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92F30 NtCreateSection, 3_2_02E92F30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92CF0 NtOpenProcess, 3_2_02E92CF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92CC0 NtQueryVirtualMemory, 3_2_02E92CC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92CA0 NtQueryInformationToken, 3_2_02E92CA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92C60 NtCreateKey, 3_2_02E92C60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92C70 NtFreeVirtualMemory, 3_2_02E92C70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92C00 NtQueryInformationProcess, 3_2_02E92C00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92DD0 NtDelayExecution, 3_2_02E92DD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92DB0 NtEnumerateKey, 3_2_02E92DB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92D30 NtUnmapViewOfSection, 3_2_02E92D30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92D00 NtSetInformationFile, 3_2_02E92D00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92D10 NtMapViewOfSection, 3_2_02E92D10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E93090 NtSetValueKey, 3_2_02E93090
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E93010 NtOpenDirectoryObject, 3_2_02E93010
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E935C0 NtCreateMutant, 3_2_02E935C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E939B0 NtGetContextThread, 3_2_02E939B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E93D70 NtOpenThread, 3_2_02E93D70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E93D10 NtOpenProcessToken, 3_2_02E93D10
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 0_2_030BDE4C 0_2_030BDE4C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 0_2_056C0508 0_2_056C0508
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 0_2_056C0518 0_2_056C0518
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 0_2_074010D0 0_2_074010D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 0_2_074066F8 0_2_074066F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 0_2_07404548 0_2_07404548
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 0_2_07405D48 0_2_07405D48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 0_2_07404538 0_2_07404538
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 0_2_07403CD8 0_2_07403CD8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 0_2_07405AD8 0_2_07405AD8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 0_2_07404101 0_2_07404101
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 0_2_07404110 0_2_07404110
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 0_2_074010C0 0_2_074010C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_0040E8FE 3_2_0040E8FE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00410887 3_2_00410887
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_0040E907 3_2_0040E907
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00403124 3_2_00403124
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_004039E4 3_2_004039E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_0042F247 3_2_0042F247
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00401A94 3_2_00401A94
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00401440 3_2_00401440
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00404CA3 3_2_00404CA3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_0041065E 3_2_0041065E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00410667 3_2_00410667
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00402E14 3_2_00402E14
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00416FC7 3_2_00416FC7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE02C0 3_2_02EE02C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F00274 3_2_02F00274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F203E6 3_2_02F203E6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E6E3F0 3_2_02E6E3F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F1A352 3_2_02F1A352
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EF2000 3_2_02EF2000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F181CC 3_2_02F181CC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F141A2 3_2_02F141A2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F201AA 3_2_02F201AA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE8158 3_2_02EE8158
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E50100 3_2_02E50100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFA118 3_2_02EFA118
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7C6E0 3_2_02E7C6E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5C7C0 3_2_02E5C7C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60770 3_2_02E60770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E84750 3_2_02E84750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F0E4F6 3_2_02F0E4F6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F12446 3_2_02F12446
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F04420 3_2_02F04420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F20591 3_2_02F20591
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60535 3_2_02E60535
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5EA80 3_2_02E5EA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F16BD7 3_2_02F16BD7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F1AB40 3_2_02F1AB40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8E8F0 3_2_02E8E8F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E468B8 3_2_02E468B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E62840 3_2_02E62840
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E6A840 3_2_02E6A840
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E629A0 3_2_02E629A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F2A9A6 3_2_02F2A9A6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E76962 3_2_02E76962
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F1EEDB 3_2_02F1EEDB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F1CE93 3_2_02F1CE93
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E72E90 3_2_02E72E90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60E59 3_2_02E60E59
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F1EE26 3_2_02F1EE26
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E6CFE0 3_2_02E6CFE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E52FC8 3_2_02E52FC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EDEFA0 3_2_02EDEFA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED4F40 3_2_02ED4F40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F02F30 3_2_02F02F30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EA2F28 3_2_02EA2F28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E80F30 3_2_02E80F30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E50CF2 3_2_02E50CF2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F00CB5 3_2_02F00CB5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60C00 3_2_02E60C00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5ADE0 3_2_02E5ADE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E78DBF 3_2_02E78DBF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E6AD00 3_2_02E6AD00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFCD1F 3_2_02EFCD1F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F012ED 3_2_02F012ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7B2C0 3_2_02E7B2C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E652A0 3_2_02E652A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EA739A 3_2_02EA739A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4D34C 3_2_02E4D34C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F1132D 3_2_02F1132D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F1F0E0 3_2_02F1F0E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F170E9 3_2_02F170E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E670C0 3_2_02E670C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F0F0CC 3_2_02F0F0CC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E6B1B0 3_2_02E6B1B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E9516C 3_2_02E9516C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4F172 3_2_02E4F172
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F2B16B 3_2_02F2B16B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F116CC 3_2_02F116CC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EA5630 3_2_02EA5630
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F1F7B0 3_2_02F1F7B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E51460 3_2_02E51460
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F1F43F 3_2_02F1F43F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F295C3 3_2_02F295C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFD5B0 3_2_02EFD5B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F17571 3_2_02F17571
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F0DAC6 3_2_02F0DAC6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFDAAC 3_2_02EFDAAC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EA5AA0 3_2_02EA5AA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F01AA3 3_2_02F01AA3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED3A6C 3_2_02ED3A6C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F17A46 3_2_02F17A46
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F1FA49 3_2_02F1FA49
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E9DBF9 3_2_02E9DBF9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED5BF0 3_2_02ED5BF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7FB80 3_2_02E7FB80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F1FB76 3_2_02F1FB76
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E638E0 3_2_02E638E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECD800 3_2_02ECD800
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E69950 3_2_02E69950
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7B950 3_2_02E7B950
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EF5910 3_2_02EF5910
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E69EB0 3_2_02E69EB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E23FD2 3_2_02E23FD2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E23FD5 3_2_02E23FD5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F1FFB1 3_2_02F1FFB1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E61F92 3_2_02E61F92
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F1FF09 3_2_02F1FF09
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F1FCF2 3_2_02F1FCF2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED9C32 3_2_02ED9C32
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7FDC0 3_2_02E7FDC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F17D73 3_2_02F17D73
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E63D40 3_2_02E63D40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F11D5A 3_2_02F11D5A
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: String function: 02E4B970 appears 280 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: String function: 02E95130 appears 59 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: String function: 02ECEA12 appears 86 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: String function: 02EDF290 appears 105 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: String function: 02EA7E54 appears 111 times
One or more processes crash
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6544 -s 240
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe, 00000000.00000002.2012410149.00000000012EE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe, 00000000.00000000.1988558146.0000000000E42000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamexseT.exeF vs SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe, 00000000.00000002.2015617071.0000000004119000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe, 00000000.00000002.2013517187.0000000003111000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGB-lesson-forms.dll@ vs SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe, 00000000.00000002.2017709295.0000000005C60000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameGB-lesson-forms.dll@ vs SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe, 00000000.00000002.2018143718.0000000007340000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe, 00000003.00000002.2328972056.0000000002F4D000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Binary or memory string: OriginalFilenamexseT.exeF vs SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 3.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 3.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.2328494578.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, qW3oPmKbfFSdIeQrE5.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, qW3oPmKbfFSdIeQrE5.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, qW3oPmKbfFSdIeQrE5.cs Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, MC2JBYLIIZges5Th4X.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, MC2JBYLIIZges5Th4X.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, qW3oPmKbfFSdIeQrE5.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, qW3oPmKbfFSdIeQrE5.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, qW3oPmKbfFSdIeQrE5.cs Security API names: _0020.AddAccessRule
Source: classification engine Classification label: mal88.troj.evad.winEXE@4/6@0/0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.log Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6544
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\370ff846-fc9b-4542-a0f9-312c7b783b07 Jump to behavior
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe ReversingLabs: Detection: 26%
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6544 -s 240
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: xseT.pdb source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe
Source: Binary string: xseT.pdbSHA256BnK source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe
Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe, 00000003.00000002.2328972056.0000000002E20000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe, SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe, 00000003.00000002.2328972056.0000000002E20000.00000040.00001000.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, qW3oPmKbfFSdIeQrE5.cs .Net Code: VSck9ui1av System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.5c60000.4.raw.unpack, .cs .Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.3146f30.0.raw.unpack, .cs .Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, qW3oPmKbfFSdIeQrE5.cs .Net Code: VSck9ui1av System.Reflection.Assembly.Load(byte[])
Binary contains a suspicious time stamp
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Static PE information: 0xA853240E [Sat Jun 28 10:16:46 2059 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_004488DB LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 3_2_004488DB
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 0_2_030BD4E0 pushfd ; ret 0_2_030BD4E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 0_2_0740A7A5 push 00000000h; retf 0_2_0740A7BC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 0_2_0740AA55 push FFFFFF8Bh; iretd 0_2_0740AA57
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00402040 push FFFFFFC2h; iretd 3_2_0040205C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00409028 push edx; iretd 3_2_0040903D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_0040D909 push 00000049h; retf 3_2_0040D914
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_004129C7 push edi; iretd 3_2_004129D7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_0040299A push cs; iretd 3_2_0040299D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_004029B3 push 0000000Eh; iretd 3_2_004029B7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_004129BE push edi; iretd 3_2_004129D7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_0042EAD7 push esi; ret 3_2_0042EAFF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00402AF5 push edi; iretd 3_2_00402B0B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00419327 push 68868784h; retf 3_2_00419350
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00402BC9 push ecx; iretd 3_2_00402BCC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00403C54 push eax; ret 3_2_00403C56
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00403400 push cs; iretd 3_2_00403401
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_0040B43A push 0000005Fh; iretd 3_2_0040B44C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00447D15 push ecx; ret 3_2_00447D28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00416E06 push ebp; ret 3_2_00416E07
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_0040DE92 push 3C5FAE21h; ret 3_2_0040DEB2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00411E9F push edx; iretd 3_2_00411EA9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00401F48 push FFFFFFC1h; iretd 3_2_00401F5B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00401F48 push esp; iretd 3_2_00401F90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00401F8A push esp; iretd 3_2_00401F90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E2225F pushad ; ret 3_2_02E227F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E227FA pushad ; ret 3_2_02E227F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E2283D push eax; iretd 3_2_02E22858
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E509AD push ecx; mov dword ptr [esp], ecx 3_2_02E509B6
Source: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Static PE information: section name: .text entropy: 7.931610915250254
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, YtRy2WELdLpIVJsvFh.cs High entropy of concatenated method names: 'A5sWqgmNfK', 'UV1WgCtpgg', 'yI0W9n2GY9', 'DQfWZcNU3J', 'RFTWh4lEIT', 'bpZW3XB9XA', 'wArWNSeMdv', 'E6hWJ8Gvs3', 'SRO8auGii4LJMYeDIIT', 'BaR7JDGFOCBnWKBE9oJ'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, XUPw0X9LpPWF2W1b5i.cs High entropy of concatenated method names: 'Yt6OZu6Dtw', 'G6iOhZlqsR', 'cFqOPiKsEY', 'UmPONG7Zux', 'vbiOdDTrt7', 'BeWODErL4F', 'tRhOH92ISy', 'STTOfIUyRN', 'KBaOscwf0u', 'As4OGUxvJe'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, jXe44KcwnkjDykoFFLo.cs High entropy of concatenated method names: 'G1DGgE1fb3', 'X9JGvsJa5w', 'NSXG9CmyCD', 'Vbj5v9m03WIHkNU00o2', 'tW2unhmtIYvT3WrZph5', 'JH26AumdhquCXEq8iat', 'xe4OxjmzK50lHb3OfJE'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, r7jukJciXBqyGCnNTun.cs High entropy of concatenated method names: 'W7Wsg7h7hy', 'KvqsvFXT1R', 'JNZs9HxIAD', 'KBCsZTO2nD', 'BS9s1vdWJn', 'jsTshSGvWK', 'URQs3cFu77', 'AFisPvdIkI', 'hlRsNaBi5P', 'olksJSx9ZY'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, Btociwfbe1wbtMmVZT.cs High entropy of concatenated method names: 'A7xHENmgu2', 'lYwHbC0kJQ', 'ToString', 'C1UHTdFAw1', 'S0DHMWqxAX', 'YRZHOOtyqk', 'ye9Hu1xS7V', 'cUBHWBCGA1', 'fgcHmExgSf', 'lpfHpQbx81'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, qd8To9h6m8hXD4lasj.cs High entropy of concatenated method names: 'Dispose', 'L6xKU779GU', 'iF55BEvgap', 'grKxxxaeAY', 'PtTKjNwJoH', 'hDhKzhBCUi', 'ProcessDialogKey', 'U775LHenDa', 'skw5K7DC93', 'ABs55awseX'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, TKsIknyRW79IkZdlgi.cs High entropy of concatenated method names: 'iOeWa3VWBG', 'AWEWMhGp6E', 'GZlWu7mVkR', 'YQ9Wmcu03x', 'GcRWpxYiUu', 'wsrunGptjW', 'KuEuYDir7O', 'TuluVy0jMJ', 'VJwu8ptZLa', 'xnnuUlEggu'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, QK6kJfMYLv0FgtQIDB.cs High entropy of concatenated method names: 'hqoH8PUYrj', 'pdfHjrC0HB', 'n75fLKn4lw', 'XTBfKjZnBU', 'SrKHeLQkE2', 'L5xHrPt88d', 'E4YHl7f1O8', 'p2GHXlnn5U', 'dnOHol1swc', 'PwYHCG37AA'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, JG7WZLeiTwcJY5p2IY.cs High entropy of concatenated method names: 'l16fSa4Vej', 'CwKfBekjtg', 'y1Df6liIre', 'Muwf4YtKUO', 'MUpfX3rDuQ', 'PClfIf27n7', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, n6R3wSc2FwDYmXxEkuj.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'my8GXm6tZv', 'UUJGoVSv58', 'wb8GCDGGr1', 'HoWG24JTih', 'qS1GnQc9Ar', 'D0BGYN0Vf8', 'RmPGVgxkEX'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, w1I8kICS0AERahopd7.cs High entropy of concatenated method names: 'LLCfTkSTvC', 'fXRfMnGQxI', 'ON2fOKoitb', 'crIfuH6mqu', 'nFVfW4vADh', 'QQqfmWyqZK', 'dFwfpo0cfy', 'P98fAUmBaP', 'eu1fEe6Fkf', 'lrffb9p73A'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, MC2JBYLIIZges5Th4X.cs High entropy of concatenated method names: 'x9BMX52JUf', 'eTUMotJWci', 'h1bMCegEPj', 'QdsM2Jvr9J', 'XLqMnMsSyD', 'HoWMYU4MZO', 'fGeMV71FOS', 'gcFM8mH3Ok', 'kbkMUPwMh5', 'hgwMj3YNvc'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, ib348tzEC454HdMBJC.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'VAbsR6MVqI', 'JRksd5sktY', 'L6FsDDs367', 'n2jsHMcE1Q', 'a4TsfPnCve', 'fj4ssxnijN', 'NJisGGXe2x'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, qW3oPmKbfFSdIeQrE5.cs High entropy of concatenated method names: 'GVawafUMc7', 'WCRwTNDXWY', 'OU6wMB8ygl', 'cqAwO8Nkij', 'JhewuisY8v', 'DfiwWZckr4', 'PpIwmLBW5t', 'YVQwpv1NCT', 'sfewA0T2jk', 'z0WwE7u1Qe'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, EPYWKmqssZjO7OKMQu.cs High entropy of concatenated method names: 'TvRmgFjXP6', 'BgkmvZ6wbg', 'bcsm94isaL', 'ytimZCW7kr', 't7vm1QcR4K', 'H4fmhJAX6X', 'U4Zm3qYlud', 'fkpmP8sZiW', 'XXkmNy1AIa', 'n9ZmJtTCIL'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, aSHBZwT1hqJmWy6URV.cs High entropy of concatenated method names: 'EBgu1K4qud', 'UKLu3GRBlv', 'tKZO6toKyW', 'bTPO4L1QyW', 'oBIOId02HC', 'jFcOtH0XC8', 'j16OiG6yZM', 'Wt7Oc27lBu', 'cLlOFNrOVp', 'E7SOyWvULh'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, UxgBotAGPTylo3v1Hh.cs High entropy of concatenated method names: 'nn6dyGpLOa', 'rn6driYAU7', 'cQbdXDLTm9', 'kNWdoM0bKt', 'fyRdB2jTyv', 'cYtd6BNXpo', 'ybwd4KvpuC', 'bwWdIU26K6', 'K0rdt4ahfp', 'e1Idi665Am'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, g6mP31wk0aYeyOCkvQ.cs High entropy of concatenated method names: 'Bxa9J08R0', 'rJMZ0xjDe', 'aCeh2WUrW', 'yir3WWMAq', 'Wx5NES9Ft', 'CgAJDSQT7', 'kSOHNjLo1bCXYCMyWR', 'Css2TjMofMvyb7MBHJ', 'Katfy5qJ3', 'YcGG8hZxI'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, iImVntPmxV3vdocuYL.cs High entropy of concatenated method names: 'CG7KmEKYRj', 'fxCKpn89MK', 'mKkKEaEZ09', 'SR3Kb4g0Pu', 'Hm1KdJaUFw', 'jchKDGtror', 'Cda3fD5LTYPMLj74Xn', 'fPLLdmKYQSwr6pJ7ae', 'IUOKKwMSBI', 'JmOKw2HJbM'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, hSEnC658EMEqM5ffAF.cs High entropy of concatenated method names: 'tOXsK90pTV', 'hN7swXEvf2', 'yQjsknRBhk', 'l1ZsTLAVhM', 'OQQsMqAgyy', 'qltsul1arL', 'WuVsWRI51b', 'g24fVnxTIs', 'GC5f8FsbhV', 'kEffUiVCI2'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.7340000.5.raw.unpack, JZBLdZ3taFKA3Yj6mn.cs High entropy of concatenated method names: 'xZnRP3xiLo', 'd3MRN366MC', 'tsTRSYIPUQ', 'PlXRBNg3Ye', 'rTeR4tJhWH', 'oe7RIp5tpK', 'dtrRiFfrTa', 'GccRccRsP5', 'kXRRy230fr', 'veSRewWdlD'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, YtRy2WELdLpIVJsvFh.cs High entropy of concatenated method names: 'A5sWqgmNfK', 'UV1WgCtpgg', 'yI0W9n2GY9', 'DQfWZcNU3J', 'RFTWh4lEIT', 'bpZW3XB9XA', 'wArWNSeMdv', 'E6hWJ8Gvs3', 'SRO8auGii4LJMYeDIIT', 'BaR7JDGFOCBnWKBE9oJ'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, XUPw0X9LpPWF2W1b5i.cs High entropy of concatenated method names: 'Yt6OZu6Dtw', 'G6iOhZlqsR', 'cFqOPiKsEY', 'UmPONG7Zux', 'vbiOdDTrt7', 'BeWODErL4F', 'tRhOH92ISy', 'STTOfIUyRN', 'KBaOscwf0u', 'As4OGUxvJe'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, jXe44KcwnkjDykoFFLo.cs High entropy of concatenated method names: 'G1DGgE1fb3', 'X9JGvsJa5w', 'NSXG9CmyCD', 'Vbj5v9m03WIHkNU00o2', 'tW2unhmtIYvT3WrZph5', 'JH26AumdhquCXEq8iat', 'xe4OxjmzK50lHb3OfJE'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, r7jukJciXBqyGCnNTun.cs High entropy of concatenated method names: 'W7Wsg7h7hy', 'KvqsvFXT1R', 'JNZs9HxIAD', 'KBCsZTO2nD', 'BS9s1vdWJn', 'jsTshSGvWK', 'URQs3cFu77', 'AFisPvdIkI', 'hlRsNaBi5P', 'olksJSx9ZY'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, Btociwfbe1wbtMmVZT.cs High entropy of concatenated method names: 'A7xHENmgu2', 'lYwHbC0kJQ', 'ToString', 'C1UHTdFAw1', 'S0DHMWqxAX', 'YRZHOOtyqk', 'ye9Hu1xS7V', 'cUBHWBCGA1', 'fgcHmExgSf', 'lpfHpQbx81'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, qd8To9h6m8hXD4lasj.cs High entropy of concatenated method names: 'Dispose', 'L6xKU779GU', 'iF55BEvgap', 'grKxxxaeAY', 'PtTKjNwJoH', 'hDhKzhBCUi', 'ProcessDialogKey', 'U775LHenDa', 'skw5K7DC93', 'ABs55awseX'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, TKsIknyRW79IkZdlgi.cs High entropy of concatenated method names: 'iOeWa3VWBG', 'AWEWMhGp6E', 'GZlWu7mVkR', 'YQ9Wmcu03x', 'GcRWpxYiUu', 'wsrunGptjW', 'KuEuYDir7O', 'TuluVy0jMJ', 'VJwu8ptZLa', 'xnnuUlEggu'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, QK6kJfMYLv0FgtQIDB.cs High entropy of concatenated method names: 'hqoH8PUYrj', 'pdfHjrC0HB', 'n75fLKn4lw', 'XTBfKjZnBU', 'SrKHeLQkE2', 'L5xHrPt88d', 'E4YHl7f1O8', 'p2GHXlnn5U', 'dnOHol1swc', 'PwYHCG37AA'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, JG7WZLeiTwcJY5p2IY.cs High entropy of concatenated method names: 'l16fSa4Vej', 'CwKfBekjtg', 'y1Df6liIre', 'Muwf4YtKUO', 'MUpfX3rDuQ', 'PClfIf27n7', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, n6R3wSc2FwDYmXxEkuj.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'my8GXm6tZv', 'UUJGoVSv58', 'wb8GCDGGr1', 'HoWG24JTih', 'qS1GnQc9Ar', 'D0BGYN0Vf8', 'RmPGVgxkEX'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, w1I8kICS0AERahopd7.cs High entropy of concatenated method names: 'LLCfTkSTvC', 'fXRfMnGQxI', 'ON2fOKoitb', 'crIfuH6mqu', 'nFVfW4vADh', 'QQqfmWyqZK', 'dFwfpo0cfy', 'P98fAUmBaP', 'eu1fEe6Fkf', 'lrffb9p73A'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, MC2JBYLIIZges5Th4X.cs High entropy of concatenated method names: 'x9BMX52JUf', 'eTUMotJWci', 'h1bMCegEPj', 'QdsM2Jvr9J', 'XLqMnMsSyD', 'HoWMYU4MZO', 'fGeMV71FOS', 'gcFM8mH3Ok', 'kbkMUPwMh5', 'hgwMj3YNvc'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, ib348tzEC454HdMBJC.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'VAbsR6MVqI', 'JRksd5sktY', 'L6FsDDs367', 'n2jsHMcE1Q', 'a4TsfPnCve', 'fj4ssxnijN', 'NJisGGXe2x'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, qW3oPmKbfFSdIeQrE5.cs High entropy of concatenated method names: 'GVawafUMc7', 'WCRwTNDXWY', 'OU6wMB8ygl', 'cqAwO8Nkij', 'JhewuisY8v', 'DfiwWZckr4', 'PpIwmLBW5t', 'YVQwpv1NCT', 'sfewA0T2jk', 'z0WwE7u1Qe'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, EPYWKmqssZjO7OKMQu.cs High entropy of concatenated method names: 'TvRmgFjXP6', 'BgkmvZ6wbg', 'bcsm94isaL', 'ytimZCW7kr', 't7vm1QcR4K', 'H4fmhJAX6X', 'U4Zm3qYlud', 'fkpmP8sZiW', 'XXkmNy1AIa', 'n9ZmJtTCIL'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, aSHBZwT1hqJmWy6URV.cs High entropy of concatenated method names: 'EBgu1K4qud', 'UKLu3GRBlv', 'tKZO6toKyW', 'bTPO4L1QyW', 'oBIOId02HC', 'jFcOtH0XC8', 'j16OiG6yZM', 'Wt7Oc27lBu', 'cLlOFNrOVp', 'E7SOyWvULh'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, UxgBotAGPTylo3v1Hh.cs High entropy of concatenated method names: 'nn6dyGpLOa', 'rn6driYAU7', 'cQbdXDLTm9', 'kNWdoM0bKt', 'fyRdB2jTyv', 'cYtd6BNXpo', 'ybwd4KvpuC', 'bwWdIU26K6', 'K0rdt4ahfp', 'e1Idi665Am'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, g6mP31wk0aYeyOCkvQ.cs High entropy of concatenated method names: 'Bxa9J08R0', 'rJMZ0xjDe', 'aCeh2WUrW', 'yir3WWMAq', 'Wx5NES9Ft', 'CgAJDSQT7', 'kSOHNjLo1bCXYCMyWR', 'Css2TjMofMvyb7MBHJ', 'Katfy5qJ3', 'YcGG8hZxI'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, iImVntPmxV3vdocuYL.cs High entropy of concatenated method names: 'CG7KmEKYRj', 'fxCKpn89MK', 'mKkKEaEZ09', 'SR3Kb4g0Pu', 'Hm1KdJaUFw', 'jchKDGtror', 'Cda3fD5LTYPMLj74Xn', 'fPLLdmKYQSwr6pJ7ae', 'IUOKKwMSBI', 'JmOKw2HJbM'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, hSEnC658EMEqM5ffAF.cs High entropy of concatenated method names: 'tOXsK90pTV', 'hN7swXEvf2', 'yQjsknRBhk', 'l1ZsTLAVhM', 'OQQsMqAgyy', 'qltsul1arL', 'WuVsWRI51b', 'g24fVnxTIs', 'GC5f8FsbhV', 'kEffUiVCI2'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.4374a80.2.raw.unpack, JZBLdZ3taFKA3Yj6mn.cs High entropy of concatenated method names: 'xZnRP3xiLo', 'd3MRN366MC', 'tsTRSYIPUQ', 'PlXRBNg3Ye', 'rTeR4tJhWH', 'oe7RIp5tpK', 'dtrRiFfrTa', 'GccRccRsP5', 'kXRRy230fr', 'veSRewWdlD'
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe PID: 5632, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Memory allocated: 3060000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Memory allocated: 3110000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Memory allocated: 5110000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Memory allocated: 7FB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Memory allocated: 7550000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Memory allocated: 8FB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Memory allocated: 9FB0000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E9096E rdtsc 3_2_02E9096E
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe API coverage: 0.3 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe TID: 4956 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: Amcache.hve.7.dr Binary or memory string: VMware
Source: Amcache.hve.7.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.7.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.7.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr Binary or memory string: vmci.sys
Source: Amcache.hve.7.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.7.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.7.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.7.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.7.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.7.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E9096E rdtsc 3_2_02E9096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92C0A LdrInitializeThunk, 3_2_02E92C0A
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_004468DC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_004468DC
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_004488DB LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 3_2_004488DB
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E602E1 mov eax, dword ptr fs:[00000030h] 3_2_02E602E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E602E1 mov eax, dword ptr fs:[00000030h] 3_2_02E602E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E602E1 mov eax, dword ptr fs:[00000030h] 3_2_02E602E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F262D6 mov eax, dword ptr fs:[00000030h] 3_2_02F262D6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5A2C3 mov eax, dword ptr fs:[00000030h] 3_2_02E5A2C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5A2C3 mov eax, dword ptr fs:[00000030h] 3_2_02E5A2C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5A2C3 mov eax, dword ptr fs:[00000030h] 3_2_02E5A2C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5A2C3 mov eax, dword ptr fs:[00000030h] 3_2_02E5A2C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5A2C3 mov eax, dword ptr fs:[00000030h] 3_2_02E5A2C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E602A0 mov eax, dword ptr fs:[00000030h] 3_2_02E602A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E602A0 mov eax, dword ptr fs:[00000030h] 3_2_02E602A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE62A0 mov eax, dword ptr fs:[00000030h] 3_2_02EE62A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE62A0 mov ecx, dword ptr fs:[00000030h] 3_2_02EE62A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE62A0 mov eax, dword ptr fs:[00000030h] 3_2_02EE62A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE62A0 mov eax, dword ptr fs:[00000030h] 3_2_02EE62A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE62A0 mov eax, dword ptr fs:[00000030h] 3_2_02EE62A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE62A0 mov eax, dword ptr fs:[00000030h] 3_2_02EE62A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8E284 mov eax, dword ptr fs:[00000030h] 3_2_02E8E284
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8E284 mov eax, dword ptr fs:[00000030h] 3_2_02E8E284
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED0283 mov eax, dword ptr fs:[00000030h] 3_2_02ED0283
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED0283 mov eax, dword ptr fs:[00000030h] 3_2_02ED0283
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED0283 mov eax, dword ptr fs:[00000030h] 3_2_02ED0283
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F00274 mov eax, dword ptr fs:[00000030h] 3_2_02F00274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F00274 mov eax, dword ptr fs:[00000030h] 3_2_02F00274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F00274 mov eax, dword ptr fs:[00000030h] 3_2_02F00274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F00274 mov eax, dword ptr fs:[00000030h] 3_2_02F00274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F00274 mov eax, dword ptr fs:[00000030h] 3_2_02F00274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F00274 mov eax, dword ptr fs:[00000030h] 3_2_02F00274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F00274 mov eax, dword ptr fs:[00000030h] 3_2_02F00274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F00274 mov eax, dword ptr fs:[00000030h] 3_2_02F00274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F00274 mov eax, dword ptr fs:[00000030h] 3_2_02F00274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F00274 mov eax, dword ptr fs:[00000030h] 3_2_02F00274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F00274 mov eax, dword ptr fs:[00000030h] 3_2_02F00274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F00274 mov eax, dword ptr fs:[00000030h] 3_2_02F00274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E54260 mov eax, dword ptr fs:[00000030h] 3_2_02E54260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E54260 mov eax, dword ptr fs:[00000030h] 3_2_02E54260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E54260 mov eax, dword ptr fs:[00000030h] 3_2_02E54260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4826B mov eax, dword ptr fs:[00000030h] 3_2_02E4826B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F0A250 mov eax, dword ptr fs:[00000030h] 3_2_02F0A250
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F0A250 mov eax, dword ptr fs:[00000030h] 3_2_02F0A250
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED8243 mov eax, dword ptr fs:[00000030h] 3_2_02ED8243
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED8243 mov ecx, dword ptr fs:[00000030h] 3_2_02ED8243
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F2625D mov eax, dword ptr fs:[00000030h] 3_2_02F2625D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4A250 mov eax, dword ptr fs:[00000030h] 3_2_02E4A250
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E56259 mov eax, dword ptr fs:[00000030h] 3_2_02E56259
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4823B mov eax, dword ptr fs:[00000030h] 3_2_02E4823B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E603E9 mov eax, dword ptr fs:[00000030h] 3_2_02E603E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E603E9 mov eax, dword ptr fs:[00000030h] 3_2_02E603E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E603E9 mov eax, dword ptr fs:[00000030h] 3_2_02E603E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E603E9 mov eax, dword ptr fs:[00000030h] 3_2_02E603E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E603E9 mov eax, dword ptr fs:[00000030h] 3_2_02E603E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E603E9 mov eax, dword ptr fs:[00000030h] 3_2_02E603E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E603E9 mov eax, dword ptr fs:[00000030h] 3_2_02E603E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E603E9 mov eax, dword ptr fs:[00000030h] 3_2_02E603E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E6E3F0 mov eax, dword ptr fs:[00000030h] 3_2_02E6E3F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E6E3F0 mov eax, dword ptr fs:[00000030h] 3_2_02E6E3F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E6E3F0 mov eax, dword ptr fs:[00000030h] 3_2_02E6E3F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E863FF mov eax, dword ptr fs:[00000030h] 3_2_02E863FF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5A3C0 mov eax, dword ptr fs:[00000030h] 3_2_02E5A3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5A3C0 mov eax, dword ptr fs:[00000030h] 3_2_02E5A3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5A3C0 mov eax, dword ptr fs:[00000030h] 3_2_02E5A3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5A3C0 mov eax, dword ptr fs:[00000030h] 3_2_02E5A3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5A3C0 mov eax, dword ptr fs:[00000030h] 3_2_02E5A3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5A3C0 mov eax, dword ptr fs:[00000030h] 3_2_02E5A3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E583C0 mov eax, dword ptr fs:[00000030h] 3_2_02E583C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E583C0 mov eax, dword ptr fs:[00000030h] 3_2_02E583C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E583C0 mov eax, dword ptr fs:[00000030h] 3_2_02E583C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E583C0 mov eax, dword ptr fs:[00000030h] 3_2_02E583C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED63C0 mov eax, dword ptr fs:[00000030h] 3_2_02ED63C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFE3DB mov eax, dword ptr fs:[00000030h] 3_2_02EFE3DB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFE3DB mov eax, dword ptr fs:[00000030h] 3_2_02EFE3DB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFE3DB mov ecx, dword ptr fs:[00000030h] 3_2_02EFE3DB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFE3DB mov eax, dword ptr fs:[00000030h] 3_2_02EFE3DB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EF43D4 mov eax, dword ptr fs:[00000030h] 3_2_02EF43D4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EF43D4 mov eax, dword ptr fs:[00000030h] 3_2_02EF43D4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F0C3CD mov eax, dword ptr fs:[00000030h] 3_2_02F0C3CD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7438F mov eax, dword ptr fs:[00000030h] 3_2_02E7438F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7438F mov eax, dword ptr fs:[00000030h] 3_2_02E7438F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4E388 mov eax, dword ptr fs:[00000030h] 3_2_02E4E388
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4E388 mov eax, dword ptr fs:[00000030h] 3_2_02E4E388
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4E388 mov eax, dword ptr fs:[00000030h] 3_2_02E4E388
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E48397 mov eax, dword ptr fs:[00000030h] 3_2_02E48397
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E48397 mov eax, dword ptr fs:[00000030h] 3_2_02E48397
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E48397 mov eax, dword ptr fs:[00000030h] 3_2_02E48397
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EF437C mov eax, dword ptr fs:[00000030h] 3_2_02EF437C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F1A352 mov eax, dword ptr fs:[00000030h] 3_2_02F1A352
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED2349 mov eax, dword ptr fs:[00000030h] 3_2_02ED2349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED2349 mov eax, dword ptr fs:[00000030h] 3_2_02ED2349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED2349 mov eax, dword ptr fs:[00000030h] 3_2_02ED2349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED2349 mov eax, dword ptr fs:[00000030h] 3_2_02ED2349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED2349 mov eax, dword ptr fs:[00000030h] 3_2_02ED2349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED2349 mov eax, dword ptr fs:[00000030h] 3_2_02ED2349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED2349 mov eax, dword ptr fs:[00000030h] 3_2_02ED2349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED2349 mov eax, dword ptr fs:[00000030h] 3_2_02ED2349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED2349 mov eax, dword ptr fs:[00000030h] 3_2_02ED2349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED2349 mov eax, dword ptr fs:[00000030h] 3_2_02ED2349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED2349 mov eax, dword ptr fs:[00000030h] 3_2_02ED2349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED2349 mov eax, dword ptr fs:[00000030h] 3_2_02ED2349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED2349 mov eax, dword ptr fs:[00000030h] 3_2_02ED2349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED2349 mov eax, dword ptr fs:[00000030h] 3_2_02ED2349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED2349 mov eax, dword ptr fs:[00000030h] 3_2_02ED2349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED035C mov eax, dword ptr fs:[00000030h] 3_2_02ED035C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED035C mov eax, dword ptr fs:[00000030h] 3_2_02ED035C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED035C mov eax, dword ptr fs:[00000030h] 3_2_02ED035C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED035C mov ecx, dword ptr fs:[00000030h] 3_2_02ED035C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED035C mov eax, dword ptr fs:[00000030h] 3_2_02ED035C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED035C mov eax, dword ptr fs:[00000030h] 3_2_02ED035C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F2634F mov eax, dword ptr fs:[00000030h] 3_2_02F2634F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EF8350 mov ecx, dword ptr fs:[00000030h] 3_2_02EF8350
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F28324 mov eax, dword ptr fs:[00000030h] 3_2_02F28324
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F28324 mov ecx, dword ptr fs:[00000030h] 3_2_02F28324
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F28324 mov eax, dword ptr fs:[00000030h] 3_2_02F28324
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F28324 mov eax, dword ptr fs:[00000030h] 3_2_02F28324
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8A30B mov eax, dword ptr fs:[00000030h] 3_2_02E8A30B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8A30B mov eax, dword ptr fs:[00000030h] 3_2_02E8A30B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8A30B mov eax, dword ptr fs:[00000030h] 3_2_02E8A30B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4C310 mov ecx, dword ptr fs:[00000030h] 3_2_02E4C310
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E70310 mov ecx, dword ptr fs:[00000030h] 3_2_02E70310
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4A0E3 mov ecx, dword ptr fs:[00000030h] 3_2_02E4A0E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E580E9 mov eax, dword ptr fs:[00000030h] 3_2_02E580E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED60E0 mov eax, dword ptr fs:[00000030h] 3_2_02ED60E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4C0F0 mov eax, dword ptr fs:[00000030h] 3_2_02E4C0F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E920F0 mov ecx, dword ptr fs:[00000030h] 3_2_02E920F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED20DE mov eax, dword ptr fs:[00000030h] 3_2_02ED20DE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E480A0 mov eax, dword ptr fs:[00000030h] 3_2_02E480A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE80A8 mov eax, dword ptr fs:[00000030h] 3_2_02EE80A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F160B8 mov eax, dword ptr fs:[00000030h] 3_2_02F160B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F160B8 mov ecx, dword ptr fs:[00000030h] 3_2_02F160B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5208A mov eax, dword ptr fs:[00000030h] 3_2_02E5208A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7C073 mov eax, dword ptr fs:[00000030h] 3_2_02E7C073
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E52050 mov eax, dword ptr fs:[00000030h] 3_2_02E52050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED6050 mov eax, dword ptr fs:[00000030h] 3_2_02ED6050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4A020 mov eax, dword ptr fs:[00000030h] 3_2_02E4A020
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4C020 mov eax, dword ptr fs:[00000030h] 3_2_02E4C020
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE6030 mov eax, dword ptr fs:[00000030h] 3_2_02EE6030
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED4000 mov ecx, dword ptr fs:[00000030h] 3_2_02ED4000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EF2000 mov eax, dword ptr fs:[00000030h] 3_2_02EF2000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EF2000 mov eax, dword ptr fs:[00000030h] 3_2_02EF2000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EF2000 mov eax, dword ptr fs:[00000030h] 3_2_02EF2000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EF2000 mov eax, dword ptr fs:[00000030h] 3_2_02EF2000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EF2000 mov eax, dword ptr fs:[00000030h] 3_2_02EF2000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EF2000 mov eax, dword ptr fs:[00000030h] 3_2_02EF2000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EF2000 mov eax, dword ptr fs:[00000030h] 3_2_02EF2000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EF2000 mov eax, dword ptr fs:[00000030h] 3_2_02EF2000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E6E016 mov eax, dword ptr fs:[00000030h] 3_2_02E6E016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E6E016 mov eax, dword ptr fs:[00000030h] 3_2_02E6E016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E6E016 mov eax, dword ptr fs:[00000030h] 3_2_02E6E016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E6E016 mov eax, dword ptr fs:[00000030h] 3_2_02E6E016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E801F8 mov eax, dword ptr fs:[00000030h] 3_2_02E801F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F261E5 mov eax, dword ptr fs:[00000030h] 3_2_02F261E5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F161C3 mov eax, dword ptr fs:[00000030h] 3_2_02F161C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F161C3 mov eax, dword ptr fs:[00000030h] 3_2_02F161C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECE1D0 mov eax, dword ptr fs:[00000030h] 3_2_02ECE1D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECE1D0 mov eax, dword ptr fs:[00000030h] 3_2_02ECE1D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECE1D0 mov ecx, dword ptr fs:[00000030h] 3_2_02ECE1D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECE1D0 mov eax, dword ptr fs:[00000030h] 3_2_02ECE1D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECE1D0 mov eax, dword ptr fs:[00000030h] 3_2_02ECE1D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E90185 mov eax, dword ptr fs:[00000030h] 3_2_02E90185
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EF4180 mov eax, dword ptr fs:[00000030h] 3_2_02EF4180
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EF4180 mov eax, dword ptr fs:[00000030h] 3_2_02EF4180
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED019F mov eax, dword ptr fs:[00000030h] 3_2_02ED019F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED019F mov eax, dword ptr fs:[00000030h] 3_2_02ED019F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED019F mov eax, dword ptr fs:[00000030h] 3_2_02ED019F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED019F mov eax, dword ptr fs:[00000030h] 3_2_02ED019F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4A197 mov eax, dword ptr fs:[00000030h] 3_2_02E4A197
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4A197 mov eax, dword ptr fs:[00000030h] 3_2_02E4A197
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4A197 mov eax, dword ptr fs:[00000030h] 3_2_02E4A197
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F0C188 mov eax, dword ptr fs:[00000030h] 3_2_02F0C188
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F0C188 mov eax, dword ptr fs:[00000030h] 3_2_02F0C188
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F24164 mov eax, dword ptr fs:[00000030h] 3_2_02F24164
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F24164 mov eax, dword ptr fs:[00000030h] 3_2_02F24164
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE4144 mov eax, dword ptr fs:[00000030h] 3_2_02EE4144
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE4144 mov eax, dword ptr fs:[00000030h] 3_2_02EE4144
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE4144 mov ecx, dword ptr fs:[00000030h] 3_2_02EE4144
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE4144 mov eax, dword ptr fs:[00000030h] 3_2_02EE4144
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE4144 mov eax, dword ptr fs:[00000030h] 3_2_02EE4144
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E56154 mov eax, dword ptr fs:[00000030h] 3_2_02E56154
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E56154 mov eax, dword ptr fs:[00000030h] 3_2_02E56154
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4C156 mov eax, dword ptr fs:[00000030h] 3_2_02E4C156
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE8158 mov eax, dword ptr fs:[00000030h] 3_2_02EE8158
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E80124 mov eax, dword ptr fs:[00000030h] 3_2_02E80124
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFE10E mov eax, dword ptr fs:[00000030h] 3_2_02EFE10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFE10E mov ecx, dword ptr fs:[00000030h] 3_2_02EFE10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFE10E mov eax, dword ptr fs:[00000030h] 3_2_02EFE10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFE10E mov eax, dword ptr fs:[00000030h] 3_2_02EFE10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFE10E mov ecx, dword ptr fs:[00000030h] 3_2_02EFE10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFE10E mov eax, dword ptr fs:[00000030h] 3_2_02EFE10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFE10E mov eax, dword ptr fs:[00000030h] 3_2_02EFE10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFE10E mov ecx, dword ptr fs:[00000030h] 3_2_02EFE10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFE10E mov eax, dword ptr fs:[00000030h] 3_2_02EFE10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFE10E mov ecx, dword ptr fs:[00000030h] 3_2_02EFE10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F10115 mov eax, dword ptr fs:[00000030h] 3_2_02F10115
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFA118 mov ecx, dword ptr fs:[00000030h] 3_2_02EFA118
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFA118 mov eax, dword ptr fs:[00000030h] 3_2_02EFA118
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFA118 mov eax, dword ptr fs:[00000030h] 3_2_02EFA118
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFA118 mov eax, dword ptr fs:[00000030h] 3_2_02EFA118
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED06F1 mov eax, dword ptr fs:[00000030h] 3_2_02ED06F1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED06F1 mov eax, dword ptr fs:[00000030h] 3_2_02ED06F1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECE6F2 mov eax, dword ptr fs:[00000030h] 3_2_02ECE6F2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECE6F2 mov eax, dword ptr fs:[00000030h] 3_2_02ECE6F2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECE6F2 mov eax, dword ptr fs:[00000030h] 3_2_02ECE6F2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECE6F2 mov eax, dword ptr fs:[00000030h] 3_2_02ECE6F2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8A6C7 mov ebx, dword ptr fs:[00000030h] 3_2_02E8A6C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8A6C7 mov eax, dword ptr fs:[00000030h] 3_2_02E8A6C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8C6A6 mov eax, dword ptr fs:[00000030h] 3_2_02E8C6A6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E866B0 mov eax, dword ptr fs:[00000030h] 3_2_02E866B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E54690 mov eax, dword ptr fs:[00000030h] 3_2_02E54690
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E54690 mov eax, dword ptr fs:[00000030h] 3_2_02E54690
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8A660 mov eax, dword ptr fs:[00000030h] 3_2_02E8A660
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8A660 mov eax, dword ptr fs:[00000030h] 3_2_02E8A660
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E82674 mov eax, dword ptr fs:[00000030h] 3_2_02E82674
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F1866E mov eax, dword ptr fs:[00000030h] 3_2_02F1866E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F1866E mov eax, dword ptr fs:[00000030h] 3_2_02F1866E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E6C640 mov eax, dword ptr fs:[00000030h] 3_2_02E6C640
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E6E627 mov eax, dword ptr fs:[00000030h] 3_2_02E6E627
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E86620 mov eax, dword ptr fs:[00000030h] 3_2_02E86620
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E88620 mov eax, dword ptr fs:[00000030h] 3_2_02E88620
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5262C mov eax, dword ptr fs:[00000030h] 3_2_02E5262C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECE609 mov eax, dword ptr fs:[00000030h] 3_2_02ECE609
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E6260B mov eax, dword ptr fs:[00000030h] 3_2_02E6260B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E6260B mov eax, dword ptr fs:[00000030h] 3_2_02E6260B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E6260B mov eax, dword ptr fs:[00000030h] 3_2_02E6260B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E6260B mov eax, dword ptr fs:[00000030h] 3_2_02E6260B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E6260B mov eax, dword ptr fs:[00000030h] 3_2_02E6260B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E6260B mov eax, dword ptr fs:[00000030h] 3_2_02E6260B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E6260B mov eax, dword ptr fs:[00000030h] 3_2_02E6260B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92619 mov eax, dword ptr fs:[00000030h] 3_2_02E92619
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E727ED mov eax, dword ptr fs:[00000030h] 3_2_02E727ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E727ED mov eax, dword ptr fs:[00000030h] 3_2_02E727ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E727ED mov eax, dword ptr fs:[00000030h] 3_2_02E727ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EDE7E1 mov eax, dword ptr fs:[00000030h] 3_2_02EDE7E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E547FB mov eax, dword ptr fs:[00000030h] 3_2_02E547FB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E547FB mov eax, dword ptr fs:[00000030h] 3_2_02E547FB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5C7C0 mov eax, dword ptr fs:[00000030h] 3_2_02E5C7C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED07C3 mov eax, dword ptr fs:[00000030h] 3_2_02ED07C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E507AF mov eax, dword ptr fs:[00000030h] 3_2_02E507AF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F047A0 mov eax, dword ptr fs:[00000030h] 3_2_02F047A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EF678E mov eax, dword ptr fs:[00000030h] 3_2_02EF678E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E58770 mov eax, dword ptr fs:[00000030h] 3_2_02E58770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60770 mov eax, dword ptr fs:[00000030h] 3_2_02E60770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60770 mov eax, dword ptr fs:[00000030h] 3_2_02E60770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60770 mov eax, dword ptr fs:[00000030h] 3_2_02E60770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60770 mov eax, dword ptr fs:[00000030h] 3_2_02E60770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60770 mov eax, dword ptr fs:[00000030h] 3_2_02E60770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60770 mov eax, dword ptr fs:[00000030h] 3_2_02E60770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60770 mov eax, dword ptr fs:[00000030h] 3_2_02E60770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60770 mov eax, dword ptr fs:[00000030h] 3_2_02E60770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60770 mov eax, dword ptr fs:[00000030h] 3_2_02E60770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60770 mov eax, dword ptr fs:[00000030h] 3_2_02E60770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60770 mov eax, dword ptr fs:[00000030h] 3_2_02E60770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60770 mov eax, dword ptr fs:[00000030h] 3_2_02E60770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8674D mov esi, dword ptr fs:[00000030h] 3_2_02E8674D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8674D mov eax, dword ptr fs:[00000030h] 3_2_02E8674D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8674D mov eax, dword ptr fs:[00000030h] 3_2_02E8674D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EDE75D mov eax, dword ptr fs:[00000030h] 3_2_02EDE75D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E50750 mov eax, dword ptr fs:[00000030h] 3_2_02E50750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED4755 mov eax, dword ptr fs:[00000030h] 3_2_02ED4755
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92750 mov eax, dword ptr fs:[00000030h] 3_2_02E92750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E92750 mov eax, dword ptr fs:[00000030h] 3_2_02E92750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8C720 mov eax, dword ptr fs:[00000030h] 3_2_02E8C720
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8C720 mov eax, dword ptr fs:[00000030h] 3_2_02E8C720
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8273C mov eax, dword ptr fs:[00000030h] 3_2_02E8273C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8273C mov ecx, dword ptr fs:[00000030h] 3_2_02E8273C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8273C mov eax, dword ptr fs:[00000030h] 3_2_02E8273C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECC730 mov eax, dword ptr fs:[00000030h] 3_2_02ECC730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8C700 mov eax, dword ptr fs:[00000030h] 3_2_02E8C700
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E50710 mov eax, dword ptr fs:[00000030h] 3_2_02E50710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E80710 mov eax, dword ptr fs:[00000030h] 3_2_02E80710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E504E5 mov ecx, dword ptr fs:[00000030h] 3_2_02E504E5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E564AB mov eax, dword ptr fs:[00000030h] 3_2_02E564AB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E844B0 mov ecx, dword ptr fs:[00000030h] 3_2_02E844B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EDA4B0 mov eax, dword ptr fs:[00000030h] 3_2_02EDA4B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F0A49A mov eax, dword ptr fs:[00000030h] 3_2_02F0A49A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EDC460 mov ecx, dword ptr fs:[00000030h] 3_2_02EDC460
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7A470 mov eax, dword ptr fs:[00000030h] 3_2_02E7A470
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7A470 mov eax, dword ptr fs:[00000030h] 3_2_02E7A470
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7A470 mov eax, dword ptr fs:[00000030h] 3_2_02E7A470
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F0A456 mov eax, dword ptr fs:[00000030h] 3_2_02F0A456
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8E443 mov eax, dword ptr fs:[00000030h] 3_2_02E8E443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8E443 mov eax, dword ptr fs:[00000030h] 3_2_02E8E443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8E443 mov eax, dword ptr fs:[00000030h] 3_2_02E8E443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8E443 mov eax, dword ptr fs:[00000030h] 3_2_02E8E443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8E443 mov eax, dword ptr fs:[00000030h] 3_2_02E8E443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8E443 mov eax, dword ptr fs:[00000030h] 3_2_02E8E443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8E443 mov eax, dword ptr fs:[00000030h] 3_2_02E8E443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8E443 mov eax, dword ptr fs:[00000030h] 3_2_02E8E443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4645D mov eax, dword ptr fs:[00000030h] 3_2_02E4645D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7245A mov eax, dword ptr fs:[00000030h] 3_2_02E7245A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4C427 mov eax, dword ptr fs:[00000030h] 3_2_02E4C427
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4E420 mov eax, dword ptr fs:[00000030h] 3_2_02E4E420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4E420 mov eax, dword ptr fs:[00000030h] 3_2_02E4E420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4E420 mov eax, dword ptr fs:[00000030h] 3_2_02E4E420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED6420 mov eax, dword ptr fs:[00000030h] 3_2_02ED6420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED6420 mov eax, dword ptr fs:[00000030h] 3_2_02ED6420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED6420 mov eax, dword ptr fs:[00000030h] 3_2_02ED6420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED6420 mov eax, dword ptr fs:[00000030h] 3_2_02ED6420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED6420 mov eax, dword ptr fs:[00000030h] 3_2_02ED6420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED6420 mov eax, dword ptr fs:[00000030h] 3_2_02ED6420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED6420 mov eax, dword ptr fs:[00000030h] 3_2_02ED6420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8A430 mov eax, dword ptr fs:[00000030h] 3_2_02E8A430
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E88402 mov eax, dword ptr fs:[00000030h] 3_2_02E88402
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E88402 mov eax, dword ptr fs:[00000030h] 3_2_02E88402
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E88402 mov eax, dword ptr fs:[00000030h] 3_2_02E88402
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7E5E7 mov eax, dword ptr fs:[00000030h] 3_2_02E7E5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7E5E7 mov eax, dword ptr fs:[00000030h] 3_2_02E7E5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7E5E7 mov eax, dword ptr fs:[00000030h] 3_2_02E7E5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7E5E7 mov eax, dword ptr fs:[00000030h] 3_2_02E7E5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7E5E7 mov eax, dword ptr fs:[00000030h] 3_2_02E7E5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7E5E7 mov eax, dword ptr fs:[00000030h] 3_2_02E7E5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7E5E7 mov eax, dword ptr fs:[00000030h] 3_2_02E7E5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7E5E7 mov eax, dword ptr fs:[00000030h] 3_2_02E7E5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E525E0 mov eax, dword ptr fs:[00000030h] 3_2_02E525E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8C5ED mov eax, dword ptr fs:[00000030h] 3_2_02E8C5ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8C5ED mov eax, dword ptr fs:[00000030h] 3_2_02E8C5ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8E5CF mov eax, dword ptr fs:[00000030h] 3_2_02E8E5CF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8E5CF mov eax, dword ptr fs:[00000030h] 3_2_02E8E5CF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E565D0 mov eax, dword ptr fs:[00000030h] 3_2_02E565D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8A5D0 mov eax, dword ptr fs:[00000030h] 3_2_02E8A5D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8A5D0 mov eax, dword ptr fs:[00000030h] 3_2_02E8A5D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED05A7 mov eax, dword ptr fs:[00000030h] 3_2_02ED05A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED05A7 mov eax, dword ptr fs:[00000030h] 3_2_02ED05A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED05A7 mov eax, dword ptr fs:[00000030h] 3_2_02ED05A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E745B1 mov eax, dword ptr fs:[00000030h] 3_2_02E745B1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E745B1 mov eax, dword ptr fs:[00000030h] 3_2_02E745B1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E84588 mov eax, dword ptr fs:[00000030h] 3_2_02E84588
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E52582 mov eax, dword ptr fs:[00000030h] 3_2_02E52582
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E52582 mov ecx, dword ptr fs:[00000030h] 3_2_02E52582
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8E59C mov eax, dword ptr fs:[00000030h] 3_2_02E8E59C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8656A mov eax, dword ptr fs:[00000030h] 3_2_02E8656A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8656A mov eax, dword ptr fs:[00000030h] 3_2_02E8656A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8656A mov eax, dword ptr fs:[00000030h] 3_2_02E8656A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E58550 mov eax, dword ptr fs:[00000030h] 3_2_02E58550
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E58550 mov eax, dword ptr fs:[00000030h] 3_2_02E58550
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60535 mov eax, dword ptr fs:[00000030h] 3_2_02E60535
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60535 mov eax, dword ptr fs:[00000030h] 3_2_02E60535
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60535 mov eax, dword ptr fs:[00000030h] 3_2_02E60535
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60535 mov eax, dword ptr fs:[00000030h] 3_2_02E60535
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60535 mov eax, dword ptr fs:[00000030h] 3_2_02E60535
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60535 mov eax, dword ptr fs:[00000030h] 3_2_02E60535
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7E53E mov eax, dword ptr fs:[00000030h] 3_2_02E7E53E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7E53E mov eax, dword ptr fs:[00000030h] 3_2_02E7E53E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7E53E mov eax, dword ptr fs:[00000030h] 3_2_02E7E53E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7E53E mov eax, dword ptr fs:[00000030h] 3_2_02E7E53E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7E53E mov eax, dword ptr fs:[00000030h] 3_2_02E7E53E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE6500 mov eax, dword ptr fs:[00000030h] 3_2_02EE6500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F24500 mov eax, dword ptr fs:[00000030h] 3_2_02F24500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F24500 mov eax, dword ptr fs:[00000030h] 3_2_02F24500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F24500 mov eax, dword ptr fs:[00000030h] 3_2_02F24500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F24500 mov eax, dword ptr fs:[00000030h] 3_2_02F24500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F24500 mov eax, dword ptr fs:[00000030h] 3_2_02F24500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F24500 mov eax, dword ptr fs:[00000030h] 3_2_02F24500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F24500 mov eax, dword ptr fs:[00000030h] 3_2_02F24500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8AAEE mov eax, dword ptr fs:[00000030h] 3_2_02E8AAEE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8AAEE mov eax, dword ptr fs:[00000030h] 3_2_02E8AAEE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EA6ACC mov eax, dword ptr fs:[00000030h] 3_2_02EA6ACC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EA6ACC mov eax, dword ptr fs:[00000030h] 3_2_02EA6ACC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EA6ACC mov eax, dword ptr fs:[00000030h] 3_2_02EA6ACC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E50AD0 mov eax, dword ptr fs:[00000030h] 3_2_02E50AD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E84AD0 mov eax, dword ptr fs:[00000030h] 3_2_02E84AD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E84AD0 mov eax, dword ptr fs:[00000030h] 3_2_02E84AD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E58AA0 mov eax, dword ptr fs:[00000030h] 3_2_02E58AA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E58AA0 mov eax, dword ptr fs:[00000030h] 3_2_02E58AA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EA6AA4 mov eax, dword ptr fs:[00000030h] 3_2_02EA6AA4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5EA80 mov eax, dword ptr fs:[00000030h] 3_2_02E5EA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5EA80 mov eax, dword ptr fs:[00000030h] 3_2_02E5EA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5EA80 mov eax, dword ptr fs:[00000030h] 3_2_02E5EA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5EA80 mov eax, dword ptr fs:[00000030h] 3_2_02E5EA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5EA80 mov eax, dword ptr fs:[00000030h] 3_2_02E5EA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5EA80 mov eax, dword ptr fs:[00000030h] 3_2_02E5EA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5EA80 mov eax, dword ptr fs:[00000030h] 3_2_02E5EA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5EA80 mov eax, dword ptr fs:[00000030h] 3_2_02E5EA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5EA80 mov eax, dword ptr fs:[00000030h] 3_2_02E5EA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F24A80 mov eax, dword ptr fs:[00000030h] 3_2_02F24A80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E88A90 mov edx, dword ptr fs:[00000030h] 3_2_02E88A90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8CA6F mov eax, dword ptr fs:[00000030h] 3_2_02E8CA6F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8CA6F mov eax, dword ptr fs:[00000030h] 3_2_02E8CA6F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8CA6F mov eax, dword ptr fs:[00000030h] 3_2_02E8CA6F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFEA60 mov eax, dword ptr fs:[00000030h] 3_2_02EFEA60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECCA72 mov eax, dword ptr fs:[00000030h] 3_2_02ECCA72
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECCA72 mov eax, dword ptr fs:[00000030h] 3_2_02ECCA72
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E56A50 mov eax, dword ptr fs:[00000030h] 3_2_02E56A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E56A50 mov eax, dword ptr fs:[00000030h] 3_2_02E56A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E56A50 mov eax, dword ptr fs:[00000030h] 3_2_02E56A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E56A50 mov eax, dword ptr fs:[00000030h] 3_2_02E56A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E56A50 mov eax, dword ptr fs:[00000030h] 3_2_02E56A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E56A50 mov eax, dword ptr fs:[00000030h] 3_2_02E56A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E56A50 mov eax, dword ptr fs:[00000030h] 3_2_02E56A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60A5B mov eax, dword ptr fs:[00000030h] 3_2_02E60A5B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60A5B mov eax, dword ptr fs:[00000030h] 3_2_02E60A5B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7EA2E mov eax, dword ptr fs:[00000030h] 3_2_02E7EA2E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8CA24 mov eax, dword ptr fs:[00000030h] 3_2_02E8CA24
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8CA38 mov eax, dword ptr fs:[00000030h] 3_2_02E8CA38
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E74A35 mov eax, dword ptr fs:[00000030h] 3_2_02E74A35
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E74A35 mov eax, dword ptr fs:[00000030h] 3_2_02E74A35
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EDCA11 mov eax, dword ptr fs:[00000030h] 3_2_02EDCA11
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E58BF0 mov eax, dword ptr fs:[00000030h] 3_2_02E58BF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E58BF0 mov eax, dword ptr fs:[00000030h] 3_2_02E58BF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E58BF0 mov eax, dword ptr fs:[00000030h] 3_2_02E58BF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7EBFC mov eax, dword ptr fs:[00000030h] 3_2_02E7EBFC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EDCBF0 mov eax, dword ptr fs:[00000030h] 3_2_02EDCBF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E50BCD mov eax, dword ptr fs:[00000030h] 3_2_02E50BCD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E50BCD mov eax, dword ptr fs:[00000030h] 3_2_02E50BCD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E50BCD mov eax, dword ptr fs:[00000030h] 3_2_02E50BCD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E70BCB mov eax, dword ptr fs:[00000030h] 3_2_02E70BCB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E70BCB mov eax, dword ptr fs:[00000030h] 3_2_02E70BCB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E70BCB mov eax, dword ptr fs:[00000030h] 3_2_02E70BCB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFEBD0 mov eax, dword ptr fs:[00000030h] 3_2_02EFEBD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F04BB0 mov eax, dword ptr fs:[00000030h] 3_2_02F04BB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F04BB0 mov eax, dword ptr fs:[00000030h] 3_2_02F04BB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60BBE mov eax, dword ptr fs:[00000030h] 3_2_02E60BBE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E60BBE mov eax, dword ptr fs:[00000030h] 3_2_02E60BBE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E4CB7E mov eax, dword ptr fs:[00000030h] 3_2_02E4CB7E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F22B57 mov eax, dword ptr fs:[00000030h] 3_2_02F22B57
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F22B57 mov eax, dword ptr fs:[00000030h] 3_2_02F22B57
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F22B57 mov eax, dword ptr fs:[00000030h] 3_2_02F22B57
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F22B57 mov eax, dword ptr fs:[00000030h] 3_2_02F22B57
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EF8B42 mov eax, dword ptr fs:[00000030h] 3_2_02EF8B42
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE6B40 mov eax, dword ptr fs:[00000030h] 3_2_02EE6B40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE6B40 mov eax, dword ptr fs:[00000030h] 3_2_02EE6B40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F1AB40 mov eax, dword ptr fs:[00000030h] 3_2_02F1AB40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E48B50 mov eax, dword ptr fs:[00000030h] 3_2_02E48B50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F04B4B mov eax, dword ptr fs:[00000030h] 3_2_02F04B4B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F04B4B mov eax, dword ptr fs:[00000030h] 3_2_02F04B4B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EFEB50 mov eax, dword ptr fs:[00000030h] 3_2_02EFEB50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7EB20 mov eax, dword ptr fs:[00000030h] 3_2_02E7EB20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7EB20 mov eax, dword ptr fs:[00000030h] 3_2_02E7EB20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F18B28 mov eax, dword ptr fs:[00000030h] 3_2_02F18B28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F18B28 mov eax, dword ptr fs:[00000030h] 3_2_02F18B28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECEB1D mov eax, dword ptr fs:[00000030h] 3_2_02ECEB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECEB1D mov eax, dword ptr fs:[00000030h] 3_2_02ECEB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECEB1D mov eax, dword ptr fs:[00000030h] 3_2_02ECEB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECEB1D mov eax, dword ptr fs:[00000030h] 3_2_02ECEB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECEB1D mov eax, dword ptr fs:[00000030h] 3_2_02ECEB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECEB1D mov eax, dword ptr fs:[00000030h] 3_2_02ECEB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECEB1D mov eax, dword ptr fs:[00000030h] 3_2_02ECEB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECEB1D mov eax, dword ptr fs:[00000030h] 3_2_02ECEB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ECEB1D mov eax, dword ptr fs:[00000030h] 3_2_02ECEB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F24B00 mov eax, dword ptr fs:[00000030h] 3_2_02F24B00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8C8F9 mov eax, dword ptr fs:[00000030h] 3_2_02E8C8F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8C8F9 mov eax, dword ptr fs:[00000030h] 3_2_02E8C8F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F1A8E4 mov eax, dword ptr fs:[00000030h] 3_2_02F1A8E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E7E8C0 mov eax, dword ptr fs:[00000030h] 3_2_02E7E8C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F208C0 mov eax, dword ptr fs:[00000030h] 3_2_02F208C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E50887 mov eax, dword ptr fs:[00000030h] 3_2_02E50887
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EDC89D mov eax, dword ptr fs:[00000030h] 3_2_02EDC89D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE6870 mov eax, dword ptr fs:[00000030h] 3_2_02EE6870
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE6870 mov eax, dword ptr fs:[00000030h] 3_2_02EE6870
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EDE872 mov eax, dword ptr fs:[00000030h] 3_2_02EDE872
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EDE872 mov eax, dword ptr fs:[00000030h] 3_2_02EDE872
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E62840 mov ecx, dword ptr fs:[00000030h] 3_2_02E62840
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E54859 mov eax, dword ptr fs:[00000030h] 3_2_02E54859
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E54859 mov eax, dword ptr fs:[00000030h] 3_2_02E54859
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E80854 mov eax, dword ptr fs:[00000030h] 3_2_02E80854
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E72835 mov eax, dword ptr fs:[00000030h] 3_2_02E72835
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E72835 mov eax, dword ptr fs:[00000030h] 3_2_02E72835
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E72835 mov eax, dword ptr fs:[00000030h] 3_2_02E72835
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E72835 mov ecx, dword ptr fs:[00000030h] 3_2_02E72835
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E72835 mov eax, dword ptr fs:[00000030h] 3_2_02E72835
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E72835 mov eax, dword ptr fs:[00000030h] 3_2_02E72835
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EF483A mov eax, dword ptr fs:[00000030h] 3_2_02EF483A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EF483A mov eax, dword ptr fs:[00000030h] 3_2_02EF483A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E8A830 mov eax, dword ptr fs:[00000030h] 3_2_02E8A830
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EDC810 mov eax, dword ptr fs:[00000030h] 3_2_02EDC810
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EDE9E0 mov eax, dword ptr fs:[00000030h] 3_2_02EDE9E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E829F9 mov eax, dword ptr fs:[00000030h] 3_2_02E829F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E829F9 mov eax, dword ptr fs:[00000030h] 3_2_02E829F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02F1A9D3 mov eax, dword ptr fs:[00000030h] 3_2_02F1A9D3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EE69C0 mov eax, dword ptr fs:[00000030h] 3_2_02EE69C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5A9D0 mov eax, dword ptr fs:[00000030h] 3_2_02E5A9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5A9D0 mov eax, dword ptr fs:[00000030h] 3_2_02E5A9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5A9D0 mov eax, dword ptr fs:[00000030h] 3_2_02E5A9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5A9D0 mov eax, dword ptr fs:[00000030h] 3_2_02E5A9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5A9D0 mov eax, dword ptr fs:[00000030h] 3_2_02E5A9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E5A9D0 mov eax, dword ptr fs:[00000030h] 3_2_02E5A9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E849D0 mov eax, dword ptr fs:[00000030h] 3_2_02E849D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E629A0 mov eax, dword ptr fs:[00000030h] 3_2_02E629A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E629A0 mov eax, dword ptr fs:[00000030h] 3_2_02E629A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E629A0 mov eax, dword ptr fs:[00000030h] 3_2_02E629A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E629A0 mov eax, dword ptr fs:[00000030h] 3_2_02E629A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E629A0 mov eax, dword ptr fs:[00000030h] 3_2_02E629A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E629A0 mov eax, dword ptr fs:[00000030h] 3_2_02E629A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E629A0 mov eax, dword ptr fs:[00000030h] 3_2_02E629A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E629A0 mov eax, dword ptr fs:[00000030h] 3_2_02E629A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E629A0 mov eax, dword ptr fs:[00000030h] 3_2_02E629A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E629A0 mov eax, dword ptr fs:[00000030h] 3_2_02E629A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E629A0 mov eax, dword ptr fs:[00000030h] 3_2_02E629A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E629A0 mov eax, dword ptr fs:[00000030h] 3_2_02E629A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E629A0 mov eax, dword ptr fs:[00000030h] 3_2_02E629A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E509AD mov eax, dword ptr fs:[00000030h] 3_2_02E509AD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E509AD mov eax, dword ptr fs:[00000030h] 3_2_02E509AD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED89B3 mov esi, dword ptr fs:[00000030h] 3_2_02ED89B3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED89B3 mov eax, dword ptr fs:[00000030h] 3_2_02ED89B3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02ED89B3 mov eax, dword ptr fs:[00000030h] 3_2_02ED89B3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E76962 mov eax, dword ptr fs:[00000030h] 3_2_02E76962
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E76962 mov eax, dword ptr fs:[00000030h] 3_2_02E76962
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E76962 mov eax, dword ptr fs:[00000030h] 3_2_02E76962
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E9096E mov eax, dword ptr fs:[00000030h] 3_2_02E9096E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E9096E mov edx, dword ptr fs:[00000030h] 3_2_02E9096E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02E9096E mov eax, dword ptr fs:[00000030h] 3_2_02E9096E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_02EDC97C mov eax, dword ptr fs:[00000030h] 3_2_02EDC97C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_004468DC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_004468DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_0044838B _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_0044838B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Memory written: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Code function: 3_2_00447EBF GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 3_2_00447EBF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.7.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 3.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.2328494578.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 3.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.2328494578.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1501379 Sample: SecuriteInfo.com.Win32.Cryp... Startdate: 29/08/2024 Architecture: WINDOWS Score: 88 17 Malicious sample detected (through community Yara rule) 2->17 19 Multi AV Scanner detection for submitted file 2->19 21 Yara detected FormBook 2->21 23 4 other signatures 2->23 7 SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe 3 2->7         started        process3 file4 15 SecuriteInfo.com.W...13380.29830.exe.log, ASCII 7->15 dropped 25 Injects a PE file into a foreign processes 7->25 11 SecuriteInfo.com.Win32.CrypterX-gen.13380.29830.exe 7->11         started        signatures5 process6 process7 13 WerFault.exe 19 16 11->13         started       
⊘No contacted IP infos