Windows Analysis Report
ungziped_file.exe

Overview

General Information

Sample name: ungziped_file.exe
Analysis ID: 1527841
MD5: 8a0c4eed07d28836f39cf33bc6640940
SHA1: 281603fb0f6c50b97db2b6835762c7f5c4c6a94f
SHA256: f7a37ab3f4c3f7e67fc347335869a9616f6658f3a45465697a58585ddb7e7caf
Tags: exeuser-adrian__luca
Infos:

Detection

FormBook
Score: 88
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
AI detected suspicious sample
Injects a PE file into a foreign processes
Machine Learning detection for sample
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: ungziped_file.exe ReversingLabs: Detection: 31%
Source: ungziped_file.exe Virustotal: Detection: 33% Perma Link
Yara detected FormBook
Source: Yara match File source: 10.2.ungziped_file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.ungziped_file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.1639030776.0000000001940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1637721060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: ungziped_file.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: ungziped_file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: ungziped_file.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: Ydzd.pdb source: ungziped_file.exe
Source: Binary string: wntdll.pdbUGP source: ungziped_file.exe, 0000000A.00000002.1638245421.00000000015F0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: ungziped_file.exe, ungziped_file.exe, 0000000A.00000002.1638245421.00000000015F0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: Ydzd.pdbSHA256I source: ungziped_file.exe

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 10.2.ungziped_file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.ungziped_file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.1639030776.0000000001940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1637721060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 10.2.ungziped_file.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 10.2.ungziped_file.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.1639030776.0000000001940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.1637721060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Contains functionality to call native functions
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0042C233 NtClose, 10_2_0042C233
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662DF0 NtQuerySystemInformation,LdrInitializeThunk, 10_2_01662DF0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662C70 NtFreeVirtualMemory,LdrInitializeThunk, 10_2_01662C70
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016635C0 NtCreateMutant,LdrInitializeThunk, 10_2_016635C0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01664340 NtSetContextThread, 10_2_01664340
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01664650 NtSuspendThread, 10_2_01664650
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662B60 NtClose, 10_2_01662B60
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662BE0 NtQueryValueKey, 10_2_01662BE0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662BF0 NtAllocateVirtualMemory, 10_2_01662BF0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662BA0 NtEnumerateValueKey, 10_2_01662BA0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662B80 NtQueryInformationFile, 10_2_01662B80
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662AF0 NtWriteFile, 10_2_01662AF0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662AD0 NtReadFile, 10_2_01662AD0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662AB0 NtWaitForSingleObject, 10_2_01662AB0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662D30 NtUnmapViewOfSection, 10_2_01662D30
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662D00 NtSetInformationFile, 10_2_01662D00
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662D10 NtMapViewOfSection, 10_2_01662D10
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662DD0 NtDelayExecution, 10_2_01662DD0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662DB0 NtEnumerateKey, 10_2_01662DB0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662C60 NtCreateKey, 10_2_01662C60
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662C00 NtQueryInformationProcess, 10_2_01662C00
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662CF0 NtOpenProcess, 10_2_01662CF0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662CC0 NtQueryVirtualMemory, 10_2_01662CC0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662CA0 NtQueryInformationToken, 10_2_01662CA0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662F60 NtCreateProcessEx, 10_2_01662F60
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662F30 NtCreateSection, 10_2_01662F30
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662FE0 NtCreateFile, 10_2_01662FE0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662FA0 NtQuerySection, 10_2_01662FA0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662FB0 NtResumeThread, 10_2_01662FB0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662F90 NtProtectVirtualMemory, 10_2_01662F90
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662E30 NtWriteVirtualMemory, 10_2_01662E30
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662EE0 NtQueueApcThread, 10_2_01662EE0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662EA0 NtAdjustPrivilegesToken, 10_2_01662EA0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662E80 NtReadVirtualMemory, 10_2_01662E80
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01663010 NtOpenDirectoryObject, 10_2_01663010
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01663090 NtSetValueKey, 10_2_01663090
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016639B0 NtGetContextThread, 10_2_016639B0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01663D70 NtOpenThread, 10_2_01663D70
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01663D10 NtOpenProcessToken, 10_2_01663D10
Detected potential crypto function
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 0_2_01B0D55C 0_2_01B0D55C
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 0_2_05916A48 0_2_05916A48
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 0_2_05910006 0_2_05910006
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 0_2_05910040 0_2_05910040
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 0_2_05916A38 0_2_05916A38
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 0_2_05A09838 0_2_05A09838
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 0_2_05A09848 0_2_05A09848
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 0_2_07DB8718 0_2_07DB8718
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 0_2_07DB6E39 0_2_07DB6E39
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 0_2_07DB47B0 0_2_07DB47B0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 0_2_07DB5598 0_2_07DB5598
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 0_2_07DB2CC0 0_2_07DB2CC0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 0_2_07DB514F 0_2_07DB514F
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 0_2_07DB5160 0_2_07DB5160
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 0_2_07DB3108 0_2_07DB3108
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 0_2_07DB0007 0_2_07DB0007
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0042E833 10_2_0042E833
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_00403150 10_2_00403150
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_00401220 10_2_00401220
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0040FB63 10_2_0040FB63
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_00416443 10_2_00416443
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_004024C5 10_2_004024C5
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_004024D0 10_2_004024D0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_00401D76 10_2_00401D76
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_00401D80 10_2_00401D80
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0040FD83 10_2_0040FD83
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0040DE03 10_2_0040DE03
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_00402680 10_2_00402680
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B8158 10_2_016B8158
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01620100 10_2_01620100
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CA118 10_2_016CA118
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016E81CC 10_2_016E81CC
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F01AA 10_2_016F01AA
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016E41A2 10_2_016E41A2
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C2000 10_2_016C2000
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016EA352 10_2_016EA352
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F03E6 10_2_016F03E6
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0163E3F0 10_2_0163E3F0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D0274 10_2_016D0274
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B02C0 10_2_016B02C0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630535 10_2_01630535
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F0591 10_2_016F0591
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016E2446 10_2_016E2446
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D4420 10_2_016D4420
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016DE4F6 10_2_016DE4F6
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630770 10_2_01630770
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01654750 10_2_01654750
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162C7C0 10_2_0162C7C0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164C6E0 10_2_0164C6E0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01646962 10_2_01646962
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016329A0 10_2_016329A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016FA9A6 10_2_016FA9A6
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0163A840 10_2_0163A840
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01632840 10_2_01632840
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165E8F0 10_2_0165E8F0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016168B8 10_2_016168B8
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016EAB40 10_2_016EAB40
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016E6BD7 10_2_016E6BD7
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162EA80 10_2_0162EA80
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0163AD00 10_2_0163AD00
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CCD1F 10_2_016CCD1F
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162ADE0 10_2_0162ADE0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01648DBF 10_2_01648DBF
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630C00 10_2_01630C00
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01620CF2 10_2_01620CF2
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D0CB5 10_2_016D0CB5
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A4F40 10_2_016A4F40
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01672F28 10_2_01672F28
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01650F30 10_2_01650F30
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D2F30 10_2_016D2F30
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0163CFE0 10_2_0163CFE0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01622FC8 10_2_01622FC8
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016AEFA0 10_2_016AEFA0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630E59 10_2_01630E59
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016EEE26 10_2_016EEE26
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016EEEDB 10_2_016EEEDB
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01642E90 10_2_01642E90
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016ECE93 10_2_016ECE93
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016FB16B 10_2_016FB16B
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0166516C 10_2_0166516C
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161F172 10_2_0161F172
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0163B1B0 10_2_0163B1B0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016E70E9 10_2_016E70E9
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016EF0E0 10_2_016EF0E0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016DF0CC 10_2_016DF0CC
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016370C0 10_2_016370C0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161D34C 10_2_0161D34C
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016E132D 10_2_016E132D
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0167739A 10_2_0167739A
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D12ED 10_2_016D12ED
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164B2C0 10_2_0164B2C0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016352A0 10_2_016352A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016E7571 10_2_016E7571
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CD5B0 10_2_016CD5B0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01621460 10_2_01621460
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016EF43F 10_2_016EF43F
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016EF7B0 10_2_016EF7B0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01675630 10_2_01675630
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016E16CC 10_2_016E16CC
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01639950 10_2_01639950
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164B950 10_2_0164B950
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C5910 10_2_016C5910
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169D800 10_2_0169D800
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016338E0 10_2_016338E0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016EFB76 10_2_016EFB76
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A5BF0 10_2_016A5BF0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0166DBF9 10_2_0166DBF9
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164FB80 10_2_0164FB80
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A3A6C 10_2_016A3A6C
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016EFA49 10_2_016EFA49
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016E7A46 10_2_016E7A46
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016DDAC6 10_2_016DDAC6
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CDAAC 10_2_016CDAAC
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01675AA0 10_2_01675AA0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D1AA3 10_2_016D1AA3
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016E7D73 10_2_016E7D73
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01633D40 10_2_01633D40
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016E1D5A 10_2_016E1D5A
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164FDC0 10_2_0164FDC0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A9C32 10_2_016A9C32
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016EFCF2 10_2_016EFCF2
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016EFF09 10_2_016EFF09
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016EFFB1 10_2_016EFFB1
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01631F92 10_2_01631F92
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01639EB0 10_2_01639EB0
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: String function: 01677E54 appears 111 times
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: String function: 016AF290 appears 105 times
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: String function: 01665130 appears 58 times
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: String function: 0161B970 appears 277 times
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: String function: 0169EA12 appears 86 times
Sample file is different than original file name gathered from version info
Source: ungziped_file.exe, 00000000.00000002.1278217632.000000000171E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs ungziped_file.exe
Source: ungziped_file.exe, 00000000.00000002.1282796656.0000000004429000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs ungziped_file.exe
Source: ungziped_file.exe, 00000000.00000002.1286006499.0000000007CE0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs ungziped_file.exe
Source: ungziped_file.exe, 00000000.00000002.1282796656.000000000464D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs ungziped_file.exe
Source: ungziped_file.exe, 0000000A.00000002.1638245421.000000000171D000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs ungziped_file.exe
Source: ungziped_file.exe Binary or memory string: OriginalFilenameYdzd.exe8 vs ungziped_file.exe
Uses 32bit PE files
Source: ungziped_file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 10.2.ungziped_file.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 10.2.ungziped_file.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.1639030776.0000000001940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.1637721060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: ungziped_file.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, vS9xfwLlbD2jjgGjAp.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, vS9xfwLlbD2jjgGjAp.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, vS9xfwLlbD2jjgGjAp.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, iTwxhOGrV12vliSbja.cs Security API names: _0020.SetAccessControl
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, iTwxhOGrV12vliSbja.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, iTwxhOGrV12vliSbja.cs Security API names: _0020.AddAccessRule
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, iTwxhOGrV12vliSbja.cs Security API names: _0020.SetAccessControl
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, iTwxhOGrV12vliSbja.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, iTwxhOGrV12vliSbja.cs Security API names: _0020.AddAccessRule
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, iTwxhOGrV12vliSbja.cs Security API names: _0020.SetAccessControl
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, iTwxhOGrV12vliSbja.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, iTwxhOGrV12vliSbja.cs Security API names: _0020.AddAccessRule
Source: classification engine Classification label: mal88.troj.evad.winEXE@3/1@0/0
Source: C:\Users\user\Desktop\ungziped_file.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ungziped_file.exe.log Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Mutant created: NULL
Source: ungziped_file.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: ungziped_file.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\ungziped_file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: ungziped_file.exe ReversingLabs: Detection: 31%
Source: ungziped_file.exe Virustotal: Detection: 33%
Source: unknown Process created: C:\Users\user\Desktop\ungziped_file.exe "C:\Users\user\Desktop\ungziped_file.exe"
Source: C:\Users\user\Desktop\ungziped_file.exe Process created: C:\Users\user\Desktop\ungziped_file.exe "C:\Users\user\Desktop\ungziped_file.exe"
Source: C:\Users\user\Desktop\ungziped_file.exe Process created: C:\Users\user\Desktop\ungziped_file.exe "C:\Users\user\Desktop\ungziped_file.exe" Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: ungziped_file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: ungziped_file.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: ungziped_file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: Ydzd.pdb source: ungziped_file.exe
Source: Binary string: wntdll.pdbUGP source: ungziped_file.exe, 0000000A.00000002.1638245421.00000000015F0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: ungziped_file.exe, ungziped_file.exe, 0000000A.00000002.1638245421.00000000015F0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: Ydzd.pdbSHA256I source: ungziped_file.exe

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: ungziped_file.exe, Form1.cs .Net Code: InitializeComponent contains xor as well as GetObject
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, iTwxhOGrV12vliSbja.cs .Net Code: C3KEgfy1Ry System.Reflection.Assembly.Load(byte[])
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, iTwxhOGrV12vliSbja.cs .Net Code: C3KEgfy1Ry System.Reflection.Assembly.Load(byte[])
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, iTwxhOGrV12vliSbja.cs .Net Code: C3KEgfy1Ry System.Reflection.Assembly.Load(byte[])
Source: 0.2.ungziped_file.exe.5fc0000.3.raw.unpack, RZ.cs .Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.ungziped_file.exe.345490c.0.raw.unpack, RZ.cs .Net Code: System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 0_2_01B0F533 push esp; iretd 0_2_01B0F539
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 0_2_01B0F508 pushfd ; iretd 0_2_01B0F531
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 0_2_05919FB3 push eax; mov dword ptr [esp], edx 0_2_05919F54
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 0_2_05919F40 push eax; mov dword ptr [esp], edx 0_2_05919F54
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 0_2_07DB4F20 pushfd ; retf 0_2_07DB4F2D
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0041184E push 5C489864h; ret 10_2_00411868
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_004020E5 push esi; iretd 10_2_00402113
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_00416A58 push edi; retf 10_2_00416A5B
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0040D2BC push ebp; iretd 10_2_0040D2D7
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_00401B3D push ebp; ret 10_2_00401B3E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_004033D0 push eax; ret 10_2_004033D2
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0041E38B push ss; ret 10_2_0041E392
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_004144F3 push ecx; retf 10_2_004144F4
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0041E64F push edi; ret 10_2_0041E650
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_00411743 push ebx; retf 10_2_00411758
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0041E70B push esp; retf 10_2_0041E70C
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_00422FD9 push edx; iretd 10_2_00422FE0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016209AD push ecx; mov dword ptr [esp], ecx 10_2_016209B6
Source: ungziped_file.exe Static PE information: section name: .text entropy: 7.986334045340147
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, a9jkVSSADUTFaXjN3p.cs High entropy of concatenated method names: 'm1Y6IbKrQm', 'URp64o6RNP', 'VsK6oy2AUw', 'iU261DQGxQ', 'nw46GLA0bF', 'fgdoUwyC2A', 'BqHoB8UWeG', 'g3foJshkbg', 'HuRokQUI4F', 'GJAotgdHbf'
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, oaBqeZ4YcuaGJvxvDM.cs High entropy of concatenated method names: 'Dispose', 'l5XatLR88N', 'dMXmXCIN6a', 'CLcPPivIfK', 'kK8aDtHMgi', 'N6WaznF4Fd', 'ProcessDialogKey', 'yt3m5jIYZl', 'CA4mahhQ8G', 'iJqmmYxvMc'
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, NlPP4AaOy0Lv7FhAIjp.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'sLCxNly3uL', 'dK9xWw43tk', 'fKtxr8x5cj', 'vdpxFSbIrM', 'uK2xULTvSH', 'dtYxBu1OF9', 'rAaxJyGemM'
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, vS9xfwLlbD2jjgGjAp.cs High entropy of concatenated method names: 'LxA4NIiiXO', 'qO94WZodkJ', 'XcL4rhbhjU', 'e2m4FIv37g', 'NnZ4Ug5xo7', 'rHx4BLBR6L', 'oLm4JiYgRr', 'IWa4kX0nwo', 'rBM4t2O8Jq', 'UAo4DfgHbg'
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, IjIYZltTA4hhQ8G6Jq.cs High entropy of concatenated method names: 'IA7nSJAdon', 'NffnXemu11', 'xgjnCSlICT', 'xYUn3AI9BA', 'VStnN1Ycms', 'IY7nRJZNbZ', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, VNyRXcHmATYaTdIJS8.cs High entropy of concatenated method names: 'HiRAL24OuW', 'IOBAVUUuYC', 'ic6ASwy2so', 'HxIAX6CVlY', 'jehA3bOg5i', 'suHARZODYI', 'XhJA7dl19M', 'auiAyIaOCt', 'T8NAd5InnI', 'eGjA2lof1B'
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, rvLRV9uoqPItNf4Bq6.cs High entropy of concatenated method names: 'GLS1QJYRda', 'YNY1ljwgqq', 'gYJ1gYQK35', 'asI1ZCG5If', 'RrH1PKie3Y', 'd501sakhAt', 'ycS1TGf0fv', 'BCc1Ln0Ok5', 'rBN1VRBqjr', 'UlZ1jHsOEO'
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, u2HNfo7CRPPmHC5IS1.cs High entropy of concatenated method names: 'wPQ1cFU5tY', 'KBr1qSdNDl', 'fDs16WcNnG', 'rJu6DDKXKp', 'XQ76zMJ5w4', 'Sxm15qrl8R', 'yna1aQXtXs', 'JFy1mkQaA9', 'SA41OlmHqx', 'HBX1E855A5'
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, NmDeEEa5QUS3Ll4S9vV.cs High entropy of concatenated method names: 'WVTwQs8f06', 'xJRwlGOkPQ', 'qXmwgVjNWs', 'ykfwZaqr6A', 'UWKwPDXqC2', 'sVFwswfs3l', 'U07wToSFG3', 'yUGwLgH0LF', 'qHAwVvihNu', 'qmLwjhoZdF'
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, iTwxhOGrV12vliSbja.cs High entropy of concatenated method names: 'EnIOI6icoM', 'WThOcdYVrl', 'mBrO4yvbIl', 'GPXOqpWpE6', 'T57OojZIVZ', 'Y55O61KG2G', 'hgsO1jH45B', 'TGCOGtOtkS', 'BVfO9ols4J', 'uYsOYphNgv'
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, LkHSWTFSlOv9G4IsSy.cs High entropy of concatenated method names: 'nYSbYiCCm6', 'b3Ube5DR4C', 'ToString', 'RYDbcsbpHl', 'FI3b4ZRyug', 'ItFbqihV7Z', 'u7QboCKVLK', 'YHob6td0k4', 'QRvb1sCNHO', 'MtwbGA3kBk'
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, Rwnfb4z06w9bFlhF4U.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'x4dwAp29Gg', 'dVPwiHOYkQ', 'sGxwfkUnQs', 'UxiwbPZuGn', 'Vndwn2Hl0q', 'Sb8wwUyK5V', 'zqYwxv6oPD'
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, MXqOyyj9sSU5L62TT2.cs High entropy of concatenated method names: 'z1MoP0C2CY', 'iQqoTdStO6', 'PZUqC07v1E', 'z0Zq3N0AgG', 'iLqqRIvdEt', 'MuFqMomfjy', 'sNBq7tVCyN', 'GYlqyWHjoU', 'm8lqusMsvE', 'I9Vqd1xDcj'
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, mxvMchDw0pf1PhHkRj.cs High entropy of concatenated method names: 'NVawaArrnd', 'EVGwOb762v', 'qMOwESfhYa', 'VUZwcGeHp4', 'P99w4MEmgC', 'Qs9wo3YfHy', 'oAlw6Wpy8K', 'lZ4nJhhFnS', 'Opfnkkybiu', 'loBntqkWK3'
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, el7VsZmLgZw5wascoJ.cs High entropy of concatenated method names: 'aVsgw14OF', 'V0SZuMwaN', 'h1Msy1xsy', 'zE1TwppDf', 'iQpVKYvX9', 'QKfj4SW3w', 'lL96n7Hgb6y1C1K3sp', 'gIKmpqliBLwq2eRrL7', 'Q9YnncRNL', 'D8ixKjy8h'
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, P8tHMgkiu6WnF4Fdlt.cs High entropy of concatenated method names: 'Ff1ncs56uR', 'gRTn4TJpqu', 'qRanqhhEXk', 'IfOnoEugKL', 'dVJn6E2jE7', 'JuRn11CEiO', 'VetnG7cO3c', 'B0jn966Eci', 'lyknYcO2A3', 'QCineYmDrB'
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, OnFYhxVZZ3W3Kf7UNf.cs High entropy of concatenated method names: 'aVAqZLiTSB', 'YcgqsInPRE', 'hudqLYpfRj', 'MlqqViSahx', 'SKRqiQH4HI', 'cmyqfaguHO', 'Ai6qbB4ApB', 'c2Oqnf5R17', 'kFBqwYvqpU', 'JWsqxWFw8u'
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, fYcq1WEa9EkpaYhIcX.cs High entropy of concatenated method names: 'v40a1S9xfw', 'ybDaG2jjgG', 'sZZaY3W3Kf', 'KUNaefuXqO', 'j2TaiT259j', 'XVSafADUTF', 'B4rRNhrkdM57X0dkwp', 'qj4GaAtl1AUjmbrbln', 'D7WaaU7bIm', 'QZ7aOTjR7q'
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, XvtBylrffYkBwSxAA9.cs High entropy of concatenated method names: 'ToString', 'WtEf2Xsjsk', 'dlKfX0iN9h', 'DfKfCUSZ4u', 'kbyf3DjHaI', 'ICUfRP0evn', 'Eu7fM1I5Sf', 'qGDf7t18cP', 'fhLfyTLmbx', 'D61fubfCVe'
Source: 0.2.ungziped_file.exe.7ce0000.4.raw.unpack, VkrSMFNK0AxJ33BeE1.cs High entropy of concatenated method names: 'B0Lid4M3xc', 'L4viKGNefu', 'vMjiNnPEWd', 'EcEiWl9PBS', 'vWSiXLNS9n', 'uM7iCNY5CZ', 's4ri38LOiE', 'hm8iRbKE5v', 'PgiiMODYyv', 'KDhi7em0xF'
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, a9jkVSSADUTFaXjN3p.cs High entropy of concatenated method names: 'm1Y6IbKrQm', 'URp64o6RNP', 'VsK6oy2AUw', 'iU261DQGxQ', 'nw46GLA0bF', 'fgdoUwyC2A', 'BqHoB8UWeG', 'g3foJshkbg', 'HuRokQUI4F', 'GJAotgdHbf'
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, oaBqeZ4YcuaGJvxvDM.cs High entropy of concatenated method names: 'Dispose', 'l5XatLR88N', 'dMXmXCIN6a', 'CLcPPivIfK', 'kK8aDtHMgi', 'N6WaznF4Fd', 'ProcessDialogKey', 'yt3m5jIYZl', 'CA4mahhQ8G', 'iJqmmYxvMc'
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, NlPP4AaOy0Lv7FhAIjp.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'sLCxNly3uL', 'dK9xWw43tk', 'fKtxr8x5cj', 'vdpxFSbIrM', 'uK2xULTvSH', 'dtYxBu1OF9', 'rAaxJyGemM'
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, vS9xfwLlbD2jjgGjAp.cs High entropy of concatenated method names: 'LxA4NIiiXO', 'qO94WZodkJ', 'XcL4rhbhjU', 'e2m4FIv37g', 'NnZ4Ug5xo7', 'rHx4BLBR6L', 'oLm4JiYgRr', 'IWa4kX0nwo', 'rBM4t2O8Jq', 'UAo4DfgHbg'
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, IjIYZltTA4hhQ8G6Jq.cs High entropy of concatenated method names: 'IA7nSJAdon', 'NffnXemu11', 'xgjnCSlICT', 'xYUn3AI9BA', 'VStnN1Ycms', 'IY7nRJZNbZ', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, VNyRXcHmATYaTdIJS8.cs High entropy of concatenated method names: 'HiRAL24OuW', 'IOBAVUUuYC', 'ic6ASwy2so', 'HxIAX6CVlY', 'jehA3bOg5i', 'suHARZODYI', 'XhJA7dl19M', 'auiAyIaOCt', 'T8NAd5InnI', 'eGjA2lof1B'
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, rvLRV9uoqPItNf4Bq6.cs High entropy of concatenated method names: 'GLS1QJYRda', 'YNY1ljwgqq', 'gYJ1gYQK35', 'asI1ZCG5If', 'RrH1PKie3Y', 'd501sakhAt', 'ycS1TGf0fv', 'BCc1Ln0Ok5', 'rBN1VRBqjr', 'UlZ1jHsOEO'
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, u2HNfo7CRPPmHC5IS1.cs High entropy of concatenated method names: 'wPQ1cFU5tY', 'KBr1qSdNDl', 'fDs16WcNnG', 'rJu6DDKXKp', 'XQ76zMJ5w4', 'Sxm15qrl8R', 'yna1aQXtXs', 'JFy1mkQaA9', 'SA41OlmHqx', 'HBX1E855A5'
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, NmDeEEa5QUS3Ll4S9vV.cs High entropy of concatenated method names: 'WVTwQs8f06', 'xJRwlGOkPQ', 'qXmwgVjNWs', 'ykfwZaqr6A', 'UWKwPDXqC2', 'sVFwswfs3l', 'U07wToSFG3', 'yUGwLgH0LF', 'qHAwVvihNu', 'qmLwjhoZdF'
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, iTwxhOGrV12vliSbja.cs High entropy of concatenated method names: 'EnIOI6icoM', 'WThOcdYVrl', 'mBrO4yvbIl', 'GPXOqpWpE6', 'T57OojZIVZ', 'Y55O61KG2G', 'hgsO1jH45B', 'TGCOGtOtkS', 'BVfO9ols4J', 'uYsOYphNgv'
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, LkHSWTFSlOv9G4IsSy.cs High entropy of concatenated method names: 'nYSbYiCCm6', 'b3Ube5DR4C', 'ToString', 'RYDbcsbpHl', 'FI3b4ZRyug', 'ItFbqihV7Z', 'u7QboCKVLK', 'YHob6td0k4', 'QRvb1sCNHO', 'MtwbGA3kBk'
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, Rwnfb4z06w9bFlhF4U.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'x4dwAp29Gg', 'dVPwiHOYkQ', 'sGxwfkUnQs', 'UxiwbPZuGn', 'Vndwn2Hl0q', 'Sb8wwUyK5V', 'zqYwxv6oPD'
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, MXqOyyj9sSU5L62TT2.cs High entropy of concatenated method names: 'z1MoP0C2CY', 'iQqoTdStO6', 'PZUqC07v1E', 'z0Zq3N0AgG', 'iLqqRIvdEt', 'MuFqMomfjy', 'sNBq7tVCyN', 'GYlqyWHjoU', 'm8lqusMsvE', 'I9Vqd1xDcj'
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, mxvMchDw0pf1PhHkRj.cs High entropy of concatenated method names: 'NVawaArrnd', 'EVGwOb762v', 'qMOwESfhYa', 'VUZwcGeHp4', 'P99w4MEmgC', 'Qs9wo3YfHy', 'oAlw6Wpy8K', 'lZ4nJhhFnS', 'Opfnkkybiu', 'loBntqkWK3'
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, el7VsZmLgZw5wascoJ.cs High entropy of concatenated method names: 'aVsgw14OF', 'V0SZuMwaN', 'h1Msy1xsy', 'zE1TwppDf', 'iQpVKYvX9', 'QKfj4SW3w', 'lL96n7Hgb6y1C1K3sp', 'gIKmpqliBLwq2eRrL7', 'Q9YnncRNL', 'D8ixKjy8h'
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, P8tHMgkiu6WnF4Fdlt.cs High entropy of concatenated method names: 'Ff1ncs56uR', 'gRTn4TJpqu', 'qRanqhhEXk', 'IfOnoEugKL', 'dVJn6E2jE7', 'JuRn11CEiO', 'VetnG7cO3c', 'B0jn966Eci', 'lyknYcO2A3', 'QCineYmDrB'
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, OnFYhxVZZ3W3Kf7UNf.cs High entropy of concatenated method names: 'aVAqZLiTSB', 'YcgqsInPRE', 'hudqLYpfRj', 'MlqqViSahx', 'SKRqiQH4HI', 'cmyqfaguHO', 'Ai6qbB4ApB', 'c2Oqnf5R17', 'kFBqwYvqpU', 'JWsqxWFw8u'
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, fYcq1WEa9EkpaYhIcX.cs High entropy of concatenated method names: 'v40a1S9xfw', 'ybDaG2jjgG', 'sZZaY3W3Kf', 'KUNaefuXqO', 'j2TaiT259j', 'XVSafADUTF', 'B4rRNhrkdM57X0dkwp', 'qj4GaAtl1AUjmbrbln', 'D7WaaU7bIm', 'QZ7aOTjR7q'
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, XvtBylrffYkBwSxAA9.cs High entropy of concatenated method names: 'ToString', 'WtEf2Xsjsk', 'dlKfX0iN9h', 'DfKfCUSZ4u', 'kbyf3DjHaI', 'ICUfRP0evn', 'Eu7fM1I5Sf', 'qGDf7t18cP', 'fhLfyTLmbx', 'D61fubfCVe'
Source: 0.2.ungziped_file.exe.46e0228.2.raw.unpack, VkrSMFNK0AxJ33BeE1.cs High entropy of concatenated method names: 'B0Lid4M3xc', 'L4viKGNefu', 'vMjiNnPEWd', 'EcEiWl9PBS', 'vWSiXLNS9n', 'uM7iCNY5CZ', 's4ri38LOiE', 'hm8iRbKE5v', 'PgiiMODYyv', 'KDhi7em0xF'
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, a9jkVSSADUTFaXjN3p.cs High entropy of concatenated method names: 'm1Y6IbKrQm', 'URp64o6RNP', 'VsK6oy2AUw', 'iU261DQGxQ', 'nw46GLA0bF', 'fgdoUwyC2A', 'BqHoB8UWeG', 'g3foJshkbg', 'HuRokQUI4F', 'GJAotgdHbf'
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, oaBqeZ4YcuaGJvxvDM.cs High entropy of concatenated method names: 'Dispose', 'l5XatLR88N', 'dMXmXCIN6a', 'CLcPPivIfK', 'kK8aDtHMgi', 'N6WaznF4Fd', 'ProcessDialogKey', 'yt3m5jIYZl', 'CA4mahhQ8G', 'iJqmmYxvMc'
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, NlPP4AaOy0Lv7FhAIjp.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'sLCxNly3uL', 'dK9xWw43tk', 'fKtxr8x5cj', 'vdpxFSbIrM', 'uK2xULTvSH', 'dtYxBu1OF9', 'rAaxJyGemM'
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, vS9xfwLlbD2jjgGjAp.cs High entropy of concatenated method names: 'LxA4NIiiXO', 'qO94WZodkJ', 'XcL4rhbhjU', 'e2m4FIv37g', 'NnZ4Ug5xo7', 'rHx4BLBR6L', 'oLm4JiYgRr', 'IWa4kX0nwo', 'rBM4t2O8Jq', 'UAo4DfgHbg'
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, IjIYZltTA4hhQ8G6Jq.cs High entropy of concatenated method names: 'IA7nSJAdon', 'NffnXemu11', 'xgjnCSlICT', 'xYUn3AI9BA', 'VStnN1Ycms', 'IY7nRJZNbZ', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, VNyRXcHmATYaTdIJS8.cs High entropy of concatenated method names: 'HiRAL24OuW', 'IOBAVUUuYC', 'ic6ASwy2so', 'HxIAX6CVlY', 'jehA3bOg5i', 'suHARZODYI', 'XhJA7dl19M', 'auiAyIaOCt', 'T8NAd5InnI', 'eGjA2lof1B'
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, rvLRV9uoqPItNf4Bq6.cs High entropy of concatenated method names: 'GLS1QJYRda', 'YNY1ljwgqq', 'gYJ1gYQK35', 'asI1ZCG5If', 'RrH1PKie3Y', 'd501sakhAt', 'ycS1TGf0fv', 'BCc1Ln0Ok5', 'rBN1VRBqjr', 'UlZ1jHsOEO'
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, u2HNfo7CRPPmHC5IS1.cs High entropy of concatenated method names: 'wPQ1cFU5tY', 'KBr1qSdNDl', 'fDs16WcNnG', 'rJu6DDKXKp', 'XQ76zMJ5w4', 'Sxm15qrl8R', 'yna1aQXtXs', 'JFy1mkQaA9', 'SA41OlmHqx', 'HBX1E855A5'
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, NmDeEEa5QUS3Ll4S9vV.cs High entropy of concatenated method names: 'WVTwQs8f06', 'xJRwlGOkPQ', 'qXmwgVjNWs', 'ykfwZaqr6A', 'UWKwPDXqC2', 'sVFwswfs3l', 'U07wToSFG3', 'yUGwLgH0LF', 'qHAwVvihNu', 'qmLwjhoZdF'
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, iTwxhOGrV12vliSbja.cs High entropy of concatenated method names: 'EnIOI6icoM', 'WThOcdYVrl', 'mBrO4yvbIl', 'GPXOqpWpE6', 'T57OojZIVZ', 'Y55O61KG2G', 'hgsO1jH45B', 'TGCOGtOtkS', 'BVfO9ols4J', 'uYsOYphNgv'
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, LkHSWTFSlOv9G4IsSy.cs High entropy of concatenated method names: 'nYSbYiCCm6', 'b3Ube5DR4C', 'ToString', 'RYDbcsbpHl', 'FI3b4ZRyug', 'ItFbqihV7Z', 'u7QboCKVLK', 'YHob6td0k4', 'QRvb1sCNHO', 'MtwbGA3kBk'
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, Rwnfb4z06w9bFlhF4U.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'x4dwAp29Gg', 'dVPwiHOYkQ', 'sGxwfkUnQs', 'UxiwbPZuGn', 'Vndwn2Hl0q', 'Sb8wwUyK5V', 'zqYwxv6oPD'
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, MXqOyyj9sSU5L62TT2.cs High entropy of concatenated method names: 'z1MoP0C2CY', 'iQqoTdStO6', 'PZUqC07v1E', 'z0Zq3N0AgG', 'iLqqRIvdEt', 'MuFqMomfjy', 'sNBq7tVCyN', 'GYlqyWHjoU', 'm8lqusMsvE', 'I9Vqd1xDcj'
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, mxvMchDw0pf1PhHkRj.cs High entropy of concatenated method names: 'NVawaArrnd', 'EVGwOb762v', 'qMOwESfhYa', 'VUZwcGeHp4', 'P99w4MEmgC', 'Qs9wo3YfHy', 'oAlw6Wpy8K', 'lZ4nJhhFnS', 'Opfnkkybiu', 'loBntqkWK3'
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, el7VsZmLgZw5wascoJ.cs High entropy of concatenated method names: 'aVsgw14OF', 'V0SZuMwaN', 'h1Msy1xsy', 'zE1TwppDf', 'iQpVKYvX9', 'QKfj4SW3w', 'lL96n7Hgb6y1C1K3sp', 'gIKmpqliBLwq2eRrL7', 'Q9YnncRNL', 'D8ixKjy8h'
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, P8tHMgkiu6WnF4Fdlt.cs High entropy of concatenated method names: 'Ff1ncs56uR', 'gRTn4TJpqu', 'qRanqhhEXk', 'IfOnoEugKL', 'dVJn6E2jE7', 'JuRn11CEiO', 'VetnG7cO3c', 'B0jn966Eci', 'lyknYcO2A3', 'QCineYmDrB'
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, OnFYhxVZZ3W3Kf7UNf.cs High entropy of concatenated method names: 'aVAqZLiTSB', 'YcgqsInPRE', 'hudqLYpfRj', 'MlqqViSahx', 'SKRqiQH4HI', 'cmyqfaguHO', 'Ai6qbB4ApB', 'c2Oqnf5R17', 'kFBqwYvqpU', 'JWsqxWFw8u'
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, fYcq1WEa9EkpaYhIcX.cs High entropy of concatenated method names: 'v40a1S9xfw', 'ybDaG2jjgG', 'sZZaY3W3Kf', 'KUNaefuXqO', 'j2TaiT259j', 'XVSafADUTF', 'B4rRNhrkdM57X0dkwp', 'qj4GaAtl1AUjmbrbln', 'D7WaaU7bIm', 'QZ7aOTjR7q'
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, XvtBylrffYkBwSxAA9.cs High entropy of concatenated method names: 'ToString', 'WtEf2Xsjsk', 'dlKfX0iN9h', 'DfKfCUSZ4u', 'kbyf3DjHaI', 'ICUfRP0evn', 'Eu7fM1I5Sf', 'qGDf7t18cP', 'fhLfyTLmbx', 'D61fubfCVe'
Source: 0.2.ungziped_file.exe.4539f40.1.raw.unpack, VkrSMFNK0AxJ33BeE1.cs High entropy of concatenated method names: 'B0Lid4M3xc', 'L4viKGNefu', 'vMjiNnPEWd', 'EcEiWl9PBS', 'vWSiXLNS9n', 'uM7iCNY5CZ', 's4ri38LOiE', 'hm8iRbKE5v', 'PgiiMODYyv', 'KDhi7em0xF'
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: ungziped_file.exe PID: 5364, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\ungziped_file.exe Memory allocated: 1A10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Memory allocated: 3420000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Memory allocated: 1A10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Memory allocated: 8030000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Memory allocated: 9030000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Memory allocated: 91D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Memory allocated: A1D0000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0166096E rdtsc 10_2_0166096E
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\ungziped_file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\ungziped_file.exe API coverage: 0.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\ungziped_file.exe TID: 4300 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe TID: 7224 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\ungziped_file.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0166096E rdtsc 10_2_0166096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_004173F3 LdrLoadDll, 10_2_004173F3
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F4164 mov eax, dword ptr fs:[00000030h] 10_2_016F4164
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F4164 mov eax, dword ptr fs:[00000030h] 10_2_016F4164
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B4144 mov eax, dword ptr fs:[00000030h] 10_2_016B4144
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B4144 mov eax, dword ptr fs:[00000030h] 10_2_016B4144
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B4144 mov ecx, dword ptr fs:[00000030h] 10_2_016B4144
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B4144 mov eax, dword ptr fs:[00000030h] 10_2_016B4144
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B4144 mov eax, dword ptr fs:[00000030h] 10_2_016B4144
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B8158 mov eax, dword ptr fs:[00000030h] 10_2_016B8158
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01626154 mov eax, dword ptr fs:[00000030h] 10_2_01626154
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01626154 mov eax, dword ptr fs:[00000030h] 10_2_01626154
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161C156 mov eax, dword ptr fs:[00000030h] 10_2_0161C156
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01650124 mov eax, dword ptr fs:[00000030h] 10_2_01650124
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CE10E mov eax, dword ptr fs:[00000030h] 10_2_016CE10E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CE10E mov ecx, dword ptr fs:[00000030h] 10_2_016CE10E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CE10E mov eax, dword ptr fs:[00000030h] 10_2_016CE10E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CE10E mov eax, dword ptr fs:[00000030h] 10_2_016CE10E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CE10E mov ecx, dword ptr fs:[00000030h] 10_2_016CE10E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CE10E mov eax, dword ptr fs:[00000030h] 10_2_016CE10E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CE10E mov eax, dword ptr fs:[00000030h] 10_2_016CE10E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CE10E mov ecx, dword ptr fs:[00000030h] 10_2_016CE10E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CE10E mov eax, dword ptr fs:[00000030h] 10_2_016CE10E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CE10E mov ecx, dword ptr fs:[00000030h] 10_2_016CE10E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CA118 mov ecx, dword ptr fs:[00000030h] 10_2_016CA118
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CA118 mov eax, dword ptr fs:[00000030h] 10_2_016CA118
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CA118 mov eax, dword ptr fs:[00000030h] 10_2_016CA118
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CA118 mov eax, dword ptr fs:[00000030h] 10_2_016CA118
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016E0115 mov eax, dword ptr fs:[00000030h] 10_2_016E0115
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F61E5 mov eax, dword ptr fs:[00000030h] 10_2_016F61E5
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016501F8 mov eax, dword ptr fs:[00000030h] 10_2_016501F8
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016E61C3 mov eax, dword ptr fs:[00000030h] 10_2_016E61C3
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016E61C3 mov eax, dword ptr fs:[00000030h] 10_2_016E61C3
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169E1D0 mov eax, dword ptr fs:[00000030h] 10_2_0169E1D0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169E1D0 mov eax, dword ptr fs:[00000030h] 10_2_0169E1D0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169E1D0 mov ecx, dword ptr fs:[00000030h] 10_2_0169E1D0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169E1D0 mov eax, dword ptr fs:[00000030h] 10_2_0169E1D0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169E1D0 mov eax, dword ptr fs:[00000030h] 10_2_0169E1D0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01660185 mov eax, dword ptr fs:[00000030h] 10_2_01660185
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016DC188 mov eax, dword ptr fs:[00000030h] 10_2_016DC188
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016DC188 mov eax, dword ptr fs:[00000030h] 10_2_016DC188
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C4180 mov eax, dword ptr fs:[00000030h] 10_2_016C4180
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C4180 mov eax, dword ptr fs:[00000030h] 10_2_016C4180
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A019F mov eax, dword ptr fs:[00000030h] 10_2_016A019F
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A019F mov eax, dword ptr fs:[00000030h] 10_2_016A019F
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A019F mov eax, dword ptr fs:[00000030h] 10_2_016A019F
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A019F mov eax, dword ptr fs:[00000030h] 10_2_016A019F
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161A197 mov eax, dword ptr fs:[00000030h] 10_2_0161A197
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161A197 mov eax, dword ptr fs:[00000030h] 10_2_0161A197
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161A197 mov eax, dword ptr fs:[00000030h] 10_2_0161A197
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164C073 mov eax, dword ptr fs:[00000030h] 10_2_0164C073
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01622050 mov eax, dword ptr fs:[00000030h] 10_2_01622050
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A6050 mov eax, dword ptr fs:[00000030h] 10_2_016A6050
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161A020 mov eax, dword ptr fs:[00000030h] 10_2_0161A020
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161C020 mov eax, dword ptr fs:[00000030h] 10_2_0161C020
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B6030 mov eax, dword ptr fs:[00000030h] 10_2_016B6030
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A4000 mov ecx, dword ptr fs:[00000030h] 10_2_016A4000
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C2000 mov eax, dword ptr fs:[00000030h] 10_2_016C2000
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C2000 mov eax, dword ptr fs:[00000030h] 10_2_016C2000
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C2000 mov eax, dword ptr fs:[00000030h] 10_2_016C2000
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C2000 mov eax, dword ptr fs:[00000030h] 10_2_016C2000
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C2000 mov eax, dword ptr fs:[00000030h] 10_2_016C2000
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C2000 mov eax, dword ptr fs:[00000030h] 10_2_016C2000
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C2000 mov eax, dword ptr fs:[00000030h] 10_2_016C2000
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C2000 mov eax, dword ptr fs:[00000030h] 10_2_016C2000
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0163E016 mov eax, dword ptr fs:[00000030h] 10_2_0163E016
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0163E016 mov eax, dword ptr fs:[00000030h] 10_2_0163E016
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0163E016 mov eax, dword ptr fs:[00000030h] 10_2_0163E016
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0163E016 mov eax, dword ptr fs:[00000030h] 10_2_0163E016
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161A0E3 mov ecx, dword ptr fs:[00000030h] 10_2_0161A0E3
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A60E0 mov eax, dword ptr fs:[00000030h] 10_2_016A60E0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016280E9 mov eax, dword ptr fs:[00000030h] 10_2_016280E9
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161C0F0 mov eax, dword ptr fs:[00000030h] 10_2_0161C0F0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016620F0 mov ecx, dword ptr fs:[00000030h] 10_2_016620F0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A20DE mov eax, dword ptr fs:[00000030h] 10_2_016A20DE
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016180A0 mov eax, dword ptr fs:[00000030h] 10_2_016180A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B80A8 mov eax, dword ptr fs:[00000030h] 10_2_016B80A8
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016E60B8 mov eax, dword ptr fs:[00000030h] 10_2_016E60B8
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016E60B8 mov ecx, dword ptr fs:[00000030h] 10_2_016E60B8
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162208A mov eax, dword ptr fs:[00000030h] 10_2_0162208A
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C437C mov eax, dword ptr fs:[00000030h] 10_2_016C437C
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F634F mov eax, dword ptr fs:[00000030h] 10_2_016F634F
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A2349 mov eax, dword ptr fs:[00000030h] 10_2_016A2349
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A2349 mov eax, dword ptr fs:[00000030h] 10_2_016A2349
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A2349 mov eax, dword ptr fs:[00000030h] 10_2_016A2349
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A2349 mov eax, dword ptr fs:[00000030h] 10_2_016A2349
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A2349 mov eax, dword ptr fs:[00000030h] 10_2_016A2349
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A2349 mov eax, dword ptr fs:[00000030h] 10_2_016A2349
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A2349 mov eax, dword ptr fs:[00000030h] 10_2_016A2349
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A2349 mov eax, dword ptr fs:[00000030h] 10_2_016A2349
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A2349 mov eax, dword ptr fs:[00000030h] 10_2_016A2349
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A2349 mov eax, dword ptr fs:[00000030h] 10_2_016A2349
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A2349 mov eax, dword ptr fs:[00000030h] 10_2_016A2349
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A2349 mov eax, dword ptr fs:[00000030h] 10_2_016A2349
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A2349 mov eax, dword ptr fs:[00000030h] 10_2_016A2349
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A2349 mov eax, dword ptr fs:[00000030h] 10_2_016A2349
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A2349 mov eax, dword ptr fs:[00000030h] 10_2_016A2349
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A035C mov eax, dword ptr fs:[00000030h] 10_2_016A035C
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A035C mov eax, dword ptr fs:[00000030h] 10_2_016A035C
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A035C mov eax, dword ptr fs:[00000030h] 10_2_016A035C
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A035C mov ecx, dword ptr fs:[00000030h] 10_2_016A035C
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A035C mov eax, dword ptr fs:[00000030h] 10_2_016A035C
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A035C mov eax, dword ptr fs:[00000030h] 10_2_016A035C
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016EA352 mov eax, dword ptr fs:[00000030h] 10_2_016EA352
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C8350 mov ecx, dword ptr fs:[00000030h] 10_2_016C8350
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165A30B mov eax, dword ptr fs:[00000030h] 10_2_0165A30B
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165A30B mov eax, dword ptr fs:[00000030h] 10_2_0165A30B
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165A30B mov eax, dword ptr fs:[00000030h] 10_2_0165A30B
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161C310 mov ecx, dword ptr fs:[00000030h] 10_2_0161C310
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01640310 mov ecx, dword ptr fs:[00000030h] 10_2_01640310
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016303E9 mov eax, dword ptr fs:[00000030h] 10_2_016303E9
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016303E9 mov eax, dword ptr fs:[00000030h] 10_2_016303E9
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016303E9 mov eax, dword ptr fs:[00000030h] 10_2_016303E9
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016303E9 mov eax, dword ptr fs:[00000030h] 10_2_016303E9
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016303E9 mov eax, dword ptr fs:[00000030h] 10_2_016303E9
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016303E9 mov eax, dword ptr fs:[00000030h] 10_2_016303E9
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016303E9 mov eax, dword ptr fs:[00000030h] 10_2_016303E9
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016303E9 mov eax, dword ptr fs:[00000030h] 10_2_016303E9
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0163E3F0 mov eax, dword ptr fs:[00000030h] 10_2_0163E3F0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0163E3F0 mov eax, dword ptr fs:[00000030h] 10_2_0163E3F0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0163E3F0 mov eax, dword ptr fs:[00000030h] 10_2_0163E3F0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016563FF mov eax, dword ptr fs:[00000030h] 10_2_016563FF
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016DC3CD mov eax, dword ptr fs:[00000030h] 10_2_016DC3CD
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162A3C0 mov eax, dword ptr fs:[00000030h] 10_2_0162A3C0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162A3C0 mov eax, dword ptr fs:[00000030h] 10_2_0162A3C0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162A3C0 mov eax, dword ptr fs:[00000030h] 10_2_0162A3C0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162A3C0 mov eax, dword ptr fs:[00000030h] 10_2_0162A3C0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162A3C0 mov eax, dword ptr fs:[00000030h] 10_2_0162A3C0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162A3C0 mov eax, dword ptr fs:[00000030h] 10_2_0162A3C0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016283C0 mov eax, dword ptr fs:[00000030h] 10_2_016283C0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016283C0 mov eax, dword ptr fs:[00000030h] 10_2_016283C0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016283C0 mov eax, dword ptr fs:[00000030h] 10_2_016283C0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016283C0 mov eax, dword ptr fs:[00000030h] 10_2_016283C0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A63C0 mov eax, dword ptr fs:[00000030h] 10_2_016A63C0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CE3DB mov eax, dword ptr fs:[00000030h] 10_2_016CE3DB
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CE3DB mov eax, dword ptr fs:[00000030h] 10_2_016CE3DB
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CE3DB mov ecx, dword ptr fs:[00000030h] 10_2_016CE3DB
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CE3DB mov eax, dword ptr fs:[00000030h] 10_2_016CE3DB
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C43D4 mov eax, dword ptr fs:[00000030h] 10_2_016C43D4
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C43D4 mov eax, dword ptr fs:[00000030h] 10_2_016C43D4
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161E388 mov eax, dword ptr fs:[00000030h] 10_2_0161E388
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161E388 mov eax, dword ptr fs:[00000030h] 10_2_0161E388
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161E388 mov eax, dword ptr fs:[00000030h] 10_2_0161E388
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164438F mov eax, dword ptr fs:[00000030h] 10_2_0164438F
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164438F mov eax, dword ptr fs:[00000030h] 10_2_0164438F
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01618397 mov eax, dword ptr fs:[00000030h] 10_2_01618397
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01618397 mov eax, dword ptr fs:[00000030h] 10_2_01618397
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01618397 mov eax, dword ptr fs:[00000030h] 10_2_01618397
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01624260 mov eax, dword ptr fs:[00000030h] 10_2_01624260
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01624260 mov eax, dword ptr fs:[00000030h] 10_2_01624260
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01624260 mov eax, dword ptr fs:[00000030h] 10_2_01624260
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161826B mov eax, dword ptr fs:[00000030h] 10_2_0161826B
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D0274 mov eax, dword ptr fs:[00000030h] 10_2_016D0274
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D0274 mov eax, dword ptr fs:[00000030h] 10_2_016D0274
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D0274 mov eax, dword ptr fs:[00000030h] 10_2_016D0274
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D0274 mov eax, dword ptr fs:[00000030h] 10_2_016D0274
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D0274 mov eax, dword ptr fs:[00000030h] 10_2_016D0274
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D0274 mov eax, dword ptr fs:[00000030h] 10_2_016D0274
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D0274 mov eax, dword ptr fs:[00000030h] 10_2_016D0274
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D0274 mov eax, dword ptr fs:[00000030h] 10_2_016D0274
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D0274 mov eax, dword ptr fs:[00000030h] 10_2_016D0274
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D0274 mov eax, dword ptr fs:[00000030h] 10_2_016D0274
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D0274 mov eax, dword ptr fs:[00000030h] 10_2_016D0274
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D0274 mov eax, dword ptr fs:[00000030h] 10_2_016D0274
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A8243 mov eax, dword ptr fs:[00000030h] 10_2_016A8243
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A8243 mov ecx, dword ptr fs:[00000030h] 10_2_016A8243
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161A250 mov eax, dword ptr fs:[00000030h] 10_2_0161A250
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F625D mov eax, dword ptr fs:[00000030h] 10_2_016F625D
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01626259 mov eax, dword ptr fs:[00000030h] 10_2_01626259
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016DA250 mov eax, dword ptr fs:[00000030h] 10_2_016DA250
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016DA250 mov eax, dword ptr fs:[00000030h] 10_2_016DA250
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161823B mov eax, dword ptr fs:[00000030h] 10_2_0161823B
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016302E1 mov eax, dword ptr fs:[00000030h] 10_2_016302E1
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016302E1 mov eax, dword ptr fs:[00000030h] 10_2_016302E1
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016302E1 mov eax, dword ptr fs:[00000030h] 10_2_016302E1
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162A2C3 mov eax, dword ptr fs:[00000030h] 10_2_0162A2C3
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162A2C3 mov eax, dword ptr fs:[00000030h] 10_2_0162A2C3
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162A2C3 mov eax, dword ptr fs:[00000030h] 10_2_0162A2C3
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162A2C3 mov eax, dword ptr fs:[00000030h] 10_2_0162A2C3
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162A2C3 mov eax, dword ptr fs:[00000030h] 10_2_0162A2C3
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F62D6 mov eax, dword ptr fs:[00000030h] 10_2_016F62D6
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016302A0 mov eax, dword ptr fs:[00000030h] 10_2_016302A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016302A0 mov eax, dword ptr fs:[00000030h] 10_2_016302A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B62A0 mov eax, dword ptr fs:[00000030h] 10_2_016B62A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B62A0 mov ecx, dword ptr fs:[00000030h] 10_2_016B62A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B62A0 mov eax, dword ptr fs:[00000030h] 10_2_016B62A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B62A0 mov eax, dword ptr fs:[00000030h] 10_2_016B62A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B62A0 mov eax, dword ptr fs:[00000030h] 10_2_016B62A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B62A0 mov eax, dword ptr fs:[00000030h] 10_2_016B62A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165E284 mov eax, dword ptr fs:[00000030h] 10_2_0165E284
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165E284 mov eax, dword ptr fs:[00000030h] 10_2_0165E284
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A0283 mov eax, dword ptr fs:[00000030h] 10_2_016A0283
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A0283 mov eax, dword ptr fs:[00000030h] 10_2_016A0283
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A0283 mov eax, dword ptr fs:[00000030h] 10_2_016A0283
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165656A mov eax, dword ptr fs:[00000030h] 10_2_0165656A
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165656A mov eax, dword ptr fs:[00000030h] 10_2_0165656A
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165656A mov eax, dword ptr fs:[00000030h] 10_2_0165656A
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01628550 mov eax, dword ptr fs:[00000030h] 10_2_01628550
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01628550 mov eax, dword ptr fs:[00000030h] 10_2_01628550
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630535 mov eax, dword ptr fs:[00000030h] 10_2_01630535
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630535 mov eax, dword ptr fs:[00000030h] 10_2_01630535
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630535 mov eax, dword ptr fs:[00000030h] 10_2_01630535
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630535 mov eax, dword ptr fs:[00000030h] 10_2_01630535
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630535 mov eax, dword ptr fs:[00000030h] 10_2_01630535
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630535 mov eax, dword ptr fs:[00000030h] 10_2_01630535
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164E53E mov eax, dword ptr fs:[00000030h] 10_2_0164E53E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164E53E mov eax, dword ptr fs:[00000030h] 10_2_0164E53E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164E53E mov eax, dword ptr fs:[00000030h] 10_2_0164E53E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164E53E mov eax, dword ptr fs:[00000030h] 10_2_0164E53E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164E53E mov eax, dword ptr fs:[00000030h] 10_2_0164E53E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B6500 mov eax, dword ptr fs:[00000030h] 10_2_016B6500
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F4500 mov eax, dword ptr fs:[00000030h] 10_2_016F4500
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F4500 mov eax, dword ptr fs:[00000030h] 10_2_016F4500
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F4500 mov eax, dword ptr fs:[00000030h] 10_2_016F4500
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F4500 mov eax, dword ptr fs:[00000030h] 10_2_016F4500
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F4500 mov eax, dword ptr fs:[00000030h] 10_2_016F4500
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F4500 mov eax, dword ptr fs:[00000030h] 10_2_016F4500
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F4500 mov eax, dword ptr fs:[00000030h] 10_2_016F4500
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016225E0 mov eax, dword ptr fs:[00000030h] 10_2_016225E0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164E5E7 mov eax, dword ptr fs:[00000030h] 10_2_0164E5E7
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164E5E7 mov eax, dword ptr fs:[00000030h] 10_2_0164E5E7
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164E5E7 mov eax, dword ptr fs:[00000030h] 10_2_0164E5E7
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164E5E7 mov eax, dword ptr fs:[00000030h] 10_2_0164E5E7
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164E5E7 mov eax, dword ptr fs:[00000030h] 10_2_0164E5E7
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164E5E7 mov eax, dword ptr fs:[00000030h] 10_2_0164E5E7
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164E5E7 mov eax, dword ptr fs:[00000030h] 10_2_0164E5E7
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164E5E7 mov eax, dword ptr fs:[00000030h] 10_2_0164E5E7
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165C5ED mov eax, dword ptr fs:[00000030h] 10_2_0165C5ED
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165C5ED mov eax, dword ptr fs:[00000030h] 10_2_0165C5ED
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165E5CF mov eax, dword ptr fs:[00000030h] 10_2_0165E5CF
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165E5CF mov eax, dword ptr fs:[00000030h] 10_2_0165E5CF
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016265D0 mov eax, dword ptr fs:[00000030h] 10_2_016265D0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165A5D0 mov eax, dword ptr fs:[00000030h] 10_2_0165A5D0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165A5D0 mov eax, dword ptr fs:[00000030h] 10_2_0165A5D0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A05A7 mov eax, dword ptr fs:[00000030h] 10_2_016A05A7
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A05A7 mov eax, dword ptr fs:[00000030h] 10_2_016A05A7
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A05A7 mov eax, dword ptr fs:[00000030h] 10_2_016A05A7
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016445B1 mov eax, dword ptr fs:[00000030h] 10_2_016445B1
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016445B1 mov eax, dword ptr fs:[00000030h] 10_2_016445B1
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01622582 mov eax, dword ptr fs:[00000030h] 10_2_01622582
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01622582 mov ecx, dword ptr fs:[00000030h] 10_2_01622582
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01654588 mov eax, dword ptr fs:[00000030h] 10_2_01654588
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165E59C mov eax, dword ptr fs:[00000030h] 10_2_0165E59C
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016AC460 mov ecx, dword ptr fs:[00000030h] 10_2_016AC460
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164A470 mov eax, dword ptr fs:[00000030h] 10_2_0164A470
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164A470 mov eax, dword ptr fs:[00000030h] 10_2_0164A470
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164A470 mov eax, dword ptr fs:[00000030h] 10_2_0164A470
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165E443 mov eax, dword ptr fs:[00000030h] 10_2_0165E443
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165E443 mov eax, dword ptr fs:[00000030h] 10_2_0165E443
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165E443 mov eax, dword ptr fs:[00000030h] 10_2_0165E443
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165E443 mov eax, dword ptr fs:[00000030h] 10_2_0165E443
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165E443 mov eax, dword ptr fs:[00000030h] 10_2_0165E443
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165E443 mov eax, dword ptr fs:[00000030h] 10_2_0165E443
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165E443 mov eax, dword ptr fs:[00000030h] 10_2_0165E443
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165E443 mov eax, dword ptr fs:[00000030h] 10_2_0165E443
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016DA456 mov eax, dword ptr fs:[00000030h] 10_2_016DA456
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161645D mov eax, dword ptr fs:[00000030h] 10_2_0161645D
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164245A mov eax, dword ptr fs:[00000030h] 10_2_0164245A
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161E420 mov eax, dword ptr fs:[00000030h] 10_2_0161E420
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161E420 mov eax, dword ptr fs:[00000030h] 10_2_0161E420
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161E420 mov eax, dword ptr fs:[00000030h] 10_2_0161E420
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161C427 mov eax, dword ptr fs:[00000030h] 10_2_0161C427
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A6420 mov eax, dword ptr fs:[00000030h] 10_2_016A6420
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A6420 mov eax, dword ptr fs:[00000030h] 10_2_016A6420
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A6420 mov eax, dword ptr fs:[00000030h] 10_2_016A6420
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A6420 mov eax, dword ptr fs:[00000030h] 10_2_016A6420
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A6420 mov eax, dword ptr fs:[00000030h] 10_2_016A6420
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A6420 mov eax, dword ptr fs:[00000030h] 10_2_016A6420
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A6420 mov eax, dword ptr fs:[00000030h] 10_2_016A6420
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165A430 mov eax, dword ptr fs:[00000030h] 10_2_0165A430
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01658402 mov eax, dword ptr fs:[00000030h] 10_2_01658402
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01658402 mov eax, dword ptr fs:[00000030h] 10_2_01658402
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01658402 mov eax, dword ptr fs:[00000030h] 10_2_01658402
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016204E5 mov ecx, dword ptr fs:[00000030h] 10_2_016204E5
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016264AB mov eax, dword ptr fs:[00000030h] 10_2_016264AB
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016544B0 mov ecx, dword ptr fs:[00000030h] 10_2_016544B0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016AA4B0 mov eax, dword ptr fs:[00000030h] 10_2_016AA4B0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016DA49A mov eax, dword ptr fs:[00000030h] 10_2_016DA49A
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01628770 mov eax, dword ptr fs:[00000030h] 10_2_01628770
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630770 mov eax, dword ptr fs:[00000030h] 10_2_01630770
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630770 mov eax, dword ptr fs:[00000030h] 10_2_01630770
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630770 mov eax, dword ptr fs:[00000030h] 10_2_01630770
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630770 mov eax, dword ptr fs:[00000030h] 10_2_01630770
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630770 mov eax, dword ptr fs:[00000030h] 10_2_01630770
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630770 mov eax, dword ptr fs:[00000030h] 10_2_01630770
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630770 mov eax, dword ptr fs:[00000030h] 10_2_01630770
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630770 mov eax, dword ptr fs:[00000030h] 10_2_01630770
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630770 mov eax, dword ptr fs:[00000030h] 10_2_01630770
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630770 mov eax, dword ptr fs:[00000030h] 10_2_01630770
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630770 mov eax, dword ptr fs:[00000030h] 10_2_01630770
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630770 mov eax, dword ptr fs:[00000030h] 10_2_01630770
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165674D mov esi, dword ptr fs:[00000030h] 10_2_0165674D
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165674D mov eax, dword ptr fs:[00000030h] 10_2_0165674D
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165674D mov eax, dword ptr fs:[00000030h] 10_2_0165674D
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01620750 mov eax, dword ptr fs:[00000030h] 10_2_01620750
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662750 mov eax, dword ptr fs:[00000030h] 10_2_01662750
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662750 mov eax, dword ptr fs:[00000030h] 10_2_01662750
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016AE75D mov eax, dword ptr fs:[00000030h] 10_2_016AE75D
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A4755 mov eax, dword ptr fs:[00000030h] 10_2_016A4755
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165C720 mov eax, dword ptr fs:[00000030h] 10_2_0165C720
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165C720 mov eax, dword ptr fs:[00000030h] 10_2_0165C720
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165273C mov eax, dword ptr fs:[00000030h] 10_2_0165273C
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165273C mov ecx, dword ptr fs:[00000030h] 10_2_0165273C
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165273C mov eax, dword ptr fs:[00000030h] 10_2_0165273C
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169C730 mov eax, dword ptr fs:[00000030h] 10_2_0169C730
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165C700 mov eax, dword ptr fs:[00000030h] 10_2_0165C700
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01620710 mov eax, dword ptr fs:[00000030h] 10_2_01620710
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01650710 mov eax, dword ptr fs:[00000030h] 10_2_01650710
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016427ED mov eax, dword ptr fs:[00000030h] 10_2_016427ED
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016427ED mov eax, dword ptr fs:[00000030h] 10_2_016427ED
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016427ED mov eax, dword ptr fs:[00000030h] 10_2_016427ED
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016AE7E1 mov eax, dword ptr fs:[00000030h] 10_2_016AE7E1
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016247FB mov eax, dword ptr fs:[00000030h] 10_2_016247FB
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016247FB mov eax, dword ptr fs:[00000030h] 10_2_016247FB
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162C7C0 mov eax, dword ptr fs:[00000030h] 10_2_0162C7C0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A07C3 mov eax, dword ptr fs:[00000030h] 10_2_016A07C3
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016207AF mov eax, dword ptr fs:[00000030h] 10_2_016207AF
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D47A0 mov eax, dword ptr fs:[00000030h] 10_2_016D47A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C678E mov eax, dword ptr fs:[00000030h] 10_2_016C678E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016E866E mov eax, dword ptr fs:[00000030h] 10_2_016E866E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016E866E mov eax, dword ptr fs:[00000030h] 10_2_016E866E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165A660 mov eax, dword ptr fs:[00000030h] 10_2_0165A660
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165A660 mov eax, dword ptr fs:[00000030h] 10_2_0165A660
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01652674 mov eax, dword ptr fs:[00000030h] 10_2_01652674
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0163C640 mov eax, dword ptr fs:[00000030h] 10_2_0163C640
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0163E627 mov eax, dword ptr fs:[00000030h] 10_2_0163E627
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01656620 mov eax, dword ptr fs:[00000030h] 10_2_01656620
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01658620 mov eax, dword ptr fs:[00000030h] 10_2_01658620
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162262C mov eax, dword ptr fs:[00000030h] 10_2_0162262C
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169E609 mov eax, dword ptr fs:[00000030h] 10_2_0169E609
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0163260B mov eax, dword ptr fs:[00000030h] 10_2_0163260B
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0163260B mov eax, dword ptr fs:[00000030h] 10_2_0163260B
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0163260B mov eax, dword ptr fs:[00000030h] 10_2_0163260B
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0163260B mov eax, dword ptr fs:[00000030h] 10_2_0163260B
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0163260B mov eax, dword ptr fs:[00000030h] 10_2_0163260B
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0163260B mov eax, dword ptr fs:[00000030h] 10_2_0163260B
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0163260B mov eax, dword ptr fs:[00000030h] 10_2_0163260B
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01662619 mov eax, dword ptr fs:[00000030h] 10_2_01662619
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169E6F2 mov eax, dword ptr fs:[00000030h] 10_2_0169E6F2
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169E6F2 mov eax, dword ptr fs:[00000030h] 10_2_0169E6F2
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169E6F2 mov eax, dword ptr fs:[00000030h] 10_2_0169E6F2
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169E6F2 mov eax, dword ptr fs:[00000030h] 10_2_0169E6F2
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A06F1 mov eax, dword ptr fs:[00000030h] 10_2_016A06F1
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A06F1 mov eax, dword ptr fs:[00000030h] 10_2_016A06F1
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165A6C7 mov ebx, dword ptr fs:[00000030h] 10_2_0165A6C7
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165A6C7 mov eax, dword ptr fs:[00000030h] 10_2_0165A6C7
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165C6A6 mov eax, dword ptr fs:[00000030h] 10_2_0165C6A6
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016566B0 mov eax, dword ptr fs:[00000030h] 10_2_016566B0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01624690 mov eax, dword ptr fs:[00000030h] 10_2_01624690
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01624690 mov eax, dword ptr fs:[00000030h] 10_2_01624690
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01646962 mov eax, dword ptr fs:[00000030h] 10_2_01646962
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01646962 mov eax, dword ptr fs:[00000030h] 10_2_01646962
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01646962 mov eax, dword ptr fs:[00000030h] 10_2_01646962
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0166096E mov eax, dword ptr fs:[00000030h] 10_2_0166096E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0166096E mov edx, dword ptr fs:[00000030h] 10_2_0166096E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0166096E mov eax, dword ptr fs:[00000030h] 10_2_0166096E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C4978 mov eax, dword ptr fs:[00000030h] 10_2_016C4978
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C4978 mov eax, dword ptr fs:[00000030h] 10_2_016C4978
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016AC97C mov eax, dword ptr fs:[00000030h] 10_2_016AC97C
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A0946 mov eax, dword ptr fs:[00000030h] 10_2_016A0946
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F4940 mov eax, dword ptr fs:[00000030h] 10_2_016F4940
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A892A mov eax, dword ptr fs:[00000030h] 10_2_016A892A
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B892B mov eax, dword ptr fs:[00000030h] 10_2_016B892B
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169E908 mov eax, dword ptr fs:[00000030h] 10_2_0169E908
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169E908 mov eax, dword ptr fs:[00000030h] 10_2_0169E908
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016AC912 mov eax, dword ptr fs:[00000030h] 10_2_016AC912
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01618918 mov eax, dword ptr fs:[00000030h] 10_2_01618918
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01618918 mov eax, dword ptr fs:[00000030h] 10_2_01618918
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016AE9E0 mov eax, dword ptr fs:[00000030h] 10_2_016AE9E0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016529F9 mov eax, dword ptr fs:[00000030h] 10_2_016529F9
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016529F9 mov eax, dword ptr fs:[00000030h] 10_2_016529F9
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B69C0 mov eax, dword ptr fs:[00000030h] 10_2_016B69C0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162A9D0 mov eax, dword ptr fs:[00000030h] 10_2_0162A9D0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162A9D0 mov eax, dword ptr fs:[00000030h] 10_2_0162A9D0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162A9D0 mov eax, dword ptr fs:[00000030h] 10_2_0162A9D0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162A9D0 mov eax, dword ptr fs:[00000030h] 10_2_0162A9D0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162A9D0 mov eax, dword ptr fs:[00000030h] 10_2_0162A9D0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162A9D0 mov eax, dword ptr fs:[00000030h] 10_2_0162A9D0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016549D0 mov eax, dword ptr fs:[00000030h] 10_2_016549D0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016EA9D3 mov eax, dword ptr fs:[00000030h] 10_2_016EA9D3
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016329A0 mov eax, dword ptr fs:[00000030h] 10_2_016329A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016329A0 mov eax, dword ptr fs:[00000030h] 10_2_016329A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016329A0 mov eax, dword ptr fs:[00000030h] 10_2_016329A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016329A0 mov eax, dword ptr fs:[00000030h] 10_2_016329A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016329A0 mov eax, dword ptr fs:[00000030h] 10_2_016329A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016329A0 mov eax, dword ptr fs:[00000030h] 10_2_016329A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016329A0 mov eax, dword ptr fs:[00000030h] 10_2_016329A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016329A0 mov eax, dword ptr fs:[00000030h] 10_2_016329A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016329A0 mov eax, dword ptr fs:[00000030h] 10_2_016329A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016329A0 mov eax, dword ptr fs:[00000030h] 10_2_016329A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016329A0 mov eax, dword ptr fs:[00000030h] 10_2_016329A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016329A0 mov eax, dword ptr fs:[00000030h] 10_2_016329A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016329A0 mov eax, dword ptr fs:[00000030h] 10_2_016329A0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016209AD mov eax, dword ptr fs:[00000030h] 10_2_016209AD
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016209AD mov eax, dword ptr fs:[00000030h] 10_2_016209AD
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A89B3 mov esi, dword ptr fs:[00000030h] 10_2_016A89B3
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A89B3 mov eax, dword ptr fs:[00000030h] 10_2_016A89B3
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016A89B3 mov eax, dword ptr fs:[00000030h] 10_2_016A89B3
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016AE872 mov eax, dword ptr fs:[00000030h] 10_2_016AE872
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016AE872 mov eax, dword ptr fs:[00000030h] 10_2_016AE872
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B6870 mov eax, dword ptr fs:[00000030h] 10_2_016B6870
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B6870 mov eax, dword ptr fs:[00000030h] 10_2_016B6870
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01632840 mov ecx, dword ptr fs:[00000030h] 10_2_01632840
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01650854 mov eax, dword ptr fs:[00000030h] 10_2_01650854
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01624859 mov eax, dword ptr fs:[00000030h] 10_2_01624859
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01624859 mov eax, dword ptr fs:[00000030h] 10_2_01624859
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01642835 mov eax, dword ptr fs:[00000030h] 10_2_01642835
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01642835 mov eax, dword ptr fs:[00000030h] 10_2_01642835
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01642835 mov eax, dword ptr fs:[00000030h] 10_2_01642835
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01642835 mov ecx, dword ptr fs:[00000030h] 10_2_01642835
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01642835 mov eax, dword ptr fs:[00000030h] 10_2_01642835
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01642835 mov eax, dword ptr fs:[00000030h] 10_2_01642835
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165A830 mov eax, dword ptr fs:[00000030h] 10_2_0165A830
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C483A mov eax, dword ptr fs:[00000030h] 10_2_016C483A
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C483A mov eax, dword ptr fs:[00000030h] 10_2_016C483A
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016AC810 mov eax, dword ptr fs:[00000030h] 10_2_016AC810
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016EA8E4 mov eax, dword ptr fs:[00000030h] 10_2_016EA8E4
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165C8F9 mov eax, dword ptr fs:[00000030h] 10_2_0165C8F9
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165C8F9 mov eax, dword ptr fs:[00000030h] 10_2_0165C8F9
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164E8C0 mov eax, dword ptr fs:[00000030h] 10_2_0164E8C0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F08C0 mov eax, dword ptr fs:[00000030h] 10_2_016F08C0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01620887 mov eax, dword ptr fs:[00000030h] 10_2_01620887
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016AC89D mov eax, dword ptr fs:[00000030h] 10_2_016AC89D
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0161CB7E mov eax, dword ptr fs:[00000030h] 10_2_0161CB7E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D4B4B mov eax, dword ptr fs:[00000030h] 10_2_016D4B4B
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D4B4B mov eax, dword ptr fs:[00000030h] 10_2_016D4B4B
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B6B40 mov eax, dword ptr fs:[00000030h] 10_2_016B6B40
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016B6B40 mov eax, dword ptr fs:[00000030h] 10_2_016B6B40
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016EAB40 mov eax, dword ptr fs:[00000030h] 10_2_016EAB40
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016C8B42 mov eax, dword ptr fs:[00000030h] 10_2_016C8B42
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01618B50 mov eax, dword ptr fs:[00000030h] 10_2_01618B50
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F2B57 mov eax, dword ptr fs:[00000030h] 10_2_016F2B57
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F2B57 mov eax, dword ptr fs:[00000030h] 10_2_016F2B57
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F2B57 mov eax, dword ptr fs:[00000030h] 10_2_016F2B57
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F2B57 mov eax, dword ptr fs:[00000030h] 10_2_016F2B57
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CEB50 mov eax, dword ptr fs:[00000030h] 10_2_016CEB50
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164EB20 mov eax, dword ptr fs:[00000030h] 10_2_0164EB20
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164EB20 mov eax, dword ptr fs:[00000030h] 10_2_0164EB20
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016E8B28 mov eax, dword ptr fs:[00000030h] 10_2_016E8B28
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016E8B28 mov eax, dword ptr fs:[00000030h] 10_2_016E8B28
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016F4B00 mov eax, dword ptr fs:[00000030h] 10_2_016F4B00
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169EB1D mov eax, dword ptr fs:[00000030h] 10_2_0169EB1D
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169EB1D mov eax, dword ptr fs:[00000030h] 10_2_0169EB1D
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169EB1D mov eax, dword ptr fs:[00000030h] 10_2_0169EB1D
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169EB1D mov eax, dword ptr fs:[00000030h] 10_2_0169EB1D
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169EB1D mov eax, dword ptr fs:[00000030h] 10_2_0169EB1D
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169EB1D mov eax, dword ptr fs:[00000030h] 10_2_0169EB1D
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169EB1D mov eax, dword ptr fs:[00000030h] 10_2_0169EB1D
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169EB1D mov eax, dword ptr fs:[00000030h] 10_2_0169EB1D
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169EB1D mov eax, dword ptr fs:[00000030h] 10_2_0169EB1D
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01628BF0 mov eax, dword ptr fs:[00000030h] 10_2_01628BF0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01628BF0 mov eax, dword ptr fs:[00000030h] 10_2_01628BF0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01628BF0 mov eax, dword ptr fs:[00000030h] 10_2_01628BF0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164EBFC mov eax, dword ptr fs:[00000030h] 10_2_0164EBFC
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016ACBF0 mov eax, dword ptr fs:[00000030h] 10_2_016ACBF0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01640BCB mov eax, dword ptr fs:[00000030h] 10_2_01640BCB
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01640BCB mov eax, dword ptr fs:[00000030h] 10_2_01640BCB
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01640BCB mov eax, dword ptr fs:[00000030h] 10_2_01640BCB
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01620BCD mov eax, dword ptr fs:[00000030h] 10_2_01620BCD
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01620BCD mov eax, dword ptr fs:[00000030h] 10_2_01620BCD
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01620BCD mov eax, dword ptr fs:[00000030h] 10_2_01620BCD
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CEBD0 mov eax, dword ptr fs:[00000030h] 10_2_016CEBD0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630BBE mov eax, dword ptr fs:[00000030h] 10_2_01630BBE
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630BBE mov eax, dword ptr fs:[00000030h] 10_2_01630BBE
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D4BB0 mov eax, dword ptr fs:[00000030h] 10_2_016D4BB0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016D4BB0 mov eax, dword ptr fs:[00000030h] 10_2_016D4BB0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165CA6F mov eax, dword ptr fs:[00000030h] 10_2_0165CA6F
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165CA6F mov eax, dword ptr fs:[00000030h] 10_2_0165CA6F
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165CA6F mov eax, dword ptr fs:[00000030h] 10_2_0165CA6F
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016CEA60 mov eax, dword ptr fs:[00000030h] 10_2_016CEA60
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169CA72 mov eax, dword ptr fs:[00000030h] 10_2_0169CA72
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0169CA72 mov eax, dword ptr fs:[00000030h] 10_2_0169CA72
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01626A50 mov eax, dword ptr fs:[00000030h] 10_2_01626A50
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01626A50 mov eax, dword ptr fs:[00000030h] 10_2_01626A50
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01626A50 mov eax, dword ptr fs:[00000030h] 10_2_01626A50
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01626A50 mov eax, dword ptr fs:[00000030h] 10_2_01626A50
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01626A50 mov eax, dword ptr fs:[00000030h] 10_2_01626A50
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01626A50 mov eax, dword ptr fs:[00000030h] 10_2_01626A50
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01626A50 mov eax, dword ptr fs:[00000030h] 10_2_01626A50
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630A5B mov eax, dword ptr fs:[00000030h] 10_2_01630A5B
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01630A5B mov eax, dword ptr fs:[00000030h] 10_2_01630A5B
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165CA24 mov eax, dword ptr fs:[00000030h] 10_2_0165CA24
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0164EA2E mov eax, dword ptr fs:[00000030h] 10_2_0164EA2E
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01644A35 mov eax, dword ptr fs:[00000030h] 10_2_01644A35
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01644A35 mov eax, dword ptr fs:[00000030h] 10_2_01644A35
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165CA38 mov eax, dword ptr fs:[00000030h] 10_2_0165CA38
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_016ACA11 mov eax, dword ptr fs:[00000030h] 10_2_016ACA11
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165AAEE mov eax, dword ptr fs:[00000030h] 10_2_0165AAEE
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0165AAEE mov eax, dword ptr fs:[00000030h] 10_2_0165AAEE
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01676ACC mov eax, dword ptr fs:[00000030h] 10_2_01676ACC
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01676ACC mov eax, dword ptr fs:[00000030h] 10_2_01676ACC
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01676ACC mov eax, dword ptr fs:[00000030h] 10_2_01676ACC
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01620AD0 mov eax, dword ptr fs:[00000030h] 10_2_01620AD0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01654AD0 mov eax, dword ptr fs:[00000030h] 10_2_01654AD0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01654AD0 mov eax, dword ptr fs:[00000030h] 10_2_01654AD0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01628AA0 mov eax, dword ptr fs:[00000030h] 10_2_01628AA0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01628AA0 mov eax, dword ptr fs:[00000030h] 10_2_01628AA0
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_01676AA4 mov eax, dword ptr fs:[00000030h] 10_2_01676AA4
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162EA80 mov eax, dword ptr fs:[00000030h] 10_2_0162EA80
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162EA80 mov eax, dword ptr fs:[00000030h] 10_2_0162EA80
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162EA80 mov eax, dword ptr fs:[00000030h] 10_2_0162EA80
Source: C:\Users\user\Desktop\ungziped_file.exe Code function: 10_2_0162EA80 mov eax, dword ptr fs:[00000030h] 10_2_0162EA80
Source: C:\Users\user\Desktop\ungziped_file.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\ungziped_file.exe Memory written: C:\Users\user\Desktop\ungziped_file.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\ungziped_file.exe Process created: C:\Users\user\Desktop\ungziped_file.exe "C:\Users\user\Desktop\ungziped_file.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\ungziped_file.exe Queries volume information: C:\Users\user\Desktop\ungziped_file.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ungziped_file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 10.2.ungziped_file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.ungziped_file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.1639030776.0000000001940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1637721060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 10.2.ungziped_file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.ungziped_file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.1639030776.0000000001940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1637721060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1527841 Sample: ungziped_file.exe Startdate: 07/10/2024 Architecture: WINDOWS Score: 88 14 Malicious sample detected (through community Yara rule) 2->14 16 Multi AV Scanner detection for submitted file 2->16 18 Yara detected FormBook 2->18 20 4 other signatures 2->20 6 ungziped_file.exe 3 2->6         started        process3 file4 12 C:\Users\user\...\ungziped_file.exe.log, ASCII 6->12 dropped 22 Injects a PE file into a foreign processes 6->22 10 ungziped_file.exe 6->10         started        signatures5 process6
⊘No contacted IP infos