Windows Analysis Report
PEDIDO-144848.exe

Overview

General Information

Sample name: PEDIDO-144848.exe
Analysis ID: 1528317
MD5: 0d9f261233df472092fbfbb1e982bbe7
SHA1: 003feaf99830b2aac6213ede7d72b148b709da0b
SHA256: 57e01b9f47d3220585bdef71852add983d96d959c08b961b1f2795ef07d78160
Infos:

Detection

FormBook, GuLoader
Score: 96
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Yara detected GuLoader
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: PEDIDO-144848.exe ReversingLabs: Detection: 23%
Yara detected FormBook
Source: Yara match File source: 00000004.00000002.117101970998.0000000002D80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.117102256673.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.115570845480.0000000036930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Machine Learning detection for sample
Source: PEDIDO-144848.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: PEDIDO-144848.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 142.250.80.46:443 -> 192.168.11.20:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.251.40.97:443 -> 192.168.11.20:49749 version: TLS 1.2
Source: PEDIDO-144848.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: SecEdit.pdb source: PEDIDO-144848.exe, 00000002.00000003.115513057373.0000000006BE0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mshtml.pdb source: PEDIDO-144848.exe, 00000002.00000001.115003799007.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source: Binary string: SecEdit.pdbGCTL source: PEDIDO-144848.exe, 00000002.00000003.115513057373.0000000006BE0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: PEDIDO-144848.exe, 00000002.00000003.115463317086.0000000036A24000.00000004.00000020.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000003.115459604949.000000003687C000.00000004.00000020.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000002.115570937750.0000000036BD0000.00000040.00001000.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000002.115570937750.0000000036CFD000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: PEDIDO-144848.exe, PEDIDO-144848.exe, 00000002.00000003.115463317086.0000000036A24000.00000004.00000020.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000003.115459604949.000000003687C000.00000004.00000020.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000002.115570937750.0000000036BD0000.00000040.00001000.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000002.115570937750.0000000036CFD000.00000040.00001000.00020000.00000000.sdmp, SecEdit.exe
Source: Binary string: mshtml.pdbUGP source: PEDIDO-144848.exe, 00000002.00000001.115003799007.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 0_2_00405642 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 0_2_00405642
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 0_2_004060A4 FindFirstFileA,FindClose, 0_2_004060A4
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 0_2_0040270B FindFirstFileA, 0_2_0040270B
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 4x nop then mov ebx, 00000004h 2_2_369004DE
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4x nop then mov ebx, 00000004h 4_2_02ED04DE
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49748 -> 142.250.80.46:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /uc?export=download&id=1nw_HdIs_98H4IwtUbliFgm1UEpN9uiHU HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /download?id=1nw_HdIs_98H4IwtUbliFgm1UEpN9uiHU&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /uc?export=download&id=1nw_HdIs_98H4IwtUbliFgm1UEpN9uiHU HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /download?id=1nw_HdIs_98H4IwtUbliFgm1UEpN9uiHU&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: drive.google.com
Source: global traffic DNS traffic detected: DNS query: drive.usercontent.google.com
Source: PEDIDO-144848.exe, 00000002.00000003.115460308522.0000000006B88000.00000004.00000020.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000003.115119605785.0000000006B8E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: PEDIDO-144848.exe, 00000002.00000003.115460308522.0000000006B88000.00000004.00000020.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000003.115119605785.0000000006B8E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: PEDIDO-144848.exe, 00000002.00000001.115003799007.0000000000649000.00000020.00000001.01000000.00000006.sdmp String found in binary or memory: http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.
Source: PEDIDO-144848.exe, PEDIDO-144848.exe, 00000000.00000002.115150635160.0000000000409000.00000004.00000001.01000000.00000003.sdmp, PEDIDO-144848.exe, 00000000.00000000.113760696755.0000000000409000.00000008.00000001.01000000.00000003.sdmp, PEDIDO-144848.exe, 00000002.00000000.115002326935.0000000000409000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: PEDIDO-144848.exe, 00000000.00000002.115150635160.0000000000409000.00000004.00000001.01000000.00000003.sdmp, PEDIDO-144848.exe, 00000000.00000000.113760696755.0000000000409000.00000008.00000001.01000000.00000003.sdmp, PEDIDO-144848.exe, 00000002.00000000.115002326935.0000000000409000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: PEDIDO-144848.exe, 00000002.00000001.115003799007.0000000000649000.00000020.00000001.01000000.00000006.sdmp String found in binary or memory: http://www.gopher.ftp://ftp.
Source: PEDIDO-144848.exe, 00000002.00000003.115460308522.0000000006B88000.00000004.00000020.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000003.115119605785.0000000006B8E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.quovadis.bm0
Source: PEDIDO-144848.exe, 00000002.00000003.115119605785.0000000006B8E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://apis.google.com
Source: PEDIDO-144848.exe, 00000002.00000003.115460520041.0000000006B3C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/
Source: PEDIDO-144848.exe, 00000002.00000003.115460520041.0000000006B3C000.00000004.00000020.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000002.115560534476.0000000006B18000.00000004.00000020.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000002.115560493823.0000000006AF0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=1nw_HdIs_98H4IwtUbliFgm1UEpN9uiHU
Source: PEDIDO-144848.exe, 00000002.00000003.115460520041.0000000006B3C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=1nw_HdIs_98H4IwtUbliFgm1UEpN9uiHU2
Source: PEDIDO-144848.exe, 00000002.00000002.115560534476.0000000006B18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=1nw_HdIs_98H4IwtUbliFgm1UEpN9uiHU3
Source: PEDIDO-144848.exe, 00000002.00000002.115560534476.0000000006B18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=1nw_HdIs_98H4IwtUbliFgm1UEpN9uiHU5v
Source: PEDIDO-144848.exe, 00000002.00000003.115460308522.0000000006B88000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/
Source: PEDIDO-144848.exe, 00000002.00000003.115461027098.0000000006B6E000.00000004.00000020.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000003.115460308522.0000000006B88000.00000004.00000020.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000003.115119605785.0000000006B8E000.00000004.00000020.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000003.115460098433.0000000006B73000.00000004.00000020.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000002.115560757589.0000000006B6E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1nw_HdIs_98H4IwtUbliFgm1UEpN9uiHU&export=download
Source: PEDIDO-144848.exe, 00000002.00000003.115460308522.0000000006B88000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/h
Source: PEDIDO-144848.exe, 00000002.00000001.115003799007.0000000000649000.00000020.00000001.01000000.00000006.sdmp String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
Source: PEDIDO-144848.exe, 00000002.00000003.115460308522.0000000006B88000.00000004.00000020.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000003.115119605785.0000000006B8E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: PEDIDO-144848.exe, 00000002.00000003.115119605785.0000000006B8E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ssl.gstatic.com
Source: PEDIDO-144848.exe, 00000002.00000003.115119605785.0000000006B8E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com;report-uri
Source: PEDIDO-144848.exe, 00000002.00000003.115119605785.0000000006B8E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: PEDIDO-144848.exe, 00000002.00000003.115119605785.0000000006B8E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.com
Source: PEDIDO-144848.exe, 00000002.00000003.115119605785.0000000006B8E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown HTTPS traffic detected: 142.250.80.46:443 -> 192.168.11.20:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.251.40.97:443 -> 192.168.11.20:49749 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 0_2_004050F7 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,LdrInitializeThunk,SendMessageA,CreatePopupMenu,LdrInitializeThunk,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,LdrInitializeThunk,SetClipboardData,CloseClipboard, 0_2_004050F7

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 00000004.00000002.117101970998.0000000002D80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.117102256673.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.115570845480.0000000036930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 00000004.00000002.117101970998.0000000002D80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.117102256673.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.115570845480.0000000036930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Contains functionality to call native functions
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C434E0 NtCreateMutant,LdrInitializeThunk, 2_2_36C434E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42EB0 NtProtectVirtualMemory,LdrInitializeThunk, 2_2_36C42EB0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42D10 NtQuerySystemInformation,LdrInitializeThunk, 2_2_36C42D10
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42BC0 NtQueryInformationToken,LdrInitializeThunk, 2_2_36C42BC0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42B90 NtFreeVirtualMemory,LdrInitializeThunk, 2_2_36C42B90
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C44570 NtSuspendThread, 2_2_36C44570
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C44260 NtSetContextThread, 2_2_36C44260
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42EC0 NtQuerySection, 2_2_36C42EC0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42ED0 NtResumeThread, 2_2_36C42ED0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42E80 NtCreateProcessEx, 2_2_36C42E80
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42E50 NtCreateSection, 2_2_36C42E50
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42E00 NtQueueApcThread, 2_2_36C42E00
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42FB0 NtSetValueKey, 2_2_36C42FB0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42F00 NtCreateFile, 2_2_36C42F00
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42F30 NtOpenDirectoryObject, 2_2_36C42F30
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42CD0 NtEnumerateKey, 2_2_36C42CD0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42CF0 NtDelayExecution, 2_2_36C42CF0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C43C90 NtOpenThread, 2_2_36C43C90
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42C50 NtUnmapViewOfSection, 2_2_36C42C50
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42C10 NtOpenProcess, 2_2_36C42C10
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42C20 NtSetInformationFile, 2_2_36C42C20
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C43C30 NtOpenProcessToken, 2_2_36C43C30
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42C30 NtMapViewOfSection, 2_2_36C42C30
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42DC0 NtAdjustPrivilegesToken, 2_2_36C42DC0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42DA0 NtReadVirtualMemory, 2_2_36C42DA0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42D50 NtWriteVirtualMemory, 2_2_36C42D50
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42AC0 NtEnumerateValueKey, 2_2_36C42AC0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42A80 NtClose, 2_2_36C42A80
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42AA0 NtQueryInformationFile, 2_2_36C42AA0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42A10 NtWriteFile, 2_2_36C42A10
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42BE0 NtQueryVirtualMemory, 2_2_36C42BE0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42B80 NtCreateKey, 2_2_36C42B80
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42B00 NtQueryValueKey, 2_2_36C42B00
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42B10 NtAllocateVirtualMemory, 2_2_36C42B10
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42B20 NtQueryInformationProcess, 2_2_36C42B20
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C438D0 NtGetContextThread, 2_2_36C438D0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C429D0 NtWaitForSingleObject, 2_2_36C429D0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C429F0 NtReadFile, 2_2_36C429F0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36913719 NtSuspendThread, 2_2_36913719
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36913A39 NtResumeThread, 2_2_36913A39
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_369133F9 NtSetContextThread, 2_2_369133F9
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A34E0 NtCreateMutant,LdrInitializeThunk, 4_2_030A34E0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2B00 NtQueryValueKey,LdrInitializeThunk, 4_2_030A2B00
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2B10 NtAllocateVirtualMemory,LdrInitializeThunk, 4_2_030A2B10
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2B80 NtCreateKey,LdrInitializeThunk, 4_2_030A2B80
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2B90 NtFreeVirtualMemory,LdrInitializeThunk, 4_2_030A2B90
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2BC0 NtQueryInformationToken,LdrInitializeThunk, 4_2_030A2BC0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2A80 NtClose,LdrInitializeThunk, 4_2_030A2A80
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A29F0 NtReadFile,LdrInitializeThunk, 4_2_030A29F0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2F00 NtCreateFile,LdrInitializeThunk, 4_2_030A2F00
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2E50 NtCreateSection,LdrInitializeThunk, 4_2_030A2E50
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2D10 NtQuerySystemInformation,LdrInitializeThunk, 4_2_030A2D10
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2C30 NtMapViewOfSection,LdrInitializeThunk, 4_2_030A2C30
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2CF0 NtDelayExecution,LdrInitializeThunk, 4_2_030A2CF0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A4260 NtSetContextThread, 4_2_030A4260
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A4570 NtSuspendThread, 4_2_030A4570
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2B20 NtQueryInformationProcess, 4_2_030A2B20
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2BE0 NtQueryVirtualMemory, 4_2_030A2BE0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2A10 NtWriteFile, 4_2_030A2A10
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2AA0 NtQueryInformationFile, 4_2_030A2AA0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2AC0 NtEnumerateValueKey, 4_2_030A2AC0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A29D0 NtWaitForSingleObject, 4_2_030A29D0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A38D0 NtGetContextThread, 4_2_030A38D0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2F30 NtOpenDirectoryObject, 4_2_030A2F30
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2FB0 NtSetValueKey, 4_2_030A2FB0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2E00 NtQueueApcThread, 4_2_030A2E00
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2E80 NtCreateProcessEx, 4_2_030A2E80
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2EB0 NtProtectVirtualMemory, 4_2_030A2EB0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2EC0 NtQuerySection, 4_2_030A2EC0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2ED0 NtResumeThread, 4_2_030A2ED0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2D50 NtWriteVirtualMemory, 4_2_030A2D50
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2DA0 NtReadVirtualMemory, 4_2_030A2DA0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2DC0 NtAdjustPrivilegesToken, 4_2_030A2DC0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2C10 NtOpenProcess, 4_2_030A2C10
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2C20 NtSetInformationFile, 4_2_030A2C20
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A3C30 NtOpenProcessToken, 4_2_030A3C30
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2C50 NtUnmapViewOfSection, 4_2_030A2C50
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A3C90 NtOpenThread, 4_2_030A3C90
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A2CD0 NtEnumerateKey, 4_2_030A2CD0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02EDEEBA NtQueryInformationProcess, 4_2_02EDEEBA
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02EE3A48 NtResumeThread, 4_2_02EE3A48
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02EE3728 NtSuspendThread, 4_2_02EE3728
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02EE3408 NtSetContextThread, 4_2_02EE3408
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02EE3D68 NtQueueApcThread, 4_2_02EE3D68
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 0_2_00403180 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,LdrInitializeThunk,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,LdrInitializeThunk,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403180
Creates files inside the system directory
Source: C:\Users\user\Desktop\PEDIDO-144848.exe File created: C:\Windows\Fonts\prelegacy Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe File created: C:\Windows\Fonts\prelegacy\prster Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 0_2_00404936 0_2_00404936
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CCA6C0 2_2_36CCA6C0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0C6E0 2_2_36C0C6E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C836EC 2_2_36C836EC
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CCF6F6 2_2_36CCF6F6
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10680 2_2_36C10680
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CBD646 2_2_36CBD646
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C34670 2_2_36C34670
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2C600 2_2_36C2C600
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAD62C 2_2_36CAD62C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC6757 2_2_36CC6757
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1A760 2_2_36C1A760
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C12760 2_2_36C12760
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10445 2_2_36C10445
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CCF5C9 2_2_36CCF5C9
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC75C6 2_2_36CC75C6
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CDA526 2_2_36CDA526
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFD2EC 2_2_36BFD2EC
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC124C 2_2_36CC124C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C01380 2_2_36C01380
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1E310 2_2_36C1E310
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CCF330 2_2_36CCF330
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1B0D0 2_2_36C1B0D0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC70F1 2_2_36CC70F1
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C4508C 2_2_36C4508C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C000A0 2_2_36C000A0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CBE076 2_2_36CBE076
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C151C0 2_2_36C151C0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2B1E0 2_2_36C2B1E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C5717A 2_2_36C5717A
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CD010E 2_2_36CD010E
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAD130 2_2_36CAD130
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC9ED2 2_2_36CC9ED2
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C02EE8 2_2_36C02EE8
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC0EAD 2_2_36CC0EAD
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C11EB2 2_2_36C11EB2
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C52E48 2_2_36C52E48
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C30E50 2_2_36C30E50
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CB0E6D 2_2_36CB0E6D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC1FC6 2_2_36CC1FC6
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C16FE0 2_2_36C16FE0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CCEFBF 2_2_36CCEFBF
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CCFF63 2_2_36CCFF63
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1CF00 2_2_36C1CF00
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C28CDF 2_2_36C28CDF
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2FCE0 2_2_36C2FCE0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CDACEB 2_2_36CDACEB
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CA9C98 2_2_36CA9C98
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CBEC4C 2_2_36CBEC4C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C13C60 2_2_36C13C60
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC6C69 2_2_36CC6C69
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CCEC60 2_2_36CCEC60
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C00C12 2_2_36C00C12
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1AC20 2_2_36C1AC20
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C19DD0 2_2_36C19DD0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAFDF4 2_2_36CAFDF4
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C22DB0 2_2_36C22DB0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC7D4C 2_2_36CC7D4C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10D69 2_2_36C10D69
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0AD00 2_2_36C0AD00
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CCFD27 2_2_36CCFD27
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CCFA89 2_2_36CCFA89
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2FAA0 2_2_36C2FAA0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CCEA5B 2_2_36CCEA5B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CCCA13 2_2_36CCCA13
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C84BC0 2_2_36C84BC0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10B10 2_2_36C10B10
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C4DB19 2_2_36C4DB19
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CCFB2E 2_2_36CCFB2E
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C128C0 2_2_36C128C0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC18DA 2_2_36CC18DA
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC78F3 2_2_36CC78F3
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C26882 2_2_36C26882
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C898B2 2_2_36C898B2
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C19870 2_2_36C19870
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2B870 2_2_36C2B870
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CCF872 2_2_36CCF872
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C13800 2_2_36C13800
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3E810 2_2_36C3E810
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF6868 2_2_36BF6868
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CB0835 2_2_36CB0835
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C559C0 2_2_36C559C0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0E9A0 2_2_36C0E9A0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CCE9A6 2_2_36CCE9A6
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_3690E69D 2_2_3690E69D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_3690D708 2_2_3690D708
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_3690E46D 2_2_3690E46D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_3690E307 2_2_3690E307
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_3690C9B8 2_2_3690C9B8
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_369151E4 2_2_369151E4
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_3690E1E8 2_2_3690E1E8
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0307E310 4_2_0307E310
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0312F330 4_2_0312F330
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03061380 4_2_03061380
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0312124C 4_2_0312124C
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0305D2EC 4_2_0305D2EC
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0305F113 4_2_0305F113
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0313010E 4_2_0313010E
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0310D130 4_2_0310D130
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030B717A 4_2_030B717A
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030751C0 4_2_030751C0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0308B1E0 4_2_0308B1E0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0311E076 4_2_0311E076
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030A508C 4_2_030A508C
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030600A0 4_2_030600A0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0307B0D0 4_2_0307B0D0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_031270F1 4_2_031270F1
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03126757 4_2_03126757
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03072760 4_2_03072760
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0307A760 4_2_0307A760
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0308C600 4_2_0308C600
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0310D62C 4_2_0310D62C
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0311D646 4_2_0311D646
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03094670 4_2_03094670
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03070680 4_2_03070680
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0312A6C0 4_2_0312A6C0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030E36EC 4_2_030E36EC
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0312F6F6 4_2_0312F6F6
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0306C6E0 4_2_0306C6E0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0313A526 4_2_0313A526
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_031275C6 4_2_031275C6
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0312F5C9 4_2_0312F5C9
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03070445 4_2_03070445
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030DD480 4_2_030DD480
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030ADB19 4_2_030ADB19
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03070B10 4_2_03070B10
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0312FB2E 4_2_0312FB2E
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030E4BC0 4_2_030E4BC0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0312CA13 4_2_0312CA13
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0312EA5B 4_2_0312EA5B
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0312FA89 4_2_0312FA89
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0308FAA0 4_2_0308FAA0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0306E9A0 4_2_0306E9A0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0312E9A6 4_2_0312E9A6
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030B59C0 4_2_030B59C0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03073800 4_2_03073800
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0309E810 4_2_0309E810
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03110835 4_2_03110835
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0312F872 4_2_0312F872
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03056868 4_2_03056868
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03079870 4_2_03079870
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0308B870 4_2_0308B870
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030E5870 4_2_030E5870
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03086882 4_2_03086882
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030E98B2 4_2_030E98B2
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030728C0 4_2_030728C0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_031218DA 4_2_031218DA
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_031278F3 4_2_031278F3
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0307CF00 4_2_0307CF00
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0312FF63 4_2_0312FF63
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0312EFBF 4_2_0312EFBF
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03121FC6 4_2_03121FC6
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03076FE0 4_2_03076FE0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030B2E48 4_2_030B2E48
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03090E50 4_2_03090E50
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03110E6D 4_2_03110E6D
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03071EB2 4_2_03071EB2
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03120EAD 4_2_03120EAD
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03129ED2 4_2_03129ED2
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03062EE8 4_2_03062EE8
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0306AD00 4_2_0306AD00
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0312FD27 4_2_0312FD27
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03127D4C 4_2_03127D4C
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03070D69 4_2_03070D69
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03082DB0 4_2_03082DB0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03079DD0 4_2_03079DD0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0310FDF4 4_2_0310FDF4
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03060C12 4_2_03060C12
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0307AC20 4_2_0307AC20
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0311EC4C 4_2_0311EC4C
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03073C60 4_2_03073C60
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0312EC60 4_2_0312EC60
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03126C69 4_2_03126C69
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03109C98 4_2_03109C98
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_03088CDF 4_2_03088CDF
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030F7CE8 4_2_030F7CE8
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0308FCE0 4_2_0308FCE0
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_0313ACEB 4_2_0313ACEB
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02EDEEBA 4_2_02EDEEBA
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02EDE307 4_2_02EDE307
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02EDE1E8 4_2_02EDE1E8
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02EDC9B3 4_2_02EDC9B3
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02EDE69D 4_2_02EDE69D
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02EDD708 4_2_02EDD708
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02EDE46D 4_2_02EDE46D
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: String function: 030DE692 appears 86 times
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: String function: 030EEF10 appears 105 times
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: String function: 030B7BE4 appears 96 times
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: String function: 0305B910 appears 268 times
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: String function: 030A5050 appears 36 times
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: String function: 36C7E692 appears 84 times
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: String function: 36C8EF10 appears 105 times
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: String function: 36C45050 appears 36 times
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: String function: 36C57BE4 appears 88 times
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: String function: 36BFB910 appears 254 times
PE / OLE file has an invalid certificate
Source: PEDIDO-144848.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: PEDIDO-144848.exe, 00000002.00000003.115459604949.000000003699F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs PEDIDO-144848.exe
Source: PEDIDO-144848.exe, 00000002.00000003.115463317086.0000000036B51000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs PEDIDO-144848.exe
Source: PEDIDO-144848.exe, 00000002.00000003.115513057373.0000000006BE0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSeCEditj% vs PEDIDO-144848.exe
Source: PEDIDO-144848.exe, 00000002.00000002.115570937750.0000000036EA0000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs PEDIDO-144848.exe
Source: PEDIDO-144848.exe, 00000002.00000002.115570937750.0000000036CFD000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs PEDIDO-144848.exe
Uses 32bit PE files
Source: PEDIDO-144848.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Yara signature match
Source: 00000004.00000002.117101970998.0000000002D80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.117102256673.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.115570845480.0000000036930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: classification engine Classification label: mal96.troj.evad.winEXE@5/7@2/2
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 0_2_00403180 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,LdrInitializeThunk,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,LdrInitializeThunk,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403180
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 0_2_004043C3 GetDlgItem,SetWindowTextA,LdrInitializeThunk,LdrInitializeThunk,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,LdrInitializeThunk,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 0_2_004043C3
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 0_2_004020CD LdrInitializeThunk,CoCreateInstance,MultiByteToWideChar,LdrInitializeThunk, 0_2_004020CD
Source: C:\Users\user\Desktop\PEDIDO-144848.exe File created: C:\Program Files (x86)\Fljtenists.ini Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe File created: C:\Users\user\slavelivets Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe File created: C:\Users\user\AppData\Local\Temp\nsu7B62.tmp Jump to behavior
Source: PEDIDO-144848.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\PEDIDO-144848.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: PEDIDO-144848.exe ReversingLabs: Detection: 23%
Source: C:\Users\user\Desktop\PEDIDO-144848.exe File read: C:\Users\user\Desktop\PEDIDO-144848.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\PEDIDO-144848.exe "C:\Users\user\Desktop\PEDIDO-144848.exe"
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Process created: C:\Users\user\Desktop\PEDIDO-144848.exe "C:\Users\user\Desktop\PEDIDO-144848.exe"
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Process created: C:\Windows\SysWOW64\SecEdit.exe "C:\Windows\SysWOW64\SecEdit.exe"
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Process created: C:\Users\user\Desktop\PEDIDO-144848.exe "C:\Users\user\Desktop\PEDIDO-144848.exe" Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Process created: C:\Windows\SysWOW64\SecEdit.exe "C:\Windows\SysWOW64\SecEdit.exe" Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe Section loaded: scecli.dll Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe File written: C:\Program Files (x86)\Fljtenists.ini Jump to behavior
Source: PEDIDO-144848.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: SecEdit.pdb source: PEDIDO-144848.exe, 00000002.00000003.115513057373.0000000006BE0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mshtml.pdb source: PEDIDO-144848.exe, 00000002.00000001.115003799007.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source: Binary string: SecEdit.pdbGCTL source: PEDIDO-144848.exe, 00000002.00000003.115513057373.0000000006BE0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: PEDIDO-144848.exe, 00000002.00000003.115463317086.0000000036A24000.00000004.00000020.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000003.115459604949.000000003687C000.00000004.00000020.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000002.115570937750.0000000036BD0000.00000040.00001000.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000002.115570937750.0000000036CFD000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: PEDIDO-144848.exe, PEDIDO-144848.exe, 00000002.00000003.115463317086.0000000036A24000.00000004.00000020.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000003.115459604949.000000003687C000.00000004.00000020.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000002.115570937750.0000000036BD0000.00000040.00001000.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000002.115570937750.0000000036CFD000.00000040.00001000.00020000.00000000.sdmp, SecEdit.exe
Source: Binary string: mshtml.pdbUGP source: PEDIDO-144848.exe, 00000002.00000001.115003799007.0000000000649000.00000020.00000001.01000000.00000006.sdmp

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000002.00000002.115544134516.00000000017B8000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.115152353454.0000000002ED8000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA, 0_2_10001A5D
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 0_2_10002D20 push eax; ret 0_2_10002D4E
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C008CD push ecx; mov dword ptr [esp], ecx 2_2_36C008D6
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36903E36 push edi; ret 2_2_36903E38
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36910637 push esp; retf 2_2_369105D9
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36904657 push ecx; ret 2_2_36904674
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36904643 push ecx; ret 2_2_36904674
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36904407 pushfd ; ret 2_2_36904408
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36900DB3 push ebx; iretd 2_2_36900DB4
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_369105A8 push esp; retf 2_2_369105D9
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36900DD3 push ds; ret 2_2_36900DD4
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36904AD6 push esp; retf 2_2_36904AAD
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36904A18 push esp; retf 2_2_36904AAD
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_369103DF push es; iretd 2_2_369103E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_3690C8AA push esi; iretd 2_2_3690C8AD
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36915032 push eax; ret 2_2_36915034
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_369151E4 push eax; retf 0000h 2_2_369156A5
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36910963 push eax; retf 2_2_36910968
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_030608CD push ecx; mov dword ptr [esp], ecx 4_2_030608D6
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02ED4AD6 push esp; retf 4_2_02ED4AAD
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02EDB2B8 push edi; retf 42F6h 4_2_02EDB325
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02ED4A0A push esp; retf 4_2_02ED4AAD
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02EDC8AA push esi; iretd 4_2_02EDC8AD
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02EDB89A pushfd ; ret 4_2_02EDB8B2
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02EDB828 pushfd ; ret 4_2_02EDB8B2
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02EE5032 push eax; ret 4_2_02EE5034
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02ED4643 push ecx; ret 4_2_02ED4674
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02ED4657 push ecx; ret 4_2_02ED4674
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02ED3E36 push edi; ret 4_2_02ED3E38
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02ED4407 pushfd ; ret 4_2_02ED4408
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02ED0DD3 push ds; ret 4_2_02ED0DD4
Source: C:\Windows\SysWOW64\SecEdit.exe Code function: 4_2_02ED0DB3 push ebx; iretd 4_2_02ED0DB4
Drops PE files
Source: C:\Users\user\Desktop\PEDIDO-144848.exe File created: C:\Users\user\AppData\Local\Temp\nsk7B73.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Switches to a custom stack to bypass stack traces
Source: C:\Users\user\Desktop\PEDIDO-144848.exe API/Special instruction interceptor: Address: 317A77D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe API/Special instruction interceptor: Address: 1A5A77D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe API/Special instruction interceptor: Address: 7FFE96ED0594
Source: C:\Users\user\Desktop\PEDIDO-144848.exe API/Special instruction interceptor: Address: 7FFE96ECFF74
Source: C:\Users\user\Desktop\PEDIDO-144848.exe API/Special instruction interceptor: Address: 7FFE96ECD6C4
Source: C:\Users\user\Desktop\PEDIDO-144848.exe API/Special instruction interceptor: Address: 7FFE96ECD864
Source: C:\Windows\SysWOW64\SecEdit.exe API/Special instruction interceptor: Address: 7FFE96ECD144
Source: C:\Windows\SysWOW64\SecEdit.exe API/Special instruction interceptor: Address: 7FFE96ED0594
Source: C:\Windows\SysWOW64\SecEdit.exe API/Special instruction interceptor: Address: 7FFE96ECD764
Source: C:\Windows\SysWOW64\SecEdit.exe API/Special instruction interceptor: Address: 7FFE96ECD324
Source: C:\Windows\SysWOW64\SecEdit.exe API/Special instruction interceptor: Address: 7FFE96ECD364
Source: C:\Windows\SysWOW64\SecEdit.exe API/Special instruction interceptor: Address: 7FFE96ECD004
Source: C:\Windows\SysWOW64\SecEdit.exe API/Special instruction interceptor: Address: 7FFE96ECFF74
Source: C:\Windows\SysWOW64\SecEdit.exe API/Special instruction interceptor: Address: 7FFE96ECD6C4
Source: C:\Windows\SysWOW64\SecEdit.exe API/Special instruction interceptor: Address: 7FFE96ECD864
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C41763 rdtsc 2_2_36C41763
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\SecEdit.exe Window / User API: threadDelayed 9852 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 881 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 877 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsk7B73.tmp\System.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\PEDIDO-144848.exe API coverage: 0.3 %
Source: C:\Windows\SysWOW64\SecEdit.exe API coverage: 1.1 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\SecEdit.exe TID: 3104 Thread sleep count: 122 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe TID: 3104 Thread sleep time: -244000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe TID: 3104 Thread sleep count: 9852 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe TID: 3104 Thread sleep time: -19704000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\SecEdit.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\SecEdit.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 0_2_00405642 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 0_2_00405642
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 0_2_004060A4 FindFirstFileA,FindClose, 0_2_004060A4
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 0_2_0040270B FindFirstFileA, 0_2_0040270B
Source: PEDIDO-144848.exe, 00000002.00000003.115460520041.0000000006B3C000.00000004.00000020.00020000.00000000.sdmp, PEDIDO-144848.exe, 00000002.00000003.115460098433.0000000006B73000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: C:\Users\user\Desktop\PEDIDO-144848.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\PEDIDO-144848.exe API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\SecEdit.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\SecEdit.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C41763 rdtsc 2_2_36C41763
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 0_2_00401759 lstrcatA,CompareFileTime,LdrInitializeThunk,SetFileTime,CloseHandle,lstrcatA, 0_2_00401759
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA, 0_2_10001A5D
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CA86C2 mov eax, dword ptr fs:[00000030h] 2_2_36CA86C2
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CCA6C0 mov eax, dword ptr fs:[00000030h] 2_2_36CCA6C0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C006CF mov eax, dword ptr fs:[00000030h] 2_2_36C006CF
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2D6D0 mov eax, dword ptr fs:[00000030h] 2_2_36C2D6D0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0C6E0 mov eax, dword ptr fs:[00000030h] 2_2_36C0C6E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C056E0 mov eax, dword ptr fs:[00000030h] 2_2_36C056E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C056E0 mov eax, dword ptr fs:[00000030h] 2_2_36C056E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C056E0 mov eax, dword ptr fs:[00000030h] 2_2_36C056E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C266E0 mov eax, dword ptr fs:[00000030h] 2_2_36C266E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C266E0 mov eax, dword ptr fs:[00000030h] 2_2_36C266E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C7C6F2 mov eax, dword ptr fs:[00000030h] 2_2_36C7C6F2
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C7C6F2 mov eax, dword ptr fs:[00000030h] 2_2_36C7C6F2
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10680 mov eax, dword ptr fs:[00000030h] 2_2_36C10680
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10680 mov eax, dword ptr fs:[00000030h] 2_2_36C10680
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10680 mov eax, dword ptr fs:[00000030h] 2_2_36C10680
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10680 mov eax, dword ptr fs:[00000030h] 2_2_36C10680
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10680 mov eax, dword ptr fs:[00000030h] 2_2_36C10680
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10680 mov eax, dword ptr fs:[00000030h] 2_2_36C10680
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10680 mov eax, dword ptr fs:[00000030h] 2_2_36C10680
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10680 mov eax, dword ptr fs:[00000030h] 2_2_36C10680
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10680 mov eax, dword ptr fs:[00000030h] 2_2_36C10680
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10680 mov eax, dword ptr fs:[00000030h] 2_2_36C10680
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10680 mov eax, dword ptr fs:[00000030h] 2_2_36C10680
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10680 mov eax, dword ptr fs:[00000030h] 2_2_36C10680
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CBF68C mov eax, dword ptr fs:[00000030h] 2_2_36CBF68C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C08690 mov eax, dword ptr fs:[00000030h] 2_2_36C08690
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C8C691 mov eax, dword ptr fs:[00000030h] 2_2_36C8C691
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF96E0 mov eax, dword ptr fs:[00000030h] 2_2_36BF96E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF96E0 mov eax, dword ptr fs:[00000030h] 2_2_36BF96E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC86A8 mov eax, dword ptr fs:[00000030h] 2_2_36CC86A8
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC86A8 mov eax, dword ptr fs:[00000030h] 2_2_36CC86A8
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C03640 mov eax, dword ptr fs:[00000030h] 2_2_36C03640
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1F640 mov eax, dword ptr fs:[00000030h] 2_2_36C1F640
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1F640 mov eax, dword ptr fs:[00000030h] 2_2_36C1F640
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1F640 mov eax, dword ptr fs:[00000030h] 2_2_36C1F640
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3C640 mov eax, dword ptr fs:[00000030h] 2_2_36C3C640
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3C640 mov eax, dword ptr fs:[00000030h] 2_2_36C3C640
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C35654 mov eax, dword ptr fs:[00000030h] 2_2_36C35654
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0965A mov eax, dword ptr fs:[00000030h] 2_2_36C0965A
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0965A mov eax, dword ptr fs:[00000030h] 2_2_36C0965A
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3265C mov eax, dword ptr fs:[00000030h] 2_2_36C3265C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3265C mov ecx, dword ptr fs:[00000030h] 2_2_36C3265C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3265C mov eax, dword ptr fs:[00000030h] 2_2_36C3265C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C13660 mov eax, dword ptr fs:[00000030h] 2_2_36C13660
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C13660 mov eax, dword ptr fs:[00000030h] 2_2_36C13660
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C13660 mov eax, dword ptr fs:[00000030h] 2_2_36C13660
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3666D mov esi, dword ptr fs:[00000030h] 2_2_36C3666D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3666D mov eax, dword ptr fs:[00000030h] 2_2_36C3666D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3666D mov eax, dword ptr fs:[00000030h] 2_2_36C3666D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C00670 mov eax, dword ptr fs:[00000030h] 2_2_36C00670
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42670 mov eax, dword ptr fs:[00000030h] 2_2_36C42670
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42670 mov eax, dword ptr fs:[00000030h] 2_2_36C42670
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C93608 mov eax, dword ptr fs:[00000030h] 2_2_36C93608
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C93608 mov eax, dword ptr fs:[00000030h] 2_2_36C93608
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C93608 mov eax, dword ptr fs:[00000030h] 2_2_36C93608
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C93608 mov eax, dword ptr fs:[00000030h] 2_2_36C93608
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C93608 mov eax, dword ptr fs:[00000030h] 2_2_36C93608
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C93608 mov eax, dword ptr fs:[00000030h] 2_2_36C93608
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2D600 mov eax, dword ptr fs:[00000030h] 2_2_36C2D600
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2D600 mov eax, dword ptr fs:[00000030h] 2_2_36C2D600
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CBF607 mov eax, dword ptr fs:[00000030h] 2_2_36CBF607
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3360F mov eax, dword ptr fs:[00000030h] 2_2_36C3360F
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CD4600 mov eax, dword ptr fs:[00000030h] 2_2_36CD4600
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF7662 mov eax, dword ptr fs:[00000030h] 2_2_36BF7662
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF7662 mov eax, dword ptr fs:[00000030h] 2_2_36BF7662
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF7662 mov eax, dword ptr fs:[00000030h] 2_2_36BF7662
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C05622 mov eax, dword ptr fs:[00000030h] 2_2_36C05622
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C05622 mov eax, dword ptr fs:[00000030h] 2_2_36C05622
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3C620 mov eax, dword ptr fs:[00000030h] 2_2_36C3C620
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAD62C mov ecx, dword ptr fs:[00000030h] 2_2_36CAD62C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAD62C mov ecx, dword ptr fs:[00000030h] 2_2_36CAD62C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAD62C mov eax, dword ptr fs:[00000030h] 2_2_36CAD62C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C00630 mov eax, dword ptr fs:[00000030h] 2_2_36C00630
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C30630 mov eax, dword ptr fs:[00000030h] 2_2_36C30630
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFD64A mov eax, dword ptr fs:[00000030h] 2_2_36BFD64A
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFD64A mov eax, dword ptr fs:[00000030h] 2_2_36BFD64A
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C88633 mov esi, dword ptr fs:[00000030h] 2_2_36C88633
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C88633 mov eax, dword ptr fs:[00000030h] 2_2_36C88633
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C88633 mov eax, dword ptr fs:[00000030h] 2_2_36C88633
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3F63F mov eax, dword ptr fs:[00000030h] 2_2_36C3F63F
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3F63F mov eax, dword ptr fs:[00000030h] 2_2_36C3F63F
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CBF7CF mov eax, dword ptr fs:[00000030h] 2_2_36CBF7CF
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2E7E0 mov eax, dword ptr fs:[00000030h] 2_2_36C2E7E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C037E4 mov eax, dword ptr fs:[00000030h] 2_2_36C037E4
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C037E4 mov eax, dword ptr fs:[00000030h] 2_2_36C037E4
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C037E4 mov eax, dword ptr fs:[00000030h] 2_2_36C037E4
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C037E4 mov eax, dword ptr fs:[00000030h] 2_2_36C037E4
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C037E4 mov eax, dword ptr fs:[00000030h] 2_2_36C037E4
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C037E4 mov eax, dword ptr fs:[00000030h] 2_2_36C037E4
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C037E4 mov eax, dword ptr fs:[00000030h] 2_2_36C037E4
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CDB781 mov eax, dword ptr fs:[00000030h] 2_2_36CDB781
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CDB781 mov eax, dword ptr fs:[00000030h] 2_2_36CDB781
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C31796 mov eax, dword ptr fs:[00000030h] 2_2_36C31796
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C31796 mov eax, dword ptr fs:[00000030h] 2_2_36C31796
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C7E79D mov eax, dword ptr fs:[00000030h] 2_2_36C7E79D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C7E79D mov eax, dword ptr fs:[00000030h] 2_2_36C7E79D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C7E79D mov eax, dword ptr fs:[00000030h] 2_2_36C7E79D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C7E79D mov eax, dword ptr fs:[00000030h] 2_2_36C7E79D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C7E79D mov eax, dword ptr fs:[00000030h] 2_2_36C7E79D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C7E79D mov eax, dword ptr fs:[00000030h] 2_2_36C7E79D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C7E79D mov eax, dword ptr fs:[00000030h] 2_2_36C7E79D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C7E79D mov eax, dword ptr fs:[00000030h] 2_2_36C7E79D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C7E79D mov eax, dword ptr fs:[00000030h] 2_2_36C7E79D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C007A7 mov eax, dword ptr fs:[00000030h] 2_2_36C007A7
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CCD7A7 mov eax, dword ptr fs:[00000030h] 2_2_36CCD7A7
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CCD7A7 mov eax, dword ptr fs:[00000030h] 2_2_36CCD7A7
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CCD7A7 mov eax, dword ptr fs:[00000030h] 2_2_36CCD7A7
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CD17BC mov eax, dword ptr fs:[00000030h] 2_2_36CD17BC
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C33740 mov eax, dword ptr fs:[00000030h] 2_2_36C33740
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3174A mov eax, dword ptr fs:[00000030h] 2_2_36C3174A
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3A750 mov eax, dword ptr fs:[00000030h] 2_2_36C3A750
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C22755 mov eax, dword ptr fs:[00000030h] 2_2_36C22755
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C22755 mov eax, dword ptr fs:[00000030h] 2_2_36C22755
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C22755 mov eax, dword ptr fs:[00000030h] 2_2_36C22755
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C22755 mov ecx, dword ptr fs:[00000030h] 2_2_36C22755
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C22755 mov eax, dword ptr fs:[00000030h] 2_2_36C22755
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C22755 mov eax, dword ptr fs:[00000030h] 2_2_36C22755
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAE750 mov eax, dword ptr fs:[00000030h] 2_2_36CAE750
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C12760 mov ecx, dword ptr fs:[00000030h] 2_2_36C12760
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C41763 mov eax, dword ptr fs:[00000030h] 2_2_36C41763
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C41763 mov eax, dword ptr fs:[00000030h] 2_2_36C41763
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C41763 mov eax, dword ptr fs:[00000030h] 2_2_36C41763
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C41763 mov eax, dword ptr fs:[00000030h] 2_2_36C41763
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C41763 mov eax, dword ptr fs:[00000030h] 2_2_36C41763
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C41763 mov eax, dword ptr fs:[00000030h] 2_2_36C41763
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C30774 mov eax, dword ptr fs:[00000030h] 2_2_36C30774
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C04779 mov eax, dword ptr fs:[00000030h] 2_2_36C04779
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C04779 mov eax, dword ptr fs:[00000030h] 2_2_36C04779
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFB705 mov eax, dword ptr fs:[00000030h] 2_2_36BFB705
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFB705 mov eax, dword ptr fs:[00000030h] 2_2_36BFB705
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFB705 mov eax, dword ptr fs:[00000030h] 2_2_36BFB705
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFB705 mov eax, dword ptr fs:[00000030h] 2_2_36BFB705
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0D700 mov ecx, dword ptr fs:[00000030h] 2_2_36C0D700
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC970B mov eax, dword ptr fs:[00000030h] 2_2_36CC970B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC970B mov eax, dword ptr fs:[00000030h] 2_2_36CC970B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2270D mov eax, dword ptr fs:[00000030h] 2_2_36C2270D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2270D mov eax, dword ptr fs:[00000030h] 2_2_36C2270D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2270D mov eax, dword ptr fs:[00000030h] 2_2_36C2270D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0471B mov eax, dword ptr fs:[00000030h] 2_2_36C0471B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0471B mov eax, dword ptr fs:[00000030h] 2_2_36C0471B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CBF717 mov eax, dword ptr fs:[00000030h] 2_2_36CBF717
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C29723 mov eax, dword ptr fs:[00000030h] 2_2_36C29723
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFF75B mov eax, dword ptr fs:[00000030h] 2_2_36BFF75B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFF75B mov eax, dword ptr fs:[00000030h] 2_2_36BFF75B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFF75B mov eax, dword ptr fs:[00000030h] 2_2_36BFF75B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFF75B mov eax, dword ptr fs:[00000030h] 2_2_36BFF75B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFF75B mov eax, dword ptr fs:[00000030h] 2_2_36BFF75B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFF75B mov eax, dword ptr fs:[00000030h] 2_2_36BFF75B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFF75B mov eax, dword ptr fs:[00000030h] 2_2_36BFF75B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFF75B mov eax, dword ptr fs:[00000030h] 2_2_36BFF75B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFF75B mov eax, dword ptr fs:[00000030h] 2_2_36BFF75B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C214C9 mov eax, dword ptr fs:[00000030h] 2_2_36C214C9
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C214C9 mov eax, dword ptr fs:[00000030h] 2_2_36C214C9
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C214C9 mov eax, dword ptr fs:[00000030h] 2_2_36C214C9
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C214C9 mov eax, dword ptr fs:[00000030h] 2_2_36C214C9
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C214C9 mov eax, dword ptr fs:[00000030h] 2_2_36C214C9
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2F4D0 mov eax, dword ptr fs:[00000030h] 2_2_36C2F4D0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2F4D0 mov eax, dword ptr fs:[00000030h] 2_2_36C2F4D0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2F4D0 mov eax, dword ptr fs:[00000030h] 2_2_36C2F4D0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2F4D0 mov eax, dword ptr fs:[00000030h] 2_2_36C2F4D0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2F4D0 mov eax, dword ptr fs:[00000030h] 2_2_36C2F4D0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2F4D0 mov eax, dword ptr fs:[00000030h] 2_2_36C2F4D0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2F4D0 mov eax, dword ptr fs:[00000030h] 2_2_36C2F4D0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2F4D0 mov eax, dword ptr fs:[00000030h] 2_2_36C2F4D0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2F4D0 mov eax, dword ptr fs:[00000030h] 2_2_36C2F4D0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C244D1 mov eax, dword ptr fs:[00000030h] 2_2_36C244D1
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C244D1 mov eax, dword ptr fs:[00000030h] 2_2_36C244D1
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C354E0 mov eax, dword ptr fs:[00000030h] 2_2_36C354E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3E4EF mov eax, dword ptr fs:[00000030h] 2_2_36C3E4EF
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3E4EF mov eax, dword ptr fs:[00000030h] 2_2_36C3E4EF
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C064F0 mov eax, dword ptr fs:[00000030h] 2_2_36C064F0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3A4F0 mov eax, dword ptr fs:[00000030h] 2_2_36C3A4F0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3A4F0 mov eax, dword ptr fs:[00000030h] 2_2_36C3A4F0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CBF4FD mov eax, dword ptr fs:[00000030h] 2_2_36CBF4FD
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C294FA mov eax, dword ptr fs:[00000030h] 2_2_36C294FA
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C00485 mov ecx, dword ptr fs:[00000030h] 2_2_36C00485
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3648A mov eax, dword ptr fs:[00000030h] 2_2_36C3648A
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3648A mov eax, dword ptr fs:[00000030h] 2_2_36C3648A
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3648A mov eax, dword ptr fs:[00000030h] 2_2_36C3648A
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3B490 mov eax, dword ptr fs:[00000030h] 2_2_36C3B490
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3B490 mov eax, dword ptr fs:[00000030h] 2_2_36C3B490
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C8C490 mov eax, dword ptr fs:[00000030h] 2_2_36C8C490
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C024A2 mov eax, dword ptr fs:[00000030h] 2_2_36C024A2
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C024A2 mov ecx, dword ptr fs:[00000030h] 2_2_36C024A2
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C8D4A0 mov ecx, dword ptr fs:[00000030h] 2_2_36C8D4A0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C8D4A0 mov eax, dword ptr fs:[00000030h] 2_2_36C8D4A0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C8D4A0 mov eax, dword ptr fs:[00000030h] 2_2_36C8D4A0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C344A8 mov eax, dword ptr fs:[00000030h] 2_2_36C344A8
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3E4BC mov eax, dword ptr fs:[00000030h] 2_2_36C3E4BC
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10445 mov eax, dword ptr fs:[00000030h] 2_2_36C10445
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10445 mov eax, dword ptr fs:[00000030h] 2_2_36C10445
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10445 mov eax, dword ptr fs:[00000030h] 2_2_36C10445
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10445 mov eax, dword ptr fs:[00000030h] 2_2_36C10445
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10445 mov eax, dword ptr fs:[00000030h] 2_2_36C10445
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C10445 mov eax, dword ptr fs:[00000030h] 2_2_36C10445
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3D450 mov eax, dword ptr fs:[00000030h] 2_2_36C3D450
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3D450 mov eax, dword ptr fs:[00000030h] 2_2_36C3D450
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0D454 mov eax, dword ptr fs:[00000030h] 2_2_36C0D454
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0D454 mov eax, dword ptr fs:[00000030h] 2_2_36C0D454
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0D454 mov eax, dword ptr fs:[00000030h] 2_2_36C0D454
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0D454 mov eax, dword ptr fs:[00000030h] 2_2_36C0D454
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0D454 mov eax, dword ptr fs:[00000030h] 2_2_36C0D454
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0D454 mov eax, dword ptr fs:[00000030h] 2_2_36C0D454
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2E45E mov eax, dword ptr fs:[00000030h] 2_2_36C2E45E
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2E45E mov eax, dword ptr fs:[00000030h] 2_2_36C2E45E
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2E45E mov eax, dword ptr fs:[00000030h] 2_2_36C2E45E
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2E45E mov eax, dword ptr fs:[00000030h] 2_2_36C2E45E
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2E45E mov eax, dword ptr fs:[00000030h] 2_2_36C2E45E
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFB420 mov eax, dword ptr fs:[00000030h] 2_2_36BFB420
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CCA464 mov eax, dword ptr fs:[00000030h] 2_2_36CCA464
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C08470 mov eax, dword ptr fs:[00000030h] 2_2_36C08470
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C08470 mov eax, dword ptr fs:[00000030h] 2_2_36C08470
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF640D mov eax, dword ptr fs:[00000030h] 2_2_36BF640D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CBF478 mov eax, dword ptr fs:[00000030h] 2_2_36CBF478
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CBF409 mov eax, dword ptr fs:[00000030h] 2_2_36CBF409
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C96400 mov eax, dword ptr fs:[00000030h] 2_2_36C96400
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C96400 mov eax, dword ptr fs:[00000030h] 2_2_36C96400
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C89429 mov eax, dword ptr fs:[00000030h] 2_2_36C89429
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C37425 mov eax, dword ptr fs:[00000030h] 2_2_36C37425
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C37425 mov ecx, dword ptr fs:[00000030h] 2_2_36C37425
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C8F42F mov eax, dword ptr fs:[00000030h] 2_2_36C8F42F
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C8F42F mov eax, dword ptr fs:[00000030h] 2_2_36C8F42F
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C8F42F mov eax, dword ptr fs:[00000030h] 2_2_36C8F42F
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C8F42F mov eax, dword ptr fs:[00000030h] 2_2_36C8F42F
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C8F42F mov eax, dword ptr fs:[00000030h] 2_2_36C8F42F
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3C5C6 mov eax, dword ptr fs:[00000030h] 2_2_36C3C5C6
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C805C6 mov eax, dword ptr fs:[00000030h] 2_2_36C805C6
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C365D0 mov eax, dword ptr fs:[00000030h] 2_2_36C365D0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0B5E0 mov eax, dword ptr fs:[00000030h] 2_2_36C0B5E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0B5E0 mov eax, dword ptr fs:[00000030h] 2_2_36C0B5E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0B5E0 mov eax, dword ptr fs:[00000030h] 2_2_36C0B5E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0B5E0 mov eax, dword ptr fs:[00000030h] 2_2_36C0B5E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0B5E0 mov eax, dword ptr fs:[00000030h] 2_2_36C0B5E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0B5E0 mov eax, dword ptr fs:[00000030h] 2_2_36C0B5E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3A5E7 mov ebx, dword ptr fs:[00000030h] 2_2_36C3A5E7
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3A5E7 mov eax, dword ptr fs:[00000030h] 2_2_36C3A5E7
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C315EF mov eax, dword ptr fs:[00000030h] 2_2_36C315EF
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C8C5FC mov eax, dword ptr fs:[00000030h] 2_2_36C8C5FC
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3A580 mov eax, dword ptr fs:[00000030h] 2_2_36C3A580
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3A580 mov eax, dword ptr fs:[00000030h] 2_2_36C3A580
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C39580 mov eax, dword ptr fs:[00000030h] 2_2_36C39580
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C39580 mov eax, dword ptr fs:[00000030h] 2_2_36C39580
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CBF582 mov eax, dword ptr fs:[00000030h] 2_2_36CBF582
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C7E588 mov eax, dword ptr fs:[00000030h] 2_2_36C7E588
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C7E588 mov eax, dword ptr fs:[00000030h] 2_2_36C7E588
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C32594 mov eax, dword ptr fs:[00000030h] 2_2_36C32594
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C8C592 mov eax, dword ptr fs:[00000030h] 2_2_36C8C592
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C885AA mov eax, dword ptr fs:[00000030h] 2_2_36C885AA
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C045B0 mov eax, dword ptr fs:[00000030h] 2_2_36C045B0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C045B0 mov eax, dword ptr fs:[00000030h] 2_2_36C045B0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFF5C7 mov eax, dword ptr fs:[00000030h] 2_2_36BFF5C7
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFF5C7 mov eax, dword ptr fs:[00000030h] 2_2_36BFF5C7
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFF5C7 mov eax, dword ptr fs:[00000030h] 2_2_36BFF5C7
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFF5C7 mov eax, dword ptr fs:[00000030h] 2_2_36BFF5C7
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFF5C7 mov eax, dword ptr fs:[00000030h] 2_2_36BFF5C7
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFF5C7 mov eax, dword ptr fs:[00000030h] 2_2_36BFF5C7
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFF5C7 mov eax, dword ptr fs:[00000030h] 2_2_36BFF5C7
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFF5C7 mov eax, dword ptr fs:[00000030h] 2_2_36BFF5C7
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFF5C7 mov eax, dword ptr fs:[00000030h] 2_2_36BFF5C7
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF753F mov eax, dword ptr fs:[00000030h] 2_2_36BF753F
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF753F mov eax, dword ptr fs:[00000030h] 2_2_36BF753F
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF753F mov eax, dword ptr fs:[00000030h] 2_2_36BF753F
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C36540 mov eax, dword ptr fs:[00000030h] 2_2_36C36540
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C38540 mov eax, dword ptr fs:[00000030h] 2_2_36C38540
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1E547 mov eax, dword ptr fs:[00000030h] 2_2_36C1E547
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0754C mov eax, dword ptr fs:[00000030h] 2_2_36C0754C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0254C mov eax, dword ptr fs:[00000030h] 2_2_36C0254C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CDB55F mov eax, dword ptr fs:[00000030h] 2_2_36CDB55F
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CDB55F mov eax, dword ptr fs:[00000030h] 2_2_36CDB55F
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CCA553 mov eax, dword ptr fs:[00000030h] 2_2_36CCA553
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1C560 mov eax, dword ptr fs:[00000030h] 2_2_36C1C560
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFB502 mov eax, dword ptr fs:[00000030h] 2_2_36BFB502
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C02500 mov eax, dword ptr fs:[00000030h] 2_2_36C02500
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2E507 mov eax, dword ptr fs:[00000030h] 2_2_36C2E507
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2E507 mov eax, dword ptr fs:[00000030h] 2_2_36C2E507
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2E507 mov eax, dword ptr fs:[00000030h] 2_2_36C2E507
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2E507 mov eax, dword ptr fs:[00000030h] 2_2_36C2E507
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2E507 mov eax, dword ptr fs:[00000030h] 2_2_36C2E507
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2E507 mov eax, dword ptr fs:[00000030h] 2_2_36C2E507
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2E507 mov eax, dword ptr fs:[00000030h] 2_2_36C2E507
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2E507 mov eax, dword ptr fs:[00000030h] 2_2_36C2E507
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3C50D mov eax, dword ptr fs:[00000030h] 2_2_36C3C50D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3C50D mov eax, dword ptr fs:[00000030h] 2_2_36C3C50D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAF51B mov eax, dword ptr fs:[00000030h] 2_2_36CAF51B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAF51B mov eax, dword ptr fs:[00000030h] 2_2_36CAF51B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAF51B mov eax, dword ptr fs:[00000030h] 2_2_36CAF51B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAF51B mov eax, dword ptr fs:[00000030h] 2_2_36CAF51B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAF51B mov eax, dword ptr fs:[00000030h] 2_2_36CAF51B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAF51B mov eax, dword ptr fs:[00000030h] 2_2_36CAF51B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAF51B mov ecx, dword ptr fs:[00000030h] 2_2_36CAF51B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAF51B mov ecx, dword ptr fs:[00000030h] 2_2_36CAF51B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAF51B mov eax, dword ptr fs:[00000030h] 2_2_36CAF51B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAF51B mov eax, dword ptr fs:[00000030h] 2_2_36CAF51B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAF51B mov eax, dword ptr fs:[00000030h] 2_2_36CAF51B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAF51B mov eax, dword ptr fs:[00000030h] 2_2_36CAF51B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAF51B mov eax, dword ptr fs:[00000030h] 2_2_36CAF51B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C8C51D mov eax, dword ptr fs:[00000030h] 2_2_36C8C51D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C21514 mov eax, dword ptr fs:[00000030h] 2_2_36C21514
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C21514 mov eax, dword ptr fs:[00000030h] 2_2_36C21514
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C21514 mov eax, dword ptr fs:[00000030h] 2_2_36C21514
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C21514 mov eax, dword ptr fs:[00000030h] 2_2_36C21514
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C21514 mov eax, dword ptr fs:[00000030h] 2_2_36C21514
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C21514 mov eax, dword ptr fs:[00000030h] 2_2_36C21514
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3F523 mov eax, dword ptr fs:[00000030h] 2_2_36C3F523
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C31527 mov eax, dword ptr fs:[00000030h] 2_2_36C31527
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1252B mov eax, dword ptr fs:[00000030h] 2_2_36C1252B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1252B mov eax, dword ptr fs:[00000030h] 2_2_36C1252B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1252B mov eax, dword ptr fs:[00000030h] 2_2_36C1252B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1252B mov eax, dword ptr fs:[00000030h] 2_2_36C1252B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1252B mov eax, dword ptr fs:[00000030h] 2_2_36C1252B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1252B mov eax, dword ptr fs:[00000030h] 2_2_36C1252B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1252B mov eax, dword ptr fs:[00000030h] 2_2_36C1252B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C03536 mov eax, dword ptr fs:[00000030h] 2_2_36C03536
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C03536 mov eax, dword ptr fs:[00000030h] 2_2_36C03536
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42539 mov eax, dword ptr fs:[00000030h] 2_2_36C42539
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C332C0 mov eax, dword ptr fs:[00000030h] 2_2_36C332C0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C332C0 mov eax, dword ptr fs:[00000030h] 2_2_36C332C0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CD32C9 mov eax, dword ptr fs:[00000030h] 2_2_36CD32C9
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C232C5 mov eax, dword ptr fs:[00000030h] 2_2_36C232C5
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFC2B0 mov ecx, dword ptr fs:[00000030h] 2_2_36BFC2B0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF92AF mov eax, dword ptr fs:[00000030h] 2_2_36BF92AF
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0A2E0 mov eax, dword ptr fs:[00000030h] 2_2_36C0A2E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0A2E0 mov eax, dword ptr fs:[00000030h] 2_2_36C0A2E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0A2E0 mov eax, dword ptr fs:[00000030h] 2_2_36C0A2E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0A2E0 mov eax, dword ptr fs:[00000030h] 2_2_36C0A2E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0A2E0 mov eax, dword ptr fs:[00000030h] 2_2_36C0A2E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0A2E0 mov eax, dword ptr fs:[00000030h] 2_2_36C0A2E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C082E0 mov eax, dword ptr fs:[00000030h] 2_2_36C082E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C082E0 mov eax, dword ptr fs:[00000030h] 2_2_36C082E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C082E0 mov eax, dword ptr fs:[00000030h] 2_2_36C082E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C082E0 mov eax, dword ptr fs:[00000030h] 2_2_36C082E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C102F9 mov eax, dword ptr fs:[00000030h] 2_2_36C102F9
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C102F9 mov eax, dword ptr fs:[00000030h] 2_2_36C102F9
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C102F9 mov eax, dword ptr fs:[00000030h] 2_2_36C102F9
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C102F9 mov eax, dword ptr fs:[00000030h] 2_2_36C102F9
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C102F9 mov eax, dword ptr fs:[00000030h] 2_2_36C102F9
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C102F9 mov eax, dword ptr fs:[00000030h] 2_2_36C102F9
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C102F9 mov eax, dword ptr fs:[00000030h] 2_2_36C102F9
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C102F9 mov eax, dword ptr fs:[00000030h] 2_2_36C102F9
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C7E289 mov eax, dword ptr fs:[00000030h] 2_2_36C7E289
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFD2EC mov eax, dword ptr fs:[00000030h] 2_2_36BFD2EC
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFD2EC mov eax, dword ptr fs:[00000030h] 2_2_36BFD2EC
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF72E0 mov eax, dword ptr fs:[00000030h] 2_2_36BF72E0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CBF2AE mov eax, dword ptr fs:[00000030h] 2_2_36CBF2AE
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC92AB mov eax, dword ptr fs:[00000030h] 2_2_36CC92AB
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C242AF mov eax, dword ptr fs:[00000030h] 2_2_36C242AF
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C242AF mov eax, dword ptr fs:[00000030h] 2_2_36C242AF
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CDB2BC mov eax, dword ptr fs:[00000030h] 2_2_36CDB2BC
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CDB2BC mov eax, dword ptr fs:[00000030h] 2_2_36CDB2BC
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CDB2BC mov eax, dword ptr fs:[00000030h] 2_2_36CDB2BC
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CDB2BC mov eax, dword ptr fs:[00000030h] 2_2_36CDB2BC
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC124C mov eax, dword ptr fs:[00000030h] 2_2_36CC124C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC124C mov eax, dword ptr fs:[00000030h] 2_2_36CC124C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC124C mov eax, dword ptr fs:[00000030h] 2_2_36CC124C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC124C mov eax, dword ptr fs:[00000030h] 2_2_36CC124C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2F24A mov eax, dword ptr fs:[00000030h] 2_2_36C2F24A
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CBF247 mov eax, dword ptr fs:[00000030h] 2_2_36CBF247
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF821B mov eax, dword ptr fs:[00000030h] 2_2_36BF821B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C9327E mov eax, dword ptr fs:[00000030h] 2_2_36C9327E
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C9327E mov eax, dword ptr fs:[00000030h] 2_2_36C9327E
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C9327E mov eax, dword ptr fs:[00000030h] 2_2_36C9327E
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C9327E mov eax, dword ptr fs:[00000030h] 2_2_36C9327E
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C9327E mov eax, dword ptr fs:[00000030h] 2_2_36C9327E
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C9327E mov eax, dword ptr fs:[00000030h] 2_2_36C9327E
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CBD270 mov eax, dword ptr fs:[00000030h] 2_2_36CBD270
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFA200 mov eax, dword ptr fs:[00000030h] 2_2_36BFA200
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFB273 mov eax, dword ptr fs:[00000030h] 2_2_36BFB273
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFB273 mov eax, dword ptr fs:[00000030h] 2_2_36BFB273
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFB273 mov eax, dword ptr fs:[00000030h] 2_2_36BFB273
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C8B214 mov eax, dword ptr fs:[00000030h] 2_2_36C8B214
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C8B214 mov eax, dword ptr fs:[00000030h] 2_2_36C8B214
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3A22B mov eax, dword ptr fs:[00000030h] 2_2_36C3A22B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3A22B mov eax, dword ptr fs:[00000030h] 2_2_36C3A22B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3A22B mov eax, dword ptr fs:[00000030h] 2_2_36C3A22B
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C80227 mov eax, dword ptr fs:[00000030h] 2_2_36C80227
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C80227 mov eax, dword ptr fs:[00000030h] 2_2_36C80227
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C80227 mov eax, dword ptr fs:[00000030h] 2_2_36C80227
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C20230 mov ecx, dword ptr fs:[00000030h] 2_2_36C20230
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C063CB mov eax, dword ptr fs:[00000030h] 2_2_36C063CB
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C333D0 mov eax, dword ptr fs:[00000030h] 2_2_36C333D0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C343D0 mov ecx, dword ptr fs:[00000030h] 2_2_36C343D0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C843D5 mov eax, dword ptr fs:[00000030h] 2_2_36C843D5
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C01380 mov eax, dword ptr fs:[00000030h] 2_2_36C01380
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C01380 mov eax, dword ptr fs:[00000030h] 2_2_36C01380
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C01380 mov eax, dword ptr fs:[00000030h] 2_2_36C01380
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C01380 mov eax, dword ptr fs:[00000030h] 2_2_36C01380
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C01380 mov eax, dword ptr fs:[00000030h] 2_2_36C01380
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1F380 mov eax, dword ptr fs:[00000030h] 2_2_36C1F380
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1F380 mov eax, dword ptr fs:[00000030h] 2_2_36C1F380
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1F380 mov eax, dword ptr fs:[00000030h] 2_2_36C1F380
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1F380 mov eax, dword ptr fs:[00000030h] 2_2_36C1F380
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1F380 mov eax, dword ptr fs:[00000030h] 2_2_36C1F380
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1F380 mov eax, dword ptr fs:[00000030h] 2_2_36C1F380
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CBF38A mov eax, dword ptr fs:[00000030h] 2_2_36CBF38A
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2A390 mov eax, dword ptr fs:[00000030h] 2_2_36C2A390
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2A390 mov eax, dword ptr fs:[00000030h] 2_2_36C2A390
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2A390 mov eax, dword ptr fs:[00000030h] 2_2_36C2A390
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C093A6 mov eax, dword ptr fs:[00000030h] 2_2_36C093A6
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C093A6 mov eax, dword ptr fs:[00000030h] 2_2_36C093A6
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C7C3B0 mov eax, dword ptr fs:[00000030h] 2_2_36C7C3B0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFC3C7 mov eax, dword ptr fs:[00000030h] 2_2_36BFC3C7
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFE3C0 mov eax, dword ptr fs:[00000030h] 2_2_36BFE3C0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFE3C0 mov eax, dword ptr fs:[00000030h] 2_2_36BFE3C0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFE3C0 mov eax, dword ptr fs:[00000030h] 2_2_36BFE3C0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3A350 mov eax, dword ptr fs:[00000030h] 2_2_36C3A350
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFE328 mov eax, dword ptr fs:[00000030h] 2_2_36BFE328
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFE328 mov eax, dword ptr fs:[00000030h] 2_2_36BFE328
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFE328 mov eax, dword ptr fs:[00000030h] 2_2_36BFE328
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0B360 mov eax, dword ptr fs:[00000030h] 2_2_36C0B360
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0B360 mov eax, dword ptr fs:[00000030h] 2_2_36C0B360
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0B360 mov eax, dword ptr fs:[00000030h] 2_2_36C0B360
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0B360 mov eax, dword ptr fs:[00000030h] 2_2_36C0B360
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0B360 mov eax, dword ptr fs:[00000030h] 2_2_36C0B360
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C0B360 mov eax, dword ptr fs:[00000030h] 2_2_36C0B360
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3E363 mov eax, dword ptr fs:[00000030h] 2_2_36C3E363
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3E363 mov eax, dword ptr fs:[00000030h] 2_2_36C3E363
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3E363 mov eax, dword ptr fs:[00000030h] 2_2_36C3E363
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3E363 mov eax, dword ptr fs:[00000030h] 2_2_36C3E363
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3E363 mov eax, dword ptr fs:[00000030h] 2_2_36C3E363
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3E363 mov eax, dword ptr fs:[00000030h] 2_2_36C3E363
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3E363 mov eax, dword ptr fs:[00000030h] 2_2_36C3E363
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3E363 mov eax, dword ptr fs:[00000030h] 2_2_36C3E363
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C7E372 mov eax, dword ptr fs:[00000030h] 2_2_36C7E372
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C7E372 mov eax, dword ptr fs:[00000030h] 2_2_36C7E372
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C7E372 mov eax, dword ptr fs:[00000030h] 2_2_36C7E372
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C7E372 mov eax, dword ptr fs:[00000030h] 2_2_36C7E372
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2237A mov eax, dword ptr fs:[00000030h] 2_2_36C2237A
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C80371 mov eax, dword ptr fs:[00000030h] 2_2_36C80371
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C80371 mov eax, dword ptr fs:[00000030h] 2_2_36C80371
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF9303 mov eax, dword ptr fs:[00000030h] 2_2_36BF9303
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF9303 mov eax, dword ptr fs:[00000030h] 2_2_36BF9303
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CBF30A mov eax, dword ptr fs:[00000030h] 2_2_36CBF30A
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C8330C mov eax, dword ptr fs:[00000030h] 2_2_36C8330C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C8330C mov eax, dword ptr fs:[00000030h] 2_2_36C8330C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C8330C mov eax, dword ptr fs:[00000030h] 2_2_36C8330C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C8330C mov eax, dword ptr fs:[00000030h] 2_2_36C8330C
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1E310 mov eax, dword ptr fs:[00000030h] 2_2_36C1E310
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1E310 mov eax, dword ptr fs:[00000030h] 2_2_36C1E310
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1E310 mov eax, dword ptr fs:[00000030h] 2_2_36C1E310
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3631F mov eax, dword ptr fs:[00000030h] 2_2_36C3631F
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C38322 mov eax, dword ptr fs:[00000030h] 2_2_36C38322
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C38322 mov eax, dword ptr fs:[00000030h] 2_2_36C38322
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C38322 mov eax, dword ptr fs:[00000030h] 2_2_36C38322
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2332D mov eax, dword ptr fs:[00000030h] 2_2_36C2332D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF8347 mov eax, dword ptr fs:[00000030h] 2_2_36BF8347
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF8347 mov eax, dword ptr fs:[00000030h] 2_2_36BF8347
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF8347 mov eax, dword ptr fs:[00000030h] 2_2_36BF8347
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CD3336 mov eax, dword ptr fs:[00000030h] 2_2_36CD3336
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C1B0D0 mov eax, dword ptr fs:[00000030h] 2_2_36C1B0D0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFA093 mov ecx, dword ptr fs:[00000030h] 2_2_36BFA093
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFC090 mov eax, dword ptr fs:[00000030h] 2_2_36BFC090
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3D0F0 mov eax, dword ptr fs:[00000030h] 2_2_36C3D0F0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C3D0F0 mov ecx, dword ptr fs:[00000030h] 2_2_36C3D0F0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF90F8 mov eax, dword ptr fs:[00000030h] 2_2_36BF90F8
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF90F8 mov eax, dword ptr fs:[00000030h] 2_2_36BF90F8
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF90F8 mov eax, dword ptr fs:[00000030h] 2_2_36BF90F8
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BF90F8 mov eax, dword ptr fs:[00000030h] 2_2_36BF90F8
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFC0F6 mov eax, dword ptr fs:[00000030h] 2_2_36BFC0F6
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CD4080 mov eax, dword ptr fs:[00000030h] 2_2_36CD4080
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CD4080 mov eax, dword ptr fs:[00000030h] 2_2_36CD4080
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CD4080 mov eax, dword ptr fs:[00000030h] 2_2_36CD4080
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CD4080 mov eax, dword ptr fs:[00000030h] 2_2_36CD4080
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CD4080 mov eax, dword ptr fs:[00000030h] 2_2_36CD4080
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CD4080 mov eax, dword ptr fs:[00000030h] 2_2_36CD4080
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CD4080 mov eax, dword ptr fs:[00000030h] 2_2_36CD4080
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C400A5 mov eax, dword ptr fs:[00000030h] 2_2_36C400A5
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CBB0AF mov eax, dword ptr fs:[00000030h] 2_2_36CBB0AF
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFB0D6 mov eax, dword ptr fs:[00000030h] 2_2_36BFB0D6
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFB0D6 mov eax, dword ptr fs:[00000030h] 2_2_36BFB0D6
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFB0D6 mov eax, dword ptr fs:[00000030h] 2_2_36BFB0D6
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFB0D6 mov eax, dword ptr fs:[00000030h] 2_2_36BFB0D6
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAF0A5 mov eax, dword ptr fs:[00000030h] 2_2_36CAF0A5
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAF0A5 mov eax, dword ptr fs:[00000030h] 2_2_36CAF0A5
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAF0A5 mov eax, dword ptr fs:[00000030h] 2_2_36CAF0A5
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAF0A5 mov eax, dword ptr fs:[00000030h] 2_2_36CAF0A5
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAF0A5 mov eax, dword ptr fs:[00000030h] 2_2_36CAF0A5
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAF0A5 mov eax, dword ptr fs:[00000030h] 2_2_36CAF0A5
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CAF0A5 mov eax, dword ptr fs:[00000030h] 2_2_36CAF0A5
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CD50B7 mov eax, dword ptr fs:[00000030h] 2_2_36CD50B7
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C30044 mov eax, dword ptr fs:[00000030h] 2_2_36C30044
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C01051 mov eax, dword ptr fs:[00000030h] 2_2_36C01051
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C01051 mov eax, dword ptr fs:[00000030h] 2_2_36C01051
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36BFD02D mov eax, dword ptr fs:[00000030h] 2_2_36BFD02D
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CA9060 mov eax, dword ptr fs:[00000030h] 2_2_36CA9060
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C07072 mov eax, dword ptr fs:[00000030h] 2_2_36C07072
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C06074 mov eax, dword ptr fs:[00000030h] 2_2_36C06074
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C06074 mov eax, dword ptr fs:[00000030h] 2_2_36C06074
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C25004 mov eax, dword ptr fs:[00000030h] 2_2_36C25004
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C25004 mov ecx, dword ptr fs:[00000030h] 2_2_36C25004
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C08009 mov eax, dword ptr fs:[00000030h] 2_2_36C08009
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C42010 mov ecx, dword ptr fs:[00000030h] 2_2_36C42010
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C101C0 mov eax, dword ptr fs:[00000030h] 2_2_36C101C0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C101C0 mov eax, dword ptr fs:[00000030h] 2_2_36C101C0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C151C0 mov eax, dword ptr fs:[00000030h] 2_2_36C151C0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C151C0 mov eax, dword ptr fs:[00000030h] 2_2_36C151C0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C151C0 mov eax, dword ptr fs:[00000030h] 2_2_36C151C0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C151C0 mov eax, dword ptr fs:[00000030h] 2_2_36C151C0
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC81EE mov eax, dword ptr fs:[00000030h] 2_2_36CC81EE
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36CC81EE mov eax, dword ptr fs:[00000030h] 2_2_36CC81EE
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 2_2_36C2B1E0 mov eax, dword ptr fs:[00000030h] 2_2_36C2B1E0

HIPS / PFW / Operating System Protection Evasion
barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe NtClose: Direct from: 0x7FFE69879E7F
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe NtProtectVirtualMemory: Direct from: 0x7FFE96E82651 Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe NtResumeThread: Indirect: 0x36913C29 Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe NtSetContextThread: Indirect: 0x369135E9 Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe NtSuspendThread: Indirect: 0x36913909 Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe NtDelayExecution: Direct from: 0x5A127AE Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe NtAllocateVirtualMemory: Direct from: 0x7FFE7A795AE0 Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe NtProtectVirtualMemory: Direct from: 0x5A1A318 Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe NtDelayExecution: Direct from: 0x5A125ED Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe NtQueueApcThread: Indirect: 0x3690F414 Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe NtResumeThread: Direct from: 0x5A1281F Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Section loaded: NULL target: C:\Windows\SysWOW64\SecEdit.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: read write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Thread register set: target process: 6432 Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe Thread register set: target process: 6432 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Thread APC queued: target process: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Process created: C:\Users\user\Desktop\PEDIDO-144848.exe "C:\Users\user\Desktop\PEDIDO-144848.exe" Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Process created: C:\Windows\SysWOW64\SecEdit.exe "C:\Windows\SysWOW64\SecEdit.exe" Jump to behavior
Source: C:\Users\user\Desktop\PEDIDO-144848.exe Code function: 0_2_00405DC2 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA, 0_2_00405DC2

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 00000004.00000002.117101970998.0000000002D80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.117102256673.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.115570845480.0000000036930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 00000004.00000002.117101970998.0000000002D80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.117102256673.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.115570845480.0000000036930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1528317 Sample: PEDIDO-144848.exe Startdate: 07/10/2024 Architecture: WINDOWS Score: 96 28 drive.usercontent.google.com 2->28 30 drive.google.com 2->30 38 Malicious sample detected (through community Yara rule) 2->38 40 Multi AV Scanner detection for submitted file 2->40 42 Yara detected FormBook 2->42 44 2 other signatures 2->44 10 PEDIDO-144848.exe 1 511 2->10         started        signatures3 process4 file5 26 C:\Users\user\AppData\Local\...\System.dll, PE32 10->26 dropped 52 Switches to a custom stack to bypass stack traces 10->52 14 PEDIDO-144848.exe 6 10->14         started        signatures6 process7 dnsIp8 32 drive.google.com 142.250.80.46, 443, 49748 GOOGLEUS United States 14->32 34 drive.usercontent.google.com 142.251.40.97, 443, 49749 GOOGLEUS United States 14->34 54 Modifies the context of a thread in another process (thread injection) 14->54 56 Maps a DLL or memory area into another process 14->56 58 Queues an APC in another process (thread injection) 14->58 60 Found direct / indirect Syscall (likely to bypass EDR) 14->60 18 RAVCpl64.exe 14->18 injected signatures9 process10 signatures11 36 Found direct / indirect Syscall (likely to bypass EDR) 18->36 21 SecEdit.exe 18->21         started        process12 signatures13 46 Modifies the context of a thread in another process (thread injection) 21->46 48 Maps a DLL or memory area into another process 21->48 50 Switches to a custom stack to bypass stack traces 21->50 24 explorer.exe 32 1 21->24 injected process14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.80.46
 drive.google.com United States
15169 GOOGLEUS false
142.251.40.97
 drive.usercontent.google.com United States
15169 GOOGLEUS false

Contacted Domains

Name IP Active
drive.google.com 142.250.80.46 true
drive.usercontent.google.com 142.251.40.97 true