Windows Analysis Report
z1SWIFT_MT103_Payment_552016_cmd.bat

Overview

General Information

Sample name: z1SWIFT_MT103_Payment_552016_cmd.bat
Analysis ID: 1545185
MD5: c00b82b6a7b2073f1887e919d1760aee
SHA1: 0d32e05789133c3270d16533319cef50deec5483
SHA256: 005de20d3c71268e4349a23b18e6f464f0632a4d67bc069a478c99d0b8e3f255
Tags: batuser-Porcupine
Infos:

Detection

DBatLoader, FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected DBatLoader
Yara detected FormBook
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Drops PE files to the user root directory
Drops PE files with a suspicious file extension
Drops or copies cmd.exe with a different name (likely to bypass HIPS)
Found direct / indirect Syscall (likely to bypass EDR)
Found large BAT file
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: DLL Search Order Hijackig Via Additional Space in Path
Sigma detected: Execution from Suspicious Folder
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Tries to resolve many domain names, but no domain seems valid
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a connection to the internet is available
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a process as a different user
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the user directory
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Execution of Suspicious File Type Extension
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic
Yara signature match

Classification

AV Detection
barindex
Found malware configuration
Source: z1SWIFT_MT103_Payment_552016_cmd.bat Malware Configuration Extractor: DBatLoader {"Download Url": ["https://himalayastrek.com/stein/233_Lvvgdeojree"]}
Source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.kimosskrupulslacker.cfd/f29s/"], "decoy": ["rostnixon.net", "exxxwordz.xyz", "ndradesanches.shop", "eneral-vceef.xyz", "isanbowl.top", "aresrasherregard.cfd", "dzas-yeah.xyz", "0083.miami", "hongziyin01.top", "jdhfmq.live", "alembottling.net", "vtyo-phone.xyz", "kaqb-decade.xyz", "odel-lsmfz.xyz", "aradise.tech", "uan123-rtp43.xyz", "pusptracking.xyz", "uqhi42.xyz", "mihy-professor.xyz", "mnz-your.xyz", "iscussion-tjard.xyz", "peak-ajau.xyz", "ixedcontainerlogistics.today", "ranxxletzz.xyz", "ccloudserve.xyz", "haloryner.website", "ro-arenamega.pro", "tjcb-wait.xyz", "lywjv-issue.xyz", "rta-away.xyz", "ay888.website", "asderkadinkollari.net", "specially-smou.xyz", "ound-qlhmm.xyz", "nit-dreeu.xyz", "ea-obgocc.xyz", "rostavive-org.xyz", "zpp-at.xyz", "duxrib.xyz", "uohz.net", "etsgroove.app", "awqs-wonder.xyz", "acaxtecameralcarers.cfd", "idstream.xyz", "umayunileusesingests.shop", "avada-cash-out.tech", "byataltatweer.net", "omething-nvho.xyz", "yntomist.pics", "aomei517.top", "how-ydhtlu.xyz", "ise-bjnh.xyz", "ovt-jobs-lisitings00810.today", "mmgiare.xyz", "plqz-move.xyz", "onheronummaryorkney.cfd", "oqo-over.xyz", "aee.pro", "as-nhynby.xyz", "dnaqm-walk.xyz", "aranvickersvirilia.cfd", "wqvn-environment.xyz", "attern-equd.xyz", "ivinetranquilityjourney.pics"]}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\x.exe ReversingLabs: Detection: 26%
Multi AV Scanner detection for submitted file
Source: z1SWIFT_MT103_Payment_552016_cmd.bat ReversingLabs: Detection: 42%
Yara detected FormBook
Source: Yara match File source: 11.1.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.1.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\x.exe Joe Sandbox ML: detected
Source: unknown HTTPS traffic detected: 50.116.93.185:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: Binary string: cscript.pdbUGP source: joedgvvL.pif, 0000000B.00000003.2313114650.000000001DADE000.00000004.00000020.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000002.2335660192.000000001DEC0000.00000040.10000000.00040000.00000000.sdmp, cscript.exe, 0000000D.00000002.4578552146.0000000000BF0000.00000040.80000000.00040000.00000000.sdmp
Source: Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: easinvoker.pdb source: x.exe, x.exe, 00000004.00000002.2248060897.0000000020EB0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2248060897.0000000020EF7000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2142117406.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2140831497.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: cmd.pdbUGP source: esentutl.exe, 00000008.00000003.2205517290.0000000005670000.00000004.00001000.00020000.00000000.sdmp, alpha.pif, 0000000A.00000000.2212405005.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, alpha.pif.8.dr
Source: Binary string: wntdll.pdbUGP source: joedgvvL.pif, 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000003.2221706978.000000001DD76000.00000004.00000020.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000003.2214977767.000000001DBCE000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000000D.00000002.4579171582.0000000004FBE000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 0000000D.00000002.4579171582.0000000004E20000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 0000000D.00000003.2313532832.0000000004AB4000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000000D.00000003.2320518672.0000000004C6D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ping.pdbGCTL source: esentutl.exe, 00000009.00000003.2209251520.0000000005320000.00000004.00001000.00020000.00000000.sdmp, xpha.pif.9.dr
Source: Binary string: wntdll.pdb source: joedgvvL.pif, joedgvvL.pif, 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000003.2221706978.000000001DD76000.00000004.00000020.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000003.2214977767.000000001DBCE000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000000D.00000002.4579171582.0000000004FBE000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 0000000D.00000002.4579171582.0000000004E20000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 0000000D.00000003.2313532832.0000000004AB4000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000000D.00000003.2320518672.0000000004C6D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: easinvoker.pdbH source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: easinvoker.pdbGCTL source: x.exe, 00000004.00000003.2210936241.0000000021580000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2248060897.0000000020EB0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2248060897.0000000020EF7000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2142117406.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2210936241.00000000215AF000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000003.2140831497.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2141828114.0000000003014000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2225748962.0000000003013000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: cmd.pdb source: esentutl.exe, 00000008.00000003.2205517290.0000000005670000.00000004.00001000.00020000.00000000.sdmp, alpha.pif, alpha.pif, 0000000A.00000000.2212405005.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, alpha.pif.8.dr
Source: Binary string: ping.pdb source: esentutl.exe, 00000009.00000003.2209251520.0000000005320000.00000004.00001000.00020000.00000000.sdmp, xpha.pif.9.dr
Source: Binary string: cscript.pdb source: joedgvvL.pif, 0000000B.00000003.2313114650.000000001DADE000.00000004.00000020.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000002.2335660192.000000001DEC0000.00000040.10000000.00040000.00000000.sdmp, cscript.exe, 0000000D.00000002.4578552146.0000000000BF0000.00000040.80000000.00040000.00000000.sdmp
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031D5908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA, 4_2_031D5908
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D20207 FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove, 10_2_00D20207
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D2589A FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose, 10_2_00D2589A
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D24EC1 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW, 10_2_00D24EC1
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D33E66 FindFirstFileW,FindNextFileW,FindClose, 10_2_00D33E66
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D1532E GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,??_V@YAXPAX@Z,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose, 10_2_00D1532E
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 4x nop then pop edi 11_2_00416CBC
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 4x nop then pop edi 11_1_00416CBC

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.6:57601 -> 178.128.81.239:80
Source: Network traffic Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.6:57601 -> 178.128.81.239:80
Source: Network traffic Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.6:57601 -> 178.128.81.239:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 178.128.81.239 80 Jump to behavior
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://himalayastrek.com/stein/233_Lvvgdeojree
Source: Malware configuration extractor URLs: www.kimosskrupulslacker.cfd/f29s/
Performs DNS queries to domains with low reputation
Source: DNS query: www.ound-qlhmm.xyz
Source: DNS query: www.idstream.xyz
Source: DNS query: www.specially-smou.xyz
Source: DNS query: www.zpp-at.xyz
Source: DNS query: www.ranxxletzz.xyz
Source: DNS query: www.ise-bjnh.xyz
Tries to resolve many domain names, but no domain seems valid
Source: unknown DNS traffic detected: query: www.ranxxletzz.xyz replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.acaxtecameralcarers.cfd replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.ise-bjnh.xyz replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.jdhfmq.live replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.kimosskrupulslacker.cfd replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.ound-qlhmm.xyz replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.zpp-at.xyz replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.byataltatweer.net replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.specially-smou.xyz replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.ixedcontainerlogistics.today replaycode: Name error (3)
Contains functionality to check if a connection to the internet is available
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031EE4B8 InternetCheckConnectionA, 4_2_031EE4B8
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /f29s/?K0D4DF=m5h39RLwl31LXRPRmTSXP9eLYqfjoOrpkihnF09uNo6H/5I9WBh+KA30PPZTUfl/TnSCsLUw0A==&YBZTY=wPDP7JgPANGdLZ7 HTTP/1.1Host: www.idstream.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
Source: Joe Sandbox View ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /stein/233_Lvvgdeojree HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: himalayastrek.com
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Windows\explorer.exe Code function: 12_2_08D92F82 getaddrinfo,setsockopt,recv, 12_2_08D92F82
Source: global traffic HTTP traffic detected: GET /stein/233_Lvvgdeojree HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: himalayastrek.com
Source: global traffic HTTP traffic detected: GET /f29s/?K0D4DF=m5h39RLwl31LXRPRmTSXP9eLYqfjoOrpkihnF09uNo6H/5I9WBh+KA30PPZTUfl/TnSCsLUw0A==&YBZTY=wPDP7JgPANGdLZ7 HTTP/1.1Host: www.idstream.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic DNS traffic detected: DNS query: himalayastrek.com
Source: global traffic DNS traffic detected: DNS query: www.acaxtecameralcarers.cfd
Source: global traffic DNS traffic detected: DNS query: www.ound-qlhmm.xyz
Source: global traffic DNS traffic detected: DNS query: www.idstream.xyz
Source: global traffic DNS traffic detected: DNS query: www.specially-smou.xyz
Source: global traffic DNS traffic detected: DNS query: www.zpp-at.xyz
Source: global traffic DNS traffic detected: DNS query: www.byataltatweer.net
Source: global traffic DNS traffic detected: DNS query: www.ranxxletzz.xyz
Source: global traffic DNS traffic detected: DNS query: www.ixedcontainerlogistics.today
Source: global traffic DNS traffic detected: DNS query: www.kimosskrupulslacker.cfd
Source: global traffic DNS traffic detected: DNS query: www.ise-bjnh.xyz
Source: global traffic DNS traffic detected: DNS query: www.jdhfmq.live
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: explorer.exe, 0000000C.00000002.4587065407.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2252238503.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2252238503.000000000978C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: explorer.exe, 0000000C.00000002.4587065407.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2252238503.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2252238503.000000000978C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: explorer.exe, 0000000C.00000002.4587065407.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2252238503.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2252238503.000000000978C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: explorer.exe, 0000000C.00000002.4587065407.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2252238503.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2252238503.000000000978C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: explorer.exe, 0000000C.00000000.2252238503.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000962B000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0C
Source: explorer.exe, 0000000C.00000002.4585076295.0000000007B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2250453536.0000000007B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2237519701.00000000028A0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://schemas.micro
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.acaxtecameralcarers.cfd
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.acaxtecameralcarers.cfd/f29s/
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.acaxtecameralcarers.cfd/f29s/www.ound-qlhmm.xyz
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.acaxtecameralcarers.cfdReferer:
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.aomei517.top
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.aomei517.top/f29s/
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.aomei517.top/f29s/www.dnaqm-walk.xyz
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.aomei517.topReferer:
Source: explorer.exe, 0000000C.00000003.2979507904.000000000C3D9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4593227950.000000000C3FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980518972.000000000C3F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2264757843.000000000C39F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.byataltatweer.net
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.byataltatweer.net/f29s/
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.byataltatweer.net/f29s/www.ranxxletzz.xyz
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.byataltatweer.netReferer:
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.dnaqm-walk.xyz
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.dnaqm-walk.xyz/f29s/
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.dnaqm-walk.xyz/f29s/www.ndradesanches.shop
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.dnaqm-walk.xyzReferer:
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.duxrib.xyz
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.duxrib.xyz/f29s/
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.duxrib.xyz/f29s/www.ise-bjnh.xyz
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.duxrib.xyzReferer:
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.idstream.xyz
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.idstream.xyz/f29s/
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.idstream.xyz/f29s/www.specially-smou.xyz
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.idstream.xyzReferer:
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.iscussion-tjard.xyz
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.iscussion-tjard.xyz/f29s/
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.iscussion-tjard.xyz/f29s/www.aomei517.top
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.iscussion-tjard.xyzReferer:
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ise-bjnh.xyz
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ise-bjnh.xyz/f29s/
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ise-bjnh.xyz/f29s/www.jdhfmq.live
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ise-bjnh.xyzReferer:
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ixedcontainerlogistics.today
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ixedcontainerlogistics.today/f29s/
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ixedcontainerlogistics.today/f29s/www.kimosskrupulslacker.cfd
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ixedcontainerlogistics.todayReferer:
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.jdhfmq.live
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.jdhfmq.live/f29s/
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.jdhfmq.live/f29s/www.iscussion-tjard.xyz
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.jdhfmq.liveReferer:
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.kimosskrupulslacker.cfd
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.kimosskrupulslacker.cfd/f29s/
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.kimosskrupulslacker.cfd/f29s/www.duxrib.xyz
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.kimosskrupulslacker.cfdReferer:
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ndradesanches.shop
Source: explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ndradesanches.shop/f29s/
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ndradesanches.shopReferer:
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ound-qlhmm.xyz
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ound-qlhmm.xyz/f29s/
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ound-qlhmm.xyz/f29s/www.idstream.xyz
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ound-qlhmm.xyzReferer:
Source: x.exe, x.exe, 00000004.00000003.2142117406.000000007FBDF000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2141828114.000000000303C000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2248060897.0000000020F49000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2250459092.00000000216D8000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2248060897.0000000020EF7000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2250243378.00000000215DC000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2254223974.000000007FE2F000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2225748962.000000000303B000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2250243378.000000002157D000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000000.2213209733.0000000000416000.00000002.00000001.01000000.00000008.sdmp, explorer.exe, 0000000C.00000002.4594172713.000000000FFFF000.00000004.80000000.00040000.00000000.sdmp, cscript.exe, 0000000D.00000002.4578632735.0000000002CAA000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000000D.00000002.4579948953.000000000536F000.00000004.10000000.00040000.00000000.sdmp, joedgvvL.pif.4.dr String found in binary or memory: http://www.pmail.com
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ranxxletzz.xyz
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ranxxletzz.xyz/f29s/
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ranxxletzz.xyz/f29s/www.ixedcontainerlogistics.today
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ranxxletzz.xyzReferer:
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.specially-smou.xyz
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.specially-smou.xyz/f29s/
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.specially-smou.xyz/f29s/www.zpp-at.xyz
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.specially-smou.xyzReferer:
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.zpp-at.xyz
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.zpp-at.xyz/f29s/
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.zpp-at.xyz/f29s/www.byataltatweer.net
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.zpp-at.xyzReferer:
Source: explorer.exe, 0000000C.00000000.2252872203.00000000099AB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: explorer.exe, 0000000C.00000000.2264757843.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4591988823.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 0000000C.00000000.2252238503.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000962B000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 0000000C.00000000.2252238503.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000962B000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/I
Source: explorer.exe, 0000000C.00000000.2252238503.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000973C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 0000000C.00000000.2252238503.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000962B000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&oc
Source: explorer.exe, 0000000C.00000000.2252238503.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 0000000C.00000000.2252238503.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000973C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
Source: explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz
Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2264757843.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://excel.office.com-
Source: x.exe, 00000004.00000002.2216401383.00000000008FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://himalayastrek.com/
Source: x.exe, 00000004.00000002.2248060897.0000000020FBD000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://himalayastrek.com/stein/233_Lvvg
Source: x.exe, 00000004.00000002.2248060897.0000000020FBD000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://himalayastrek.com/stein/233_Lvvgdeojree
Source: x.exe, 00000004.00000002.2216401383.0000000000977000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://himalayastrek.com:443/stein/233_LvvgdeojreeP
Source: explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzME7S.img
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2264757843.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.come
Source: explorer.exe, 0000000C.00000000.2264757843.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4591988823.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://powerpoint.office.comEMd
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sectigo.com/CPS0
Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000000C.00000002.4587065407.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3075011568.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2252872203.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2979174181.00000000099AB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://wns.windows.com/e
Source: explorer.exe, 0000000C.00000003.2979877608.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2264757843.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4592188467.000000000C048000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2980545373.000000000C071000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3076227046.000000000C071000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://word.office.comM
Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/10-things-rich-people-never-buy-and-you-shouldn-t-ei
Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA
Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngF
Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri
Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-
Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-h
Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-qu
Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation
Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c
Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/world/us-supplies-ukraine-with-a-million-rounds-of-ammunition-seized-
Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-
Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve
Source: explorer.exe, 0000000C.00000000.2248191769.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown HTTPS traffic detected: 50.116.93.185:443 -> 192.168.2.6:49710 version: TLS 1.2
Yara detected Keylogger Generic
Source: Yara match File source: Process Memory Space: x.exe PID: 3544, type: MEMORYSTR

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 11.1.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.1.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 11.1.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 11.1.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 11.1.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 11.2.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 11.2.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 11.2.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 11.2.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 11.2.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 11.2.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 11.1.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 11.1.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 11.1.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000002.4586555413.0000000008DAA000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
Source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: x.exe PID: 3544, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: joedgvvL.pif PID: 2992, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTR Matched rule: Semi-Auto-generated - file ironshell.php.txt Author: Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Source: Process Memory Space: cscript.exe PID: 2912, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Found large BAT file
Source: z1SWIFT_MT103_Payment_552016_cmd.bat Static file information: 1139107
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031E8670 NtUnmapViewOfSection, 4_2_031E8670
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031E8400 NtReadVirtualMemory, 4_2_031E8400
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031E7A2C NtAllocateVirtualMemory, 4_2_031E7A2C
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031E7D78 NtWriteVirtualMemory, 4_2_031E7D78
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031EDD70 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose, 4_2_031EDD70
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031E8D70 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread, 4_2_031E8D70
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031EDC04 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile, 4_2_031EDC04
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031EDC8C RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose, 4_2_031EDC8C
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031EDBB0 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile, 4_2_031EDBB0
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031E7A2A NtAllocateVirtualMemory, 4_2_031E7A2A
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031E8D6E GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread, 4_2_031E8D6E
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D264CA NtQueryInformationToken, 10_2_00D264CA
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D37460 EnterCriticalSection,LeaveCriticalSection,fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer, 10_2_00D37460
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D2643A NtOpenThreadToken,NtOpenProcessToken,NtClose, 10_2_00D2643A
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D24823 NtQueryVolumeInformationFile,GetFileInformationByHandleEx, 10_2_00D24823
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D3C1FA SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memcpy,memcpy,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW, 10_2_00D3C1FA
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D26500 NtQueryInformationToken,NtQueryInformationToken, 10_2_00D26500
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D3A135 NtSetInformationFile, 10_2_00D3A135
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D14E3B _setjmp3,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,longjmp, 10_2_00D14E3B
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D24759 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,DeleteFileW,GetLastError, 10_2_00D24759
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_0041A330 NtCreateFile, 11_2_0041A330
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_0041A3E0 NtReadFile, 11_2_0041A3E0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_0041A460 NtClose, 11_2_0041A460
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_0041A510 NtAllocateVirtualMemory, 11_2_0041A510
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_0041A48B NtClose, 11_2_0041A48B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_0041A50C NtAllocateVirtualMemory, 11_2_0041A50C
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92DF0 NtQuerySystemInformation,LdrInitializeThunk, 11_2_1DF92DF0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92DD0 NtDelayExecution,LdrInitializeThunk, 11_2_1DF92DD0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92D30 NtUnmapViewOfSection,LdrInitializeThunk, 11_2_1DF92D30
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92D10 NtMapViewOfSection,LdrInitializeThunk, 11_2_1DF92D10
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92CA0 NtQueryInformationToken,LdrInitializeThunk, 11_2_1DF92CA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92C70 NtFreeVirtualMemory,LdrInitializeThunk, 11_2_1DF92C70
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92FE0 NtCreateFile,LdrInitializeThunk, 11_2_1DF92FE0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92FB0 NtResumeThread,LdrInitializeThunk, 11_2_1DF92FB0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92F90 NtProtectVirtualMemory,LdrInitializeThunk, 11_2_1DF92F90
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92F30 NtCreateSection,LdrInitializeThunk, 11_2_1DF92F30
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92EA0 NtAdjustPrivilegesToken,LdrInitializeThunk, 11_2_1DF92EA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92E80 NtReadVirtualMemory,LdrInitializeThunk, 11_2_1DF92E80
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 11_2_1DF92BF0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92B60 NtClose,LdrInitializeThunk, 11_2_1DF92B60
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92AD0 NtReadFile,LdrInitializeThunk, 11_2_1DF92AD0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92DB0 NtEnumerateKey, 11_2_1DF92DB0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF93D70 NtOpenThread, 11_2_1DF93D70
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF93D10 NtOpenProcessToken, 11_2_1DF93D10
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92D00 NtSetInformationFile, 11_2_1DF92D00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92CF0 NtOpenProcess, 11_2_1DF92CF0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92CC0 NtQueryVirtualMemory, 11_2_1DF92CC0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92C60 NtCreateKey, 11_2_1DF92C60
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92C00 NtQueryInformationProcess, 11_2_1DF92C00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92FA0 NtQuerySection, 11_2_1DF92FA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92F60 NtCreateProcessEx, 11_2_1DF92F60
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92EE0 NtQueueApcThread, 11_2_1DF92EE0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92E30 NtWriteVirtualMemory, 11_2_1DF92E30
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF939B0 NtGetContextThread, 11_2_1DF939B0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92BE0 NtQueryValueKey, 11_2_1DF92BE0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92BA0 NtEnumerateValueKey, 11_2_1DF92BA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92B80 NtQueryInformationFile, 11_2_1DF92B80
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92AF0 NtWriteFile, 11_2_1DF92AF0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF92AB0 NtWaitForSingleObject, 11_2_1DF92AB0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF935C0 NtCreateMutant, 11_2_1DF935C0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF94650 NtSuspendThread, 11_2_1DF94650
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF93090 NtSetValueKey, 11_2_1DF93090
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF93010 NtOpenDirectoryObject, 11_2_1DF93010
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF94340 NtSetContextThread, 11_2_1DF94340
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DEAA036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread,NtClose, 11_2_1DEAA036
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DEAA042 NtQueryInformationProcess, 11_2_1DEAA042
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_1_0041A330 NtCreateFile, 11_1_0041A330
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_1_0041A3E0 NtReadFile, 11_1_0041A3E0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_1_0041A460 NtClose, 11_1_0041A460
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_1_0041A510 NtAllocateVirtualMemory, 11_1_0041A510
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_1_0041A48B NtClose, 11_1_0041A48B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_1_0041A50C NtAllocateVirtualMemory, 11_1_0041A50C
Source: C:\Windows\explorer.exe Code function: 12_2_08D93E12 NtProtectVirtualMemory, 12_2_08D93E12
Source: C:\Windows\explorer.exe Code function: 12_2_08D92232 NtCreateFile, 12_2_08D92232
Source: C:\Windows\explorer.exe Code function: 12_2_08D93E0A NtProtectVirtualMemory, 12_2_08D93E0A
Contains functionality to communicate with device drivers
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D14C10: memset,GetFileSecurityW,GetSecurityDescriptorOwner,??_V@YAXPAX@Z,memset,CreateFileW,DeviceIoControl,memcpy,CloseHandle,??_V@YAXPAX@Z,memset,??_V@YAXPAX@Z,FindClose,??_V@YAXPAX@Z, 10_2_00D14C10
Contains functionality to launch a process as a different user
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031E8788 CreateProcessAsUserW, 4_2_031E8788
Creates files inside the system directory
Source: C:\Users\Public\alpha.pif File created: C:\Windows Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031D20C4 4_2_031D20C4
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D174B1 10_2_00D174B1
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D24875 10_2_00D24875
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D14C10 10_2_00D14C10
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D1540A 10_2_00D1540A
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D34191 10_2_00D34191
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D3695A 10_2_00D3695A
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D19144 10_2_00D19144
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D24EC1 10_2_00D24EC1
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D3769E 10_2_00D3769E
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D25A86 10_2_00D25A86
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D23EB3 10_2_00D23EB3
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D16E57 10_2_00D16E57
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D1D660 10_2_00D1D660
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D33E66 10_2_00D33E66
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D1EE03 10_2_00D1EE03
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D17A34 10_2_00D17A34
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D20BF0 10_2_00D20BF0
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D20740 10_2_00D20740
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D16B20 10_2_00D16B20
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_00401030 11_2_00401030
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_0041E50C 11_2_0041E50C
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_0041E524 11_2_0041E524
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_0041D6C9 11_2_0041D6C9
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_0041EB53 11_2_0041EB53
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_00402D87 11_2_00402D87
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_00402D90 11_2_00402D90
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_00409E5B 11_2_00409E5B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_00409E60 11_2_00409E60
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_00402FB0 11_2_00402FB0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5ADE0 11_2_1DF5ADE0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01EE26 11_2_1E01EE26
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7FDC0 11_2_1DF7FDC0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF78DBF 11_2_1DF78DBF
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01CE93 11_2_1E01CE93
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D40 11_2_1DF63D40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01EEDB 11_2_1E01EEDB
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF6AD00 11_2_1DF6AD00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF50CF2 11_2_1DF50CF2
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01FF09 11_2_1E01FF09
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01FFB1 11_2_1E01FFB1
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD9C32 11_2_1DFD9C32
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF60C00 11_2_1DF60C00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF6CFE0 11_2_1DF6CFE0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF52FC8 11_2_1DF52FC8
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF61F92 11_2_1DF61F92
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E000CB5 11_2_1E000CB5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD4F40 11_2_1DFD4F40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF80F30 11_2_1DF80F30
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFA2F28 11_2_1DFA2F28
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01FCF2 11_2_1E01FCF2
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF69EB0 11_2_1DF69EB0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E011D5A 11_2_1E011D5A
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF72E90 11_2_1DF72E90
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E017D73 11_2_1E017D73
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF60E59 11_2_1DF60E59
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E017A46 11_2_1E017A46
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01FA49 11_2_1E01FA49
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF629A0 11_2_1DF629A0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF76962 11_2_1DF76962
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF69950 11_2_1DF69950
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7B950 11_2_1DF7B950
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00DAC6 11_2_1E00DAC6
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8E8F0 11_2_1DF8E8F0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF638E0 11_2_1DF638E0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01AB40 11_2_1E01AB40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF468B8 11_2_1DF468B8
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01FB76 11_2_1E01FB76
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF62840 11_2_1DF62840
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF6A840 11_2_1DF6A840
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E016BD7 11_2_1E016BD7
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFCD800 11_2_1DFCD800
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF9DBF9 11_2_1DF9DBF9
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7FB80 11_2_1DF7FB80
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFDAAC 11_2_1DFFDAAC
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFA5AA0 11_2_1DFA5AA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5EA80 11_2_1DF5EA80
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD3A6C 11_2_1DFD3A6C
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E02A9A6 11_2_1E02A9A6
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFD5B0 11_2_1DFFD5B0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF60535 11_2_1DF60535
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E0116CC 11_2_1E0116CC
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF51460 11_2_1DF51460
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01F7B0 11_2_1E01F7B0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5C7C0 11_2_1DF5C7C0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01F43F 11_2_1E01F43F
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E012446 11_2_1E012446
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF60770 11_2_1DF60770
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF84750 11_2_1DF84750
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00E4F6 11_2_1E00E4F6
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7C6E0 11_2_1DF7C6E0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E017571 11_2_1E017571
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E020591 11_2_1E020591
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF6B1B0 11_2_1DF6B1B0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E000274 11_2_1E000274
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4F172 11_2_1DF4F172
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF9516C 11_2_1DF9516C
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFA118 11_2_1DFFA118
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E0012ED 11_2_1E0012ED
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF50100 11_2_1DF50100
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01132D 11_2_1E01132D
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF670C0 11_2_1DF670C0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01A352 11_2_1E01A352
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E0203E6 11_2_1E0203E6
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF6E3F0 11_2_1DF6E3F0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFA739A 11_2_1DFA739A
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4D34C 11_2_1DF4D34C
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00F0CC 11_2_1E00F0CC
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01F0E0 11_2_1E01F0E0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E0170E9 11_2_1E0170E9
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7B2C0 11_2_1DF7B2C0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF652A0 11_2_1DF652A0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E02B16B 11_2_1E02B16B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E0201AA 11_2_1E0201AA
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E0181CC 11_2_1E0181CC
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DEAA036 11_2_1DEAA036
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DEA2D02 11_2_1DEA2D02
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DEA8912 11_2_1DEA8912
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DEA5B32 11_2_1DEA5B32
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DEA5B30 11_2_1DEA5B30
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DEAE5CD 11_2_1DEAE5CD
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DEA1082 11_2_1DEA1082
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DEAB232 11_2_1DEAB232
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_1_00401030 11_1_00401030
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_1_0041E50C 11_1_0041E50C
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_1_0041E524 11_1_0041E524
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_1_0041D6C9 11_1_0041D6C9
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_1_0041EB53 11_1_0041EB53
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_1_00402D87 11_1_00402D87
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_1_00402D90 11_1_00402D90
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_1_00409E5B 11_1_00409E5B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_1_00409E60 11_1_00409E60
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_1_00402FB0 11_1_00402FB0
Source: C:\Windows\explorer.exe Code function: 12_2_08D92232 12_2_08D92232
Source: C:\Windows\explorer.exe Code function: 12_2_08D88082 12_2_08D88082
Source: C:\Windows\explorer.exe Code function: 12_2_08D91036 12_2_08D91036
Source: C:\Windows\explorer.exe Code function: 12_2_08D955CD 12_2_08D955CD
Source: C:\Windows\explorer.exe Code function: 12_2_08D8F912 12_2_08D8F912
Source: C:\Windows\explorer.exe Code function: 12_2_08D89D02 12_2_08D89D02
Source: C:\Windows\explorer.exe Code function: 12_2_08D8CB30 12_2_08D8CB30
Source: C:\Windows\explorer.exe Code function: 12_2_08D8CB32 12_2_08D8CB32
Source: C:\Windows\explorer.exe Code function: 12_2_0E25D232 12_2_0E25D232
Source: C:\Windows\explorer.exe Code function: 12_2_0E257B30 12_2_0E257B30
Source: C:\Windows\explorer.exe Code function: 12_2_0E257B32 12_2_0E257B32
Source: C:\Windows\explorer.exe Code function: 12_2_0E25C036 12_2_0E25C036
Source: C:\Windows\explorer.exe Code function: 12_2_0E253082 12_2_0E253082
Source: C:\Windows\explorer.exe Code function: 12_2_0E254D02 12_2_0E254D02
Source: C:\Windows\explorer.exe Code function: 12_2_0E25A912 12_2_0E25A912
Source: C:\Windows\explorer.exe Code function: 12_2_0E2605CD 12_2_0E2605CD
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\Public\Libraries\joedgvvL.pif 7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: String function: 031D4500 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: String function: 031D4860 appears 949 times
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: String function: 031D46D4 appears 244 times
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: String function: 031E89D0 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: String function: 031E894C appears 56 times
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: String function: 031D44DC appears 74 times
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: String function: 0041C1B0 appears 38 times
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: String function: 1DF4B970 appears 268 times
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: String function: 1DFA7E54 appears 89 times
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: String function: 1DFCEA12 appears 85 times
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: String function: 1DFDF290 appears 105 times
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: String function: 1DF95130 appears 36 times
Yara signature match
Source: 11.1.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 11.1.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 11.1.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 11.2.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 11.2.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 11.2.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 11.2.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 11.2.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 11.2.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 11.1.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 11.1.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 11.1.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.4586555413.0000000008DAA000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
Source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: x.exe PID: 3544, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: joedgvvL.pif PID: 2992, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTR Matched rule: ironshell_php author = Neo23x0 Yara BRG + customization by Stefan -dfate- Molls, description = Semi-Auto-generated - file ironshell.php.txt, hash = 8bfa2eeb8a3ff6afc619258e39fded56
Source: Process Memory Space: cscript.exe PID: 2912, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: classification engine Classification label: mal100.troj.evad.winBAT@23/8@12/2
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031D7FD4 GetDiskFreeSpaceA, 4_2_031D7FD4
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031E6DC8 CoCreateInstance, 4_2_031E6DC8
Source: C:\Users\user\AppData\Local\Temp\x.exe File created: C:\Users\Public\Libraries\PNO Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3492:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3892:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2788:120:WilError_03
Source: C:\Windows\System32\extrac32.exe File created: C:\Users\user\AppData\Local\Temp\CAB01864.TMP Jump to behavior
Source: unknown Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\z1SWIFT_MT103_Payment_552016_cmd.bat" "
Source: C:\Users\user\AppData\Local\Temp\x.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Windows\System32\extrac32.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: z1SWIFT_MT103_Payment_552016_cmd.bat ReversingLabs: Detection: 42%
Source: unknown Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\z1SWIFT_MT103_Payment_552016_cmd.bat" "
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\extrac32.exe extrac32 /y "C:\Users\user\Desktop\z1SWIFT_MT103_Payment_552016_cmd.bat" "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Users\user\AppData\Local\Temp\x.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\joedgvvL.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "
Source: C:\Users\user\AppData\Local\Temp\x.exe Process created: C:\Users\Public\Libraries\joedgvvL.pif C:\Users\Public\Libraries\joedgvvL.pif
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cscript.exe "C:\Windows\SysWOW64\cscript.exe"
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\Public\Libraries\joedgvvL.pif"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\extrac32.exe extrac32 /y "C:\Users\user\Desktop\z1SWIFT_MT103_Payment_552016_cmd.bat" "C:\Users\user\AppData\Local\Temp\x.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\joedgvvL.cmd" " Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Process created: C:\Users\Public\Libraries\joedgvvL.pif C:\Users\Public\Libraries\joedgvvL.pif Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cscript.exe "C:\Windows\SysWOW64\cscript.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\Public\Libraries\joedgvvL.pif" Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\extrac32.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: url.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Section loaded: ??.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32 Jump to behavior
Source: z1SWIFT_MT103_Payment_552016_cmd.bat Static file information: File size 1139107 > 1048576
Source: Binary string: cscript.pdbUGP source: joedgvvL.pif, 0000000B.00000003.2313114650.000000001DADE000.00000004.00000020.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000002.2335660192.000000001DEC0000.00000040.10000000.00040000.00000000.sdmp, cscript.exe, 0000000D.00000002.4578552146.0000000000BF0000.00000040.80000000.00040000.00000000.sdmp
Source: Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: easinvoker.pdb source: x.exe, x.exe, 00000004.00000002.2248060897.0000000020EB0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2248060897.0000000020EF7000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2142117406.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2140831497.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: cmd.pdbUGP source: esentutl.exe, 00000008.00000003.2205517290.0000000005670000.00000004.00001000.00020000.00000000.sdmp, alpha.pif, 0000000A.00000000.2212405005.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, alpha.pif.8.dr
Source: Binary string: wntdll.pdbUGP source: joedgvvL.pif, 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000003.2221706978.000000001DD76000.00000004.00000020.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000003.2214977767.000000001DBCE000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000000D.00000002.4579171582.0000000004FBE000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 0000000D.00000002.4579171582.0000000004E20000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 0000000D.00000003.2313532832.0000000004AB4000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000000D.00000003.2320518672.0000000004C6D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ping.pdbGCTL source: esentutl.exe, 00000009.00000003.2209251520.0000000005320000.00000004.00001000.00020000.00000000.sdmp, xpha.pif.9.dr
Source: Binary string: wntdll.pdb source: joedgvvL.pif, joedgvvL.pif, 0000000B.00000002.2335706570.000000001E0BE000.00000040.00001000.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000002.2335706570.000000001DF20000.00000040.00001000.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000003.2221706978.000000001DD76000.00000004.00000020.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000003.2214977767.000000001DBCE000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000000D.00000002.4579171582.0000000004FBE000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 0000000D.00000002.4579171582.0000000004E20000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 0000000D.00000003.2313532832.0000000004AB4000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 0000000D.00000003.2320518672.0000000004C6D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: easinvoker.pdbH source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: easinvoker.pdbGCTL source: x.exe, 00000004.00000003.2210936241.0000000021580000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2248060897.0000000020EB0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2248060897.0000000020EF7000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2142117406.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2210936241.00000000215AF000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000003.2140831497.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000003.2141828114.0000000003014000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2225748962.0000000003013000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2227079504.00000000031FE000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: cmd.pdb source: esentutl.exe, 00000008.00000003.2205517290.0000000005670000.00000004.00001000.00020000.00000000.sdmp, alpha.pif, alpha.pif, 0000000A.00000000.2212405005.0000000000D11000.00000020.00000001.01000000.00000007.sdmp, alpha.pif.8.dr
Source: Binary string: ping.pdb source: esentutl.exe, 00000009.00000003.2209251520.0000000005320000.00000004.00001000.00020000.00000000.sdmp, xpha.pif.9.dr
Source: Binary string: cscript.pdb source: joedgvvL.pif, 0000000B.00000003.2313114650.000000001DADE000.00000004.00000020.00020000.00000000.sdmp, joedgvvL.pif, 0000000B.00000002.2335660192.000000001DEC0000.00000040.10000000.00040000.00000000.sdmp, cscript.exe, 0000000D.00000002.4578552146.0000000000BF0000.00000040.80000000.00040000.00000000.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\Public\Libraries\joedgvvL.pif Unpacked PE file: 11.2.joedgvvL.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.rsrc:R; vs .text:ER;
Yara detected DBatLoader
Source: Yara match File source: 4.2.x.exe.31d0000.0.unpack, type: UNPACKEDPE
Binary contains a suspicious time stamp
Source: joedgvvL.pif.4.dr Static PE information: 0x9E9038DB [Sun Apr 19 22:51:07 2054 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031E894C LoadLibraryW,GetProcAddress,FreeLibrary, 4_2_031E894C
PE file contains sections with non-standard names
Source: alpha.pif.8.dr Static PE information: section name: .didat
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031D332C push eax; ret 4_2_031D3368
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031DC349 push 8B031DC1h; ret 4_2_031DC34E
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031FC378 push 031FC56Eh; ret 4_2_031FC566
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031D63B0 push 031D640Bh; ret 4_2_031D6403
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031D63AE push 031D640Bh; ret 4_2_031D6403
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031FD2FC push 031FD367h; ret 4_2_031FD35F
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031EF108 push ecx; mov dword ptr [esp], edx 4_2_031EF10D
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031FD144 push 031FD1ECh; ret 4_2_031FD1E4
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031FD1F8 push 031FD288h; ret 4_2_031FD280
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031E306C push 031E30B9h; ret 4_2_031E30B1
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031E306B push 031E30B9h; ret 4_2_031E30B1
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031FD0AC push 031FD125h; ret 4_2_031FD11D
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031D6784 push 031D67C6h; ret 4_2_031D67BE
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031D6782 push 031D67C6h; ret 4_2_031D67BE
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031FC570 push 031FC56Eh; ret 4_2_031FC566
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031DC56C push ecx; mov dword ptr [esp], edx 4_2_031DC571
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031DD5A0 push 031DD5CCh; ret 4_2_031DD5C4
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031DCBEC push 031DCD72h; ret 4_2_031DCD6A
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031DCA4E push 031DCD72h; ret 4_2_031DCD6A
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_03244A50 push eax; ret 4_2_03244B20
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031EAADF push 031EAB18h; ret 4_2_031EAB10
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031E8AD8 push 031E8B10h; ret 4_2_031E8B08
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031EAAE0 push 031EAB18h; ret 4_2_031EAB10
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031E790C push 031E7989h; ret 4_2_031E7981
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031E6948 push 031E69F3h; ret 4_2_031E69EB
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031E6946 push 031E69F3h; ret 4_2_031E69EB
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031E886C push 031E88AEh; ret 4_2_031E88A6
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031E2F60 push 031E2FD6h; ret 4_2_031E2FCE
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031E5E7C push ecx; mov dword ptr [esp], edx 4_2_031E5E7E
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D271ED push ecx; ret 10_2_00D27200
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D2722B push ecx; ret 10_2_00D2723E

Persistence and Installation Behavior
barindex
Drops PE files with a suspicious file extension
Source: C:\Windows\SysWOW64\esentutl.exe File created: C:\Users\Public\alpha.pif Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe File created: C:\Users\Public\xpha.pif Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x.exe File created: C:\Users\Public\Libraries\joedgvvL.pif Jump to dropped file
Drops PE files
Source: C:\Windows\System32\extrac32.exe File created: C:\Users\user\AppData\Local\Temp\x.exe Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe File created: C:\Users\Public\alpha.pif Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe File created: C:\Users\Public\xpha.pif Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x.exe File created: C:\Users\Public\Libraries\joedgvvL.pif Jump to dropped file
Drops PE files to the user directory
Source: C:\Windows\SysWOW64\esentutl.exe File created: C:\Users\Public\alpha.pif Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe File created: C:\Users\Public\xpha.pif Jump to dropped file

Boot Survival
barindex
Drops PE files to the user root directory
Source: C:\Windows\SysWOW64\esentutl.exe File created: C:\Users\Public\alpha.pif Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe File created: C:\Users\Public\xpha.pif Jump to dropped file
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031EAB1C GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 4_2_031EAB1C
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Switches to a custom stack to bypass stack traces
Source: C:\Users\Public\Libraries\joedgvvL.pif API/Special instruction interceptor: Address: 7FFDB442D324
Source: C:\Users\Public\Libraries\joedgvvL.pif API/Special instruction interceptor: Address: 7FFDB4430774
Source: C:\Users\Public\Libraries\joedgvvL.pif API/Special instruction interceptor: Address: 7FFDB4430154
Source: C:\Users\Public\Libraries\joedgvvL.pif API/Special instruction interceptor: Address: 7FFDB442D8A4
Source: C:\Users\Public\Libraries\joedgvvL.pif API/Special instruction interceptor: Address: 7FFDB442DA44
Source: C:\Users\Public\Libraries\joedgvvL.pif API/Special instruction interceptor: Address: 7FFDB442D1E4
Source: C:\Windows\SysWOW64\cscript.exe API/Special instruction interceptor: Address: 7FFDB442D324
Source: C:\Windows\SysWOW64\cscript.exe API/Special instruction interceptor: Address: 7FFDB4430774
Source: C:\Windows\SysWOW64\cscript.exe API/Special instruction interceptor: Address: 7FFDB442D944
Source: C:\Windows\SysWOW64\cscript.exe API/Special instruction interceptor: Address: 7FFDB442D504
Source: C:\Windows\SysWOW64\cscript.exe API/Special instruction interceptor: Address: 7FFDB442D544
Source: C:\Windows\SysWOW64\cscript.exe API/Special instruction interceptor: Address: 7FFDB442D1E4
Source: C:\Windows\SysWOW64\cscript.exe API/Special instruction interceptor: Address: 7FFDB4430154
Source: C:\Windows\SysWOW64\cscript.exe API/Special instruction interceptor: Address: 7FFDB442D8A4
Source: C:\Windows\SysWOW64\cscript.exe API/Special instruction interceptor: Address: 7FFDB442DA44
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\Public\Libraries\joedgvvL.pif RDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\Public\Libraries\joedgvvL.pif RDTSC instruction interceptor: First address: 409B7E second address: 409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cscript.exe RDTSC instruction interceptor: First address: A39904 second address: A3990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cscript.exe RDTSC instruction interceptor: First address: A39B7E second address: A39B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_00409AB0 rdtsc 11_2_00409AB0
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 6997 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 2933 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 900 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 852 Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Window / User API: threadDelayed 1575 Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Window / User API: threadDelayed 8396 Jump to behavior
Found decision node followed by non-executed suspicious APIs
Source: C:\Windows\explorer.exe Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)
Found dropped PE file which has not been started or loaded
Source: C:\Windows\SysWOW64\esentutl.exe Dropped PE file which has not been started: C:\Users\Public\xpha.pif Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\Public\alpha.pif API coverage: 6.3 %
Source: C:\Users\Public\Libraries\joedgvvL.pif API coverage: 2.0 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 1864 Thread sleep count: 6997 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 1864 Thread sleep time: -13994000s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 1864 Thread sleep count: 2933 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 1864 Thread sleep time: -5866000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe TID: 2580 Thread sleep count: 1575 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe TID: 2580 Thread sleep time: -3150000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe TID: 2580 Thread sleep count: 8396 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe TID: 2580 Thread sleep time: -16792000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\cscript.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\cscript.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031D5908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA, 4_2_031D5908
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D20207 FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove, 10_2_00D20207
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D2589A FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose, 10_2_00D2589A
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D24EC1 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW, 10_2_00D24EC1
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D33E66 FindFirstFileW,FindNextFileW,FindClose, 10_2_00D33E66
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D1532E GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,??_V@YAXPAX@Z,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose, 10_2_00D1532E
Source: explorer.exe, 0000000C.00000002.4593351515.000000000C474000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: d'me#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94
Source: explorer.exe, 0000000C.00000000.2252238503.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000962B000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWystem32\DriverStore\en-US\msmouse.inf_locv
Source: explorer.exe, 0000000C.00000000.2252872203.00000000097F3000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 0000000C.00000000.2252238503.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000973C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWws
Source: x.exe, 00000004.00000002.2216401383.0000000000960000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW|
Source: explorer.exe, 0000000C.00000003.2979174181.00000000098AD000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}RoamingCom
Source: explorer.exe, 0000000C.00000000.2252238503.0000000009605000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: NXTVMWare
Source: explorer.exe, 0000000C.00000002.4578501898.0000000000D99000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: x.exe, 00000004.00000002.2216401383.00000000008FE000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000004.00000002.2216401383.0000000000960000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2252238503.000000000978C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 0000000C.00000002.4578501898.0000000000D99000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000W
Source: explorer.exe, 0000000C.00000002.4582974589.00000000073E5000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 0000000C.00000003.2979174181.00000000098AD000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}lnkramW6
Source: explorer.exe, 0000000C.00000002.4578501898.0000000000D99000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 0000000C.00000003.2979174181.00000000098AD000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: explorer.exe, 0000000C.00000002.4578501898.0000000000D99000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Users\user\AppData\Local\Temp\x.exe API call chain: ExitProcess graph end node
Source: C:\Users\Public\Libraries\joedgvvL.pif Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031EF744 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent, 4_2_031EF744
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\Temp\x.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\Public\Libraries\joedgvvL.pif Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_00409AB0 rdtsc 11_2_00409AB0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_0040ACF0 LdrLoadDll, 11_2_0040ACF0
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D32E37 IsDebuggerPresent, 10_2_00D32E37
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031E894C LoadLibraryW,GetProcAddress,FreeLibrary, 4_2_031E894C
Contains functionality to read the PEB
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D3C1FA mov eax, dword ptr fs:[00000030h] 10_2_00D3C1FA
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF46DF6 mov eax, dword ptr fs:[00000030h] 11_2_1DF46DF6
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7CDF0 mov eax, dword ptr fs:[00000030h] 11_2_1DF7CDF0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7CDF0 mov ecx, dword ptr fs:[00000030h] 11_2_1DF7CDF0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5ADE0 mov eax, dword ptr fs:[00000030h] 11_2_1DF5ADE0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5ADE0 mov eax, dword ptr fs:[00000030h] 11_2_1DF5ADE0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5ADE0 mov eax, dword ptr fs:[00000030h] 11_2_1DF5ADE0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5ADE0 mov eax, dword ptr fs:[00000030h] 11_2_1DF5ADE0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5ADE0 mov eax, dword ptr fs:[00000030h] 11_2_1DF5ADE0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5ADE0 mov eax, dword ptr fs:[00000030h] 11_2_1DF5ADE0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF70DE1 mov eax, dword ptr fs:[00000030h] 11_2_1DF70DE1
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4CDEA mov eax, dword ptr fs:[00000030h] 11_2_1DF4CDEA
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4CDEA mov eax, dword ptr fs:[00000030h] 11_2_1DF4CDEA
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7EDD3 mov eax, dword ptr fs:[00000030h] 11_2_1DF7EDD3
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7EDD3 mov eax, dword ptr fs:[00000030h] 11_2_1DF7EDD3
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF53DD0 mov eax, dword ptr fs:[00000030h] 11_2_1DF53DD0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF53DD0 mov eax, dword ptr fs:[00000030h] 11_2_1DF53DD0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD4DD7 mov eax, dword ptr fs:[00000030h] 11_2_1DFD4DD7
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD4DD7 mov eax, dword ptr fs:[00000030h] 11_2_1DFD4DD7
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFDDDC0 mov eax, dword ptr fs:[00000030h] 11_2_1DFDDDC0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00DE46 mov eax, dword ptr fs:[00000030h] 11_2_1E00DE46
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF6DDB1 mov eax, dword ptr fs:[00000030h] 11_2_1DF6DDB1
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF6DDB1 mov eax, dword ptr fs:[00000030h] 11_2_1DF6DDB1
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF6DDB1 mov eax, dword ptr fs:[00000030h] 11_2_1DF6DDB1
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF78DBF mov eax, dword ptr fs:[00000030h] 11_2_1DF78DBF
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF78DBF mov eax, dword ptr fs:[00000030h] 11_2_1DF78DBF
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8CDB1 mov ecx, dword ptr fs:[00000030h] 11_2_1DF8CDB1
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8CDB1 mov eax, dword ptr fs:[00000030h] 11_2_1DF8CDB1
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8CDB1 mov eax, dword ptr fs:[00000030h] 11_2_1DF8CDB1
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFDDDB1 mov eax, dword ptr fs:[00000030h] 11_2_1DFDDDB1
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E022E4F mov eax, dword ptr fs:[00000030h] 11_2_1E022E4F
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E022E4F mov eax, dword ptr fs:[00000030h] 11_2_1E022E4F
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF89DAF mov eax, dword ptr fs:[00000030h] 11_2_1DF89DAF
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF86DA0 mov eax, dword ptr fs:[00000030h] 11_2_1DF86DA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5FDA9 mov eax, dword ptr fs:[00000030h] 11_2_1DF5FDA9
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF49D96 mov eax, dword ptr fs:[00000030h] 11_2_1DF49D96
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF49D96 mov eax, dword ptr fs:[00000030h] 11_2_1DF49D96
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF49D96 mov ecx, dword ptr fs:[00000030h] 11_2_1DF49D96
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4FD80 mov eax, dword ptr fs:[00000030h] 11_2_1DF4FD80
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF57D75 mov eax, dword ptr fs:[00000030h] 11_2_1DF57D75
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF57D75 mov eax, dword ptr fs:[00000030h] 11_2_1DF57D75
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFFD78 mov eax, dword ptr fs:[00000030h] 11_2_1DFFFD78
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFFD78 mov eax, dword ptr fs:[00000030h] 11_2_1DFFFD78
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFFD78 mov eax, dword ptr fs:[00000030h] 11_2_1DFFFD78
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFFD78 mov eax, dword ptr fs:[00000030h] 11_2_1DFFFD78
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFFD78 mov eax, dword ptr fs:[00000030h] 11_2_1DFFFD78
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFE8D6B mov eax, dword ptr fs:[00000030h] 11_2_1DFE8D6B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF50D59 mov eax, dword ptr fs:[00000030h] 11_2_1DF50D59
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF50D59 mov eax, dword ptr fs:[00000030h] 11_2_1DF50D59
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF50D59 mov eax, dword ptr fs:[00000030h] 11_2_1DF50D59
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF58D59 mov eax, dword ptr fs:[00000030h] 11_2_1DF58D59
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF58D59 mov eax, dword ptr fs:[00000030h] 11_2_1DF58D59
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF58D59 mov eax, dword ptr fs:[00000030h] 11_2_1DF58D59
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF58D59 mov eax, dword ptr fs:[00000030h] 11_2_1DF58D59
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF58D59 mov eax, dword ptr fs:[00000030h] 11_2_1DF58D59
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00DEB0 mov eax, dword ptr fs:[00000030h] 11_2_1E00DEB0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF47D41 mov eax, dword ptr fs:[00000030h] 11_2_1DF47D41
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h] 11_2_1DF63D40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h] 11_2_1DF63D40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h] 11_2_1DF63D40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h] 11_2_1DF63D40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D40 mov ecx, dword ptr fs:[00000030h] 11_2_1DF63D40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D40 mov ecx, dword ptr fs:[00000030h] 11_2_1DF63D40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h] 11_2_1DF63D40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D40 mov ecx, dword ptr fs:[00000030h] 11_2_1DF63D40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D40 mov ecx, dword ptr fs:[00000030h] 11_2_1DF63D40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h] 11_2_1DF63D40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D40 mov ecx, dword ptr fs:[00000030h] 11_2_1DF63D40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D40 mov ecx, dword ptr fs:[00000030h] 11_2_1DF63D40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h] 11_2_1DF63D40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h] 11_2_1DF63D40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h] 11_2_1DF63D40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h] 11_2_1DF63D40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h] 11_2_1DF63D40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h] 11_2_1DF63D40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h] 11_2_1DF63D40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D40 mov eax, dword ptr fs:[00000030h] 11_2_1DF63D40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8BD4E mov eax, dword ptr fs:[00000030h] 11_2_1DF8BD4E
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8BD4E mov eax, dword ptr fs:[00000030h] 11_2_1DF8BD4E
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFDDD47 mov eax, dword ptr fs:[00000030h] 11_2_1DFDDD47
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D20 mov eax, dword ptr fs:[00000030h] 11_2_1DF63D20
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFDFD2A mov eax, dword ptr fs:[00000030h] 11_2_1DFDFD2A
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFDFD2A mov eax, dword ptr fs:[00000030h] 11_2_1DFDFD2A
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF46D10 mov eax, dword ptr fs:[00000030h] 11_2_1DF46D10
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF46D10 mov eax, dword ptr fs:[00000030h] 11_2_1DF46D10
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF46D10 mov eax, dword ptr fs:[00000030h] 11_2_1DF46D10
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF84D1D mov eax, dword ptr fs:[00000030h] 11_2_1DF84D1D
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01BEE6 mov eax, dword ptr fs:[00000030h] 11_2_1E01BEE6
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01BEE6 mov eax, dword ptr fs:[00000030h] 11_2_1E01BEE6
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01BEE6 mov eax, dword ptr fs:[00000030h] 11_2_1E01BEE6
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01BEE6 mov eax, dword ptr fs:[00000030h] 11_2_1E01BEE6
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF63D00 mov eax, dword ptr fs:[00000030h] 11_2_1DF63D00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF6AD00 mov eax, dword ptr fs:[00000030h] 11_2_1DF6AD00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF6AD00 mov eax, dword ptr fs:[00000030h] 11_2_1DF6AD00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF6AD00 mov eax, dword ptr fs:[00000030h] 11_2_1DF6AD00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E006F00 mov eax, dword ptr fs:[00000030h] 11_2_1E006F00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFF1CF9 mov eax, dword ptr fs:[00000030h] 11_2_1DFF1CF9
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFF1CF9 mov eax, dword ptr fs:[00000030h] 11_2_1DFF1CF9
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFF1CF9 mov eax, dword ptr fs:[00000030h] 11_2_1DFF1CF9
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF82CF0 mov eax, dword ptr fs:[00000030h] 11_2_1DF82CF0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF82CF0 mov eax, dword ptr fs:[00000030h] 11_2_1DF82CF0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF82CF0 mov eax, dword ptr fs:[00000030h] 11_2_1DF82CF0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF82CF0 mov eax, dword ptr fs:[00000030h] 11_2_1DF82CF0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFFCDF mov eax, dword ptr fs:[00000030h] 11_2_1DFFFCDF
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFFCDF mov eax, dword ptr fs:[00000030h] 11_2_1DFFFCDF
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFFCDF mov eax, dword ptr fs:[00000030h] 11_2_1DFFFCDF
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF47CD5 mov eax, dword ptr fs:[00000030h] 11_2_1DF47CD5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF47CD5 mov eax, dword ptr fs:[00000030h] 11_2_1DF47CD5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF47CD5 mov eax, dword ptr fs:[00000030h] 11_2_1DF47CD5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF47CD5 mov eax, dword ptr fs:[00000030h] 11_2_1DF47CD5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF47CD5 mov eax, dword ptr fs:[00000030h] 11_2_1DF47CD5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD3CDB mov eax, dword ptr fs:[00000030h] 11_2_1DFD3CDB
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD3CDB mov eax, dword ptr fs:[00000030h] 11_2_1DFD3CDB
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD3CDB mov eax, dword ptr fs:[00000030h] 11_2_1DFD3CDB
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00DF2F mov eax, dword ptr fs:[00000030h] 11_2_1E00DF2F
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF61CC7 mov eax, dword ptr fs:[00000030h] 11_2_1DF61CC7
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF61CC7 mov eax, dword ptr fs:[00000030h] 11_2_1DF61CC7
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF85CC0 mov eax, dword ptr fs:[00000030h] 11_2_1DF85CC0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF85CC0 mov eax, dword ptr fs:[00000030h] 11_2_1DF85CC0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4CCC8 mov eax, dword ptr fs:[00000030h] 11_2_1DF4CCC8
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF78CB1 mov eax, dword ptr fs:[00000030h] 11_2_1DF78CB1
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF78CB1 mov eax, dword ptr fs:[00000030h] 11_2_1DF78CB1
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4DCA0 mov eax, dword ptr fs:[00000030h] 11_2_1DF4DCA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7FCA0 mov ecx, dword ptr fs:[00000030h] 11_2_1DF7FCA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7FCA0 mov eax, dword ptr fs:[00000030h] 11_2_1DF7FCA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7FCA0 mov eax, dword ptr fs:[00000030h] 11_2_1DF7FCA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7FCA0 mov eax, dword ptr fs:[00000030h] 11_2_1DF7FCA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7FCA0 mov eax, dword ptr fs:[00000030h] 11_2_1DF7FCA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8BCA0 mov eax, dword ptr fs:[00000030h] 11_2_1DF8BCA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8BCA0 mov eax, dword ptr fs:[00000030h] 11_2_1DF8BCA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8BCA0 mov ecx, dword ptr fs:[00000030h] 11_2_1DF8BCA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8BCA0 mov eax, dword ptr fs:[00000030h] 11_2_1DF8BCA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFCCCA0 mov ecx, dword ptr fs:[00000030h] 11_2_1DFCCCA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFCCCA0 mov eax, dword ptr fs:[00000030h] 11_2_1DFCCCA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFCCCA0 mov eax, dword ptr fs:[00000030h] 11_2_1DFCCCA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFCCCA0 mov eax, dword ptr fs:[00000030h] 11_2_1DFCCCA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E024F68 mov eax, dword ptr fs:[00000030h] 11_2_1E024F68
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF53C84 mov eax, dword ptr fs:[00000030h] 11_2_1DF53C84
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF53C84 mov eax, dword ptr fs:[00000030h] 11_2_1DF53C84
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF53C84 mov eax, dword ptr fs:[00000030h] 11_2_1DF53C84
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF53C84 mov eax, dword ptr fs:[00000030h] 11_2_1DF53C84
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF48C8D mov eax, dword ptr fs:[00000030h] 11_2_1DF48C8D
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF81C7C mov eax, dword ptr fs:[00000030h] 11_2_1DF81C7C
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF61C60 mov eax, dword ptr fs:[00000030h] 11_2_1DF61C60
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF84C59 mov eax, dword ptr fs:[00000030h] 11_2_1DF84C59
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5AC50 mov eax, dword ptr fs:[00000030h] 11_2_1DF5AC50
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5AC50 mov eax, dword ptr fs:[00000030h] 11_2_1DF5AC50
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5AC50 mov eax, dword ptr fs:[00000030h] 11_2_1DF5AC50
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5AC50 mov eax, dword ptr fs:[00000030h] 11_2_1DF5AC50
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5AC50 mov eax, dword ptr fs:[00000030h] 11_2_1DF5AC50
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5AC50 mov eax, dword ptr fs:[00000030h] 11_2_1DF5AC50
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF56C50 mov eax, dword ptr fs:[00000030h] 11_2_1DF56C50
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF56C50 mov eax, dword ptr fs:[00000030h] 11_2_1DF56C50
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF56C50 mov eax, dword ptr fs:[00000030h] 11_2_1DF56C50
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF47C40 mov eax, dword ptr fs:[00000030h] 11_2_1DF47C40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF47C40 mov ecx, dword ptr fs:[00000030h] 11_2_1DF47C40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF47C40 mov eax, dword ptr fs:[00000030h] 11_2_1DF47C40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF47C40 mov eax, dword ptr fs:[00000030h] 11_2_1DF47C40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00BFC0 mov ecx, dword ptr fs:[00000030h] 11_2_1E00BFC0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00BFC0 mov eax, dword ptr fs:[00000030h] 11_2_1E00BFC0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8BC3B mov esi, dword ptr fs:[00000030h] 11_2_1DF8BC3B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD9C32 mov eax, dword ptr fs:[00000030h] 11_2_1DFD9C32
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4EC20 mov eax, dword ptr fs:[00000030h] 11_2_1DF4EC20
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E024FE7 mov eax, dword ptr fs:[00000030h] 11_2_1E024FE7
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF60C00 mov eax, dword ptr fs:[00000030h] 11_2_1DF60C00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF60C00 mov eax, dword ptr fs:[00000030h] 11_2_1DF60C00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF60C00 mov eax, dword ptr fs:[00000030h] 11_2_1DF60C00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF60C00 mov eax, dword ptr fs:[00000030h] 11_2_1DF60C00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E006FF7 mov eax, dword ptr fs:[00000030h] 11_2_1E006FF7
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8CC00 mov eax, dword ptr fs:[00000030h] 11_2_1DF8CC00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E02BC01 mov eax, dword ptr fs:[00000030h] 11_2_1E02BC01
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E02BC01 mov eax, dword ptr fs:[00000030h] 11_2_1E02BC01
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF90FF6 mov eax, dword ptr fs:[00000030h] 11_2_1DF90FF6
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF90FF6 mov eax, dword ptr fs:[00000030h] 11_2_1DF90FF6
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF90FF6 mov eax, dword ptr fs:[00000030h] 11_2_1DF90FF6
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF90FF6 mov eax, dword ptr fs:[00000030h] 11_2_1DF90FF6
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8BFEC mov eax, dword ptr fs:[00000030h] 11_2_1DF8BFEC
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8BFEC mov eax, dword ptr fs:[00000030h] 11_2_1DF8BFEC
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8BFEC mov eax, dword ptr fs:[00000030h] 11_2_1DF8BFEC
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF6CFE0 mov eax, dword ptr fs:[00000030h] 11_2_1DF6CFE0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF6CFE0 mov eax, dword ptr fs:[00000030h] 11_2_1DF6CFE0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4BFD0 mov eax, dword ptr fs:[00000030h] 11_2_1DF4BFD0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01DC27 mov eax, dword ptr fs:[00000030h] 11_2_1E01DC27
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01DC27 mov eax, dword ptr fs:[00000030h] 11_2_1E01DC27
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01DC27 mov eax, dword ptr fs:[00000030h] 11_2_1E01DC27
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD3FD7 mov eax, dword ptr fs:[00000030h] 11_2_1DFD3FD7
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4EFD8 mov eax, dword ptr fs:[00000030h] 11_2_1DF4EFD8
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4EFD8 mov eax, dword ptr fs:[00000030h] 11_2_1DF4EFD8
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4EFD8 mov eax, dword ptr fs:[00000030h] 11_2_1DF4EFD8
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF81FCD mov eax, dword ptr fs:[00000030h] 11_2_1DF81FCD
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF81FCD mov eax, dword ptr fs:[00000030h] 11_2_1DF81FCD
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF81FCD mov eax, dword ptr fs:[00000030h] 11_2_1DF81FCD
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF53FC2 mov eax, dword ptr fs:[00000030h] 11_2_1DF53FC2
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF52FC8 mov eax, dword ptr fs:[00000030h] 11_2_1DF52FC8
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF52FC8 mov eax, dword ptr fs:[00000030h] 11_2_1DF52FC8
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF52FC8 mov eax, dword ptr fs:[00000030h] 11_2_1DF52FC8
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF52FC8 mov eax, dword ptr fs:[00000030h] 11_2_1DF52FC8
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E021C3C mov eax, dword ptr fs:[00000030h] 11_2_1E021C3C
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF91FB8 mov eax, dword ptr fs:[00000030h] 11_2_1DF91FB8
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8BFB0 mov eax, dword ptr fs:[00000030h] 11_2_1DF8BFB0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00FC4F mov eax, dword ptr fs:[00000030h] 11_2_1E00FC4F
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF82F98 mov eax, dword ptr fs:[00000030h] 11_2_1DF82F98
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF82F98 mov eax, dword ptr fs:[00000030h] 11_2_1DF82F98
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF61F92 mov ecx, dword ptr fs:[00000030h] 11_2_1DF61F92
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF61F92 mov ecx, dword ptr fs:[00000030h] 11_2_1DF61F92
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF61F92 mov eax, dword ptr fs:[00000030h] 11_2_1DF61F92
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF61F92 mov ecx, dword ptr fs:[00000030h] 11_2_1DF61F92
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF61F92 mov ecx, dword ptr fs:[00000030h] 11_2_1DF61F92
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF61F92 mov eax, dword ptr fs:[00000030h] 11_2_1DF61F92
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF61F92 mov ecx, dword ptr fs:[00000030h] 11_2_1DF61F92
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF61F92 mov ecx, dword ptr fs:[00000030h] 11_2_1DF61F92
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF61F92 mov eax, dword ptr fs:[00000030h] 11_2_1DF61F92
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF61F92 mov ecx, dword ptr fs:[00000030h] 11_2_1DF61F92
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF61F92 mov ecx, dword ptr fs:[00000030h] 11_2_1DF61F92
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF61F92 mov eax, dword ptr fs:[00000030h] 11_2_1DF61F92
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4FF90 mov edi, dword ptr fs:[00000030h] 11_2_1DF4FF90
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8CF80 mov eax, dword ptr fs:[00000030h] 11_2_1DF8CF80
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7BF60 mov eax, dword ptr fs:[00000030h] 11_2_1DF7BF60
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7AF69 mov eax, dword ptr fs:[00000030h] 11_2_1DF7AF69
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7AF69 mov eax, dword ptr fs:[00000030h] 11_2_1DF7AF69
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4CF50 mov eax, dword ptr fs:[00000030h] 11_2_1DF4CF50
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4CF50 mov eax, dword ptr fs:[00000030h] 11_2_1DF4CF50
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4CF50 mov eax, dword ptr fs:[00000030h] 11_2_1DF4CF50
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4CF50 mov eax, dword ptr fs:[00000030h] 11_2_1DF4CF50
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4CF50 mov eax, dword ptr fs:[00000030h] 11_2_1DF4CF50
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4CF50 mov eax, dword ptr fs:[00000030h] 11_2_1DF4CF50
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF51F50 mov eax, dword ptr fs:[00000030h] 11_2_1DF51F50
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8CF50 mov eax, dword ptr fs:[00000030h] 11_2_1DF8CF50
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF87F51 mov eax, dword ptr fs:[00000030h] 11_2_1DF87F51
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h] 11_2_1E00FCAB
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h] 11_2_1E00FCAB
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h] 11_2_1E00FCAB
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h] 11_2_1E00FCAB
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h] 11_2_1E00FCAB
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h] 11_2_1E00FCAB
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h] 11_2_1E00FCAB
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h] 11_2_1E00FCAB
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h] 11_2_1E00FCAB
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h] 11_2_1E00FCAB
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h] 11_2_1E00FCAB
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h] 11_2_1E00FCAB
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h] 11_2_1E00FCAB
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00FCAB mov eax, dword ptr fs:[00000030h] 11_2_1E00FCAB
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h] 11_2_1E000CB5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h] 11_2_1E000CB5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h] 11_2_1E000CB5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h] 11_2_1E000CB5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h] 11_2_1E000CB5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h] 11_2_1E000CB5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h] 11_2_1E000CB5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h] 11_2_1E000CB5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h] 11_2_1E000CB5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h] 11_2_1E000CB5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h] 11_2_1E000CB5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h] 11_2_1E000CB5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E000CB5 mov eax, dword ptr fs:[00000030h] 11_2_1E000CB5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD4F40 mov eax, dword ptr fs:[00000030h] 11_2_1DFD4F40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD4F40 mov eax, dword ptr fs:[00000030h] 11_2_1DFD4F40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD4F40 mov eax, dword ptr fs:[00000030h] 11_2_1DFD4F40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD4F40 mov eax, dword ptr fs:[00000030h] 11_2_1DFD4F40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFCFF42 mov eax, dword ptr fs:[00000030h] 11_2_1DFCFF42
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFF7F3E mov eax, dword ptr fs:[00000030h] 11_2_1DFF7F3E
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7EF28 mov eax, dword ptr fs:[00000030h] 11_2_1DF7EF28
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF52F12 mov eax, dword ptr fs:[00000030h] 11_2_1DF52F12
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8CF1F mov eax, dword ptr fs:[00000030h] 11_2_1DF8CF1F
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFDDF10 mov eax, dword ptr fs:[00000030h] 11_2_1DFDDF10
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD1F13 mov eax, dword ptr fs:[00000030h] 11_2_1DFD1F13
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF53EF4 mov eax, dword ptr fs:[00000030h] 11_2_1DF53EF4
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF53EF4 mov eax, dword ptr fs:[00000030h] 11_2_1DF53EF4
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF53EF4 mov eax, dword ptr fs:[00000030h] 11_2_1DF53EF4
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF88EF5 mov eax, dword ptr fs:[00000030h] 11_2_1DF88EF5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E008D10 mov eax, dword ptr fs:[00000030h] 11_2_1E008D10
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E008D10 mov eax, dword ptr fs:[00000030h] 11_2_1E008D10
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF83EEB mov ecx, dword ptr fs:[00000030h] 11_2_1DF83EEB
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF83EEB mov eax, dword ptr fs:[00000030h] 11_2_1DF83EEB
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF83EEB mov eax, dword ptr fs:[00000030h] 11_2_1DF83EEB
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF53EE1 mov eax, dword ptr fs:[00000030h] 11_2_1DF53EE1
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF56EE0 mov eax, dword ptr fs:[00000030h] 11_2_1DF56EE0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF56EE0 mov eax, dword ptr fs:[00000030h] 11_2_1DF56EE0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF56EE0 mov eax, dword ptr fs:[00000030h] 11_2_1DF56EE0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF56EE0 mov eax, dword ptr fs:[00000030h] 11_2_1DF56EE0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4BEC0 mov eax, dword ptr fs:[00000030h] 11_2_1DF4BEC0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4BEC0 mov eax, dword ptr fs:[00000030h] 11_2_1DF4BEC0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5BEC0 mov eax, dword ptr fs:[00000030h] 11_2_1DF5BEC0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5BEC0 mov eax, dword ptr fs:[00000030h] 11_2_1DF5BEC0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5BEC0 mov eax, dword ptr fs:[00000030h] 11_2_1DF5BEC0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5BEC0 mov eax, dword ptr fs:[00000030h] 11_2_1DF5BEC0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5BEC0 mov eax, dword ptr fs:[00000030h] 11_2_1DF5BEC0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5BEC0 mov eax, dword ptr fs:[00000030h] 11_2_1DF5BEC0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5BEC0 mov eax, dword ptr fs:[00000030h] 11_2_1DF5BEC0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5BEC0 mov eax, dword ptr fs:[00000030h] 11_2_1DF5BEC0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7FEC0 mov eax, dword ptr fs:[00000030h] 11_2_1DF7FEC0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFDFEC5 mov eax, dword ptr fs:[00000030h] 11_2_1DFDFEC5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFEAEB0 mov eax, dword ptr fs:[00000030h] 11_2_1DFEAEB0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFEAEB0 mov eax, dword ptr fs:[00000030h] 11_2_1DFEAEB0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4DEA5 mov eax, dword ptr fs:[00000030h] 11_2_1DF4DEA5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4DEA5 mov ecx, dword ptr fs:[00000030h] 11_2_1DF4DEA5
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4FEA0 mov eax, dword ptr fs:[00000030h] 11_2_1DF4FEA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFDDEAA mov eax, dword ptr fs:[00000030h] 11_2_1DFDDEAA
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E011D5A mov eax, dword ptr fs:[00000030h] 11_2_1E011D5A
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E011D5A mov eax, dword ptr fs:[00000030h] 11_2_1E011D5A
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E011D5A mov eax, dword ptr fs:[00000030h] 11_2_1E011D5A
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E011D5A mov eax, dword ptr fs:[00000030h] 11_2_1E011D5A
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFDCEA0 mov eax, dword ptr fs:[00000030h] 11_2_1DFDCEA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFDCEA0 mov eax, dword ptr fs:[00000030h] 11_2_1DFDCEA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFDCEA0 mov eax, dword ptr fs:[00000030h] 11_2_1DFDCEA0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF57E96 mov eax, dword ptr fs:[00000030h] 11_2_1DF57E96
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF82E9C mov eax, dword ptr fs:[00000030h] 11_2_1DF82E9C
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF82E9C mov ecx, dword ptr fs:[00000030h] 11_2_1DF82E9C
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4AE90 mov eax, dword ptr fs:[00000030h] 11_2_1DF4AE90
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4AE90 mov eax, dword ptr fs:[00000030h] 11_2_1DF4AE90
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4AE90 mov eax, dword ptr fs:[00000030h] 11_2_1DF4AE90
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFDDE9B mov eax, dword ptr fs:[00000030h] 11_2_1DFDDE9B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF83E8F mov eax, dword ptr fs:[00000030h] 11_2_1DF83E8F
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD0E7F mov eax, dword ptr fs:[00000030h] 11_2_1DFD0E7F
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD0E7F mov eax, dword ptr fs:[00000030h] 11_2_1DFD0E7F
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD0E7F mov eax, dword ptr fs:[00000030h] 11_2_1DFD0E7F
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF56E71 mov eax, dword ptr fs:[00000030h] 11_2_1DF56E71
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4BE78 mov ecx, dword ptr fs:[00000030h] 11_2_1DF4BE78
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8BE51 mov eax, dword ptr fs:[00000030h] 11_2_1DF8BE51
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8BE51 mov eax, dword ptr fs:[00000030h] 11_2_1DF8BE51
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4EE5A mov eax, dword ptr fs:[00000030h] 11_2_1DF4EE5A
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E018DAE mov eax, dword ptr fs:[00000030h] 11_2_1E018DAE
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E018DAE mov eax, dword ptr fs:[00000030h] 11_2_1E018DAE
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E024DAD mov eax, dword ptr fs:[00000030h] 11_2_1E024DAD
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF65E40 mov eax, dword ptr fs:[00000030h] 11_2_1DF65E40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF51E30 mov eax, dword ptr fs:[00000030h] 11_2_1DF51E30
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF51E30 mov eax, dword ptr fs:[00000030h] 11_2_1DF51E30
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01DDC6 mov eax, dword ptr fs:[00000030h] 11_2_1E01DDC6
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00DDC7 mov eax, dword ptr fs:[00000030h] 11_2_1E00DDC7
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF6DE2D mov eax, dword ptr fs:[00000030h] 11_2_1DF6DE2D
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF6DE2D mov eax, dword ptr fs:[00000030h] 11_2_1DF6DE2D
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF6DE2D mov eax, dword ptr fs:[00000030h] 11_2_1DF6DE2D
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4DE10 mov eax, dword ptr fs:[00000030h] 11_2_1DF4DE10
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF48E1D mov eax, dword ptr fs:[00000030h] 11_2_1DF48E1D
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7AE00 mov eax, dword ptr fs:[00000030h] 11_2_1DF7AE00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7AE00 mov eax, dword ptr fs:[00000030h] 11_2_1DF7AE00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7AE00 mov eax, dword ptr fs:[00000030h] 11_2_1DF7AE00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7AE00 mov ecx, dword ptr fs:[00000030h] 11_2_1DF7AE00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7AE00 mov eax, dword ptr fs:[00000030h] 11_2_1DF7AE00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7AE00 mov eax, dword ptr fs:[00000030h] 11_2_1DF7AE00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7AE00 mov eax, dword ptr fs:[00000030h] 11_2_1DF7AE00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7AE00 mov eax, dword ptr fs:[00000030h] 11_2_1DF7AE00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7AE00 mov eax, dword ptr fs:[00000030h] 11_2_1DF7AE00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7AE00 mov eax, dword ptr fs:[00000030h] 11_2_1DF7AE00
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF829F9 mov eax, dword ptr fs:[00000030h] 11_2_1DF829F9
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF829F9 mov eax, dword ptr fs:[00000030h] 11_2_1DF829F9
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00FA02 mov eax, dword ptr fs:[00000030h] 11_2_1E00FA02
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5A9D0 mov eax, dword ptr fs:[00000030h] 11_2_1DF5A9D0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5A9D0 mov eax, dword ptr fs:[00000030h] 11_2_1DF5A9D0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5A9D0 mov eax, dword ptr fs:[00000030h] 11_2_1DF5A9D0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5A9D0 mov eax, dword ptr fs:[00000030h] 11_2_1DF5A9D0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5A9D0 mov eax, dword ptr fs:[00000030h] 11_2_1DF5A9D0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5A9D0 mov eax, dword ptr fs:[00000030h] 11_2_1DF5A9D0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7D9D0 mov eax, dword ptr fs:[00000030h] 11_2_1DF7D9D0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7D9D0 mov eax, dword ptr fs:[00000030h] 11_2_1DF7D9D0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7D9D0 mov esi, dword ptr fs:[00000030h] 11_2_1DF7D9D0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7D9D0 mov eax, dword ptr fs:[00000030h] 11_2_1DF7D9D0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7D9D0 mov eax, dword ptr fs:[00000030h] 11_2_1DF7D9D0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7D9D0 mov eax, dword ptr fs:[00000030h] 11_2_1DF7D9D0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7D9D0 mov eax, dword ptr fs:[00000030h] 11_2_1DF7D9D0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7D9D0 mov eax, dword ptr fs:[00000030h] 11_2_1DF7D9D0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF849D0 mov eax, dword ptr fs:[00000030h] 11_2_1DF849D0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF559C0 mov eax, dword ptr fs:[00000030h] 11_2_1DF559C0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF559C0 mov eax, dword ptr fs:[00000030h] 11_2_1DF559C0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF559C0 mov eax, dword ptr fs:[00000030h] 11_2_1DF559C0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF559C0 mov eax, dword ptr fs:[00000030h] 11_2_1DF559C0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF599BE mov eax, dword ptr fs:[00000030h] 11_2_1DF599BE
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD89B3 mov esi, dword ptr fs:[00000030h] 11_2_1DFD89B3
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD89B3 mov eax, dword ptr fs:[00000030h] 11_2_1DFD89B3
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD89B3 mov eax, dword ptr fs:[00000030h] 11_2_1DFD89B3
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h] 11_2_1DF629A0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h] 11_2_1DF629A0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h] 11_2_1DF629A0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h] 11_2_1DF629A0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h] 11_2_1DF629A0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h] 11_2_1DF629A0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h] 11_2_1DF629A0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h] 11_2_1DF629A0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h] 11_2_1DF629A0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h] 11_2_1DF629A0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h] 11_2_1DF629A0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h] 11_2_1DF629A0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF629A0 mov eax, dword ptr fs:[00000030h] 11_2_1DF629A0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF509AD mov eax, dword ptr fs:[00000030h] 11_2_1DF509AD
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF509AD mov eax, dword ptr fs:[00000030h] 11_2_1DF509AD
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h] 11_2_1DFFF99B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h] 11_2_1DFFF99B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h] 11_2_1DFFF99B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h] 11_2_1DFFF99B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h] 11_2_1DFFF99B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h] 11_2_1DFFF99B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFF99B mov ecx, dword ptr fs:[00000030h] 11_2_1DFFF99B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFF99B mov ecx, dword ptr fs:[00000030h] 11_2_1DFFF99B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h] 11_2_1DFFF99B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h] 11_2_1DFFF99B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h] 11_2_1DFFF99B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h] 11_2_1DFFF99B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFFF99B mov eax, dword ptr fs:[00000030h] 11_2_1DFFF99B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4B991 mov eax, dword ptr fs:[00000030h] 11_2_1DF4B991
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4B991 mov eax, dword ptr fs:[00000030h] 11_2_1DF4B991
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFDC97C mov eax, dword ptr fs:[00000030h] 11_2_1DFDC97C
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E024A80 mov eax, dword ptr fs:[00000030h] 11_2_1E024A80
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00FA87 mov eax, dword ptr fs:[00000030h] 11_2_1E00FA87
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8B970 mov eax, dword ptr fs:[00000030h] 11_2_1DF8B970
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8B970 mov eax, dword ptr fs:[00000030h] 11_2_1DF8B970
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8B970 mov eax, dword ptr fs:[00000030h] 11_2_1DF8B970
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7D978 mov eax, dword ptr fs:[00000030h] 11_2_1DF7D978
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF47967 mov eax, dword ptr fs:[00000030h] 11_2_1DF47967
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF77962 mov eax, dword ptr fs:[00000030h] 11_2_1DF77962
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF76962 mov eax, dword ptr fs:[00000030h] 11_2_1DF76962
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF76962 mov eax, dword ptr fs:[00000030h] 11_2_1DF76962
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF76962 mov eax, dword ptr fs:[00000030h] 11_2_1DF76962
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8196E mov eax, dword ptr fs:[00000030h] 11_2_1DF8196E
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8196E mov eax, dword ptr fs:[00000030h] 11_2_1DF8196E
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF9096E mov eax, dword ptr fs:[00000030h] 11_2_1DF9096E
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF9096E mov edx, dword ptr fs:[00000030h] 11_2_1DF9096E
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF9096E mov eax, dword ptr fs:[00000030h] 11_2_1DF9096E
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5F950 mov eax, dword ptr fs:[00000030h] 11_2_1DF5F950
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF5F950 mov eax, dword ptr fs:[00000030h] 11_2_1DF5F950
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF69950 mov eax, dword ptr fs:[00000030h] 11_2_1DF69950
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF69950 mov eax, dword ptr fs:[00000030h] 11_2_1DF69950
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD0946 mov eax, dword ptr fs:[00000030h] 11_2_1DFD0946
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF47931 mov eax, dword ptr fs:[00000030h] 11_2_1DF47931
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFD892A mov eax, dword ptr fs:[00000030h] 11_2_1DFD892A
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h] 11_2_1DF4F910
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h] 11_2_1DF4F910
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h] 11_2_1DF4F910
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h] 11_2_1DF4F910
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h] 11_2_1DF4F910
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h] 11_2_1DF4F910
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h] 11_2_1DF4F910
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h] 11_2_1DF4F910
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h] 11_2_1DF4F910
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h] 11_2_1DF4F910
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4F910 mov eax, dword ptr fs:[00000030h] 11_2_1DF4F910
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF48918 mov eax, dword ptr fs:[00000030h] 11_2_1DF48918
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF48918 mov eax, dword ptr fs:[00000030h] 11_2_1DF48918
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7B919 mov eax, dword ptr fs:[00000030h] 11_2_1DF7B919
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFDC912 mov eax, dword ptr fs:[00000030h] 11_2_1DFDC912
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFCE908 mov eax, dword ptr fs:[00000030h] 11_2_1DFCE908
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFCE908 mov eax, dword ptr fs:[00000030h] 11_2_1DFCE908
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8C8F9 mov eax, dword ptr fs:[00000030h] 11_2_1DF8C8F9
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8C8F9 mov eax, dword ptr fs:[00000030h] 11_2_1DF8C8F9
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00FB0C mov eax, dword ptr fs:[00000030h] 11_2_1E00FB0C
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF638E0 mov eax, dword ptr fs:[00000030h] 11_2_1DF638E0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF638E0 mov eax, dword ptr fs:[00000030h] 11_2_1DF638E0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF638E0 mov eax, dword ptr fs:[00000030h] 11_2_1DF638E0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E018B28 mov eax, dword ptr fs:[00000030h] 11_2_1E018B28
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E018B28 mov eax, dword ptr fs:[00000030h] 11_2_1E018B28
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF578D9 mov eax, dword ptr fs:[00000030h] 11_2_1DF578D9
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF578D9 mov eax, dword ptr fs:[00000030h] 11_2_1DF578D9
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF538C4 mov eax, dword ptr fs:[00000030h] 11_2_1DF538C4
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF538C4 mov eax, dword ptr fs:[00000030h] 11_2_1DF538C4
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF538C4 mov eax, dword ptr fs:[00000030h] 11_2_1DF538C4
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF538C4 mov eax, dword ptr fs:[00000030h] 11_2_1DF538C4
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF538C4 mov eax, dword ptr fs:[00000030h] 11_2_1DF538C4
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF538C4 mov eax, dword ptr fs:[00000030h] 11_2_1DF538C4
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF538C4 mov eax, dword ptr fs:[00000030h] 11_2_1DF538C4
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF7E8C0 mov eax, dword ptr fs:[00000030h] 11_2_1DF7E8C0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E01AB40 mov eax, dword ptr fs:[00000030h] 11_2_1E01AB40
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFDC89D mov eax, dword ptr fs:[00000030h] 11_2_1DFDC89D
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF50887 mov eax, dword ptr fs:[00000030h] 11_2_1DF50887
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E019B8B mov eax, dword ptr fs:[00000030h] 11_2_1E019B8B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E019B8B mov eax, dword ptr fs:[00000030h] 11_2_1E019B8B
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4D878 mov eax, dword ptr fs:[00000030h] 11_2_1DF4D878
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF81876 mov eax, dword ptr fs:[00000030h] 11_2_1DF81876
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF81876 mov eax, dword ptr fs:[00000030h] 11_2_1DF81876
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFE6870 mov eax, dword ptr fs:[00000030h] 11_2_1DFE6870
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFE6870 mov eax, dword ptr fs:[00000030h] 11_2_1DFE6870
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF4D860 mov eax, dword ptr fs:[00000030h] 11_2_1DF4D860
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00FB97 mov eax, dword ptr fs:[00000030h] 11_2_1E00FB97
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF54859 mov eax, dword ptr fs:[00000030h] 11_2_1DF54859
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF54859 mov eax, dword ptr fs:[00000030h] 11_2_1DF54859
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF80854 mov eax, dword ptr fs:[00000030h] 11_2_1DF80854
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF62840 mov ecx, dword ptr fs:[00000030h] 11_2_1DF62840
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF91843 mov eax, dword ptr fs:[00000030h] 11_2_1DF91843
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF91843 mov eax, dword ptr fs:[00000030h] 11_2_1DF91843
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF91843 mov eax, dword ptr fs:[00000030h] 11_2_1DF91843
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF91843 mov eax, dword ptr fs:[00000030h] 11_2_1DF91843
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF91843 mov eax, dword ptr fs:[00000030h] 11_2_1DF91843
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF91843 mov eax, dword ptr fs:[00000030h] 11_2_1DF91843
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF72835 mov eax, dword ptr fs:[00000030h] 11_2_1DF72835
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF72835 mov eax, dword ptr fs:[00000030h] 11_2_1DF72835
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF72835 mov eax, dword ptr fs:[00000030h] 11_2_1DF72835
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF72835 mov ecx, dword ptr fs:[00000030h] 11_2_1DF72835
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF72835 mov eax, dword ptr fs:[00000030h] 11_2_1DF72835
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF72835 mov eax, dword ptr fs:[00000030h] 11_2_1DF72835
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8A830 mov eax, dword ptr fs:[00000030h] 11_2_1DF8A830
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF8182A mov eax, dword ptr fs:[00000030h] 11_2_1DF8182A
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF83820 mov eax, dword ptr fs:[00000030h] 11_2_1DF83820
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFDD820 mov ecx, dword ptr fs:[00000030h] 11_2_1DFDD820
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFDD820 mov eax, dword ptr fs:[00000030h] 11_2_1DFDD820
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFDD820 mov eax, dword ptr fs:[00000030h] 11_2_1DFDD820
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DFDC810 mov eax, dword ptr fs:[00000030h] 11_2_1DFDC810
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF79803 mov eax, dword ptr fs:[00000030h] 11_2_1DF79803
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF58BF0 mov eax, dword ptr fs:[00000030h] 11_2_1DF58BF0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF58BF0 mov eax, dword ptr fs:[00000030h] 11_2_1DF58BF0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1DF58BF0 mov eax, dword ptr fs:[00000030h] 11_2_1DF58BF0
Source: C:\Users\Public\Libraries\joedgvvL.pif Code function: 11_2_1E00F80A mov eax, dword ptr fs:[00000030h] 11_2_1E00F80A
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D1A9D4 GetEnvironmentStringsW,GetProcessHeap,RtlAllocateHeap,memcpy,FreeEnvironmentStringsW, 10_2_00D1A9D4
Enables debug privileges
Source: C:\Users\Public\Libraries\joedgvvL.pif Process token adjusted: Debug Jump to behavior
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D26EC0 SetUnhandledExceptionFilter, 10_2_00D26EC0
Source: C:\Users\Public\alpha.pif Code function: 10_2_00D26B40 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 10_2_00D26B40

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 178.128.81.239 80 Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\AppData\Local\Temp\x.exe Memory allocated: C:\Users\Public\Libraries\joedgvvL.pif base: 400000 protect: page execute and read and write Jump to behavior
Drops or copies cmd.exe with a different name (likely to bypass HIPS)
Source: C:\Windows\SysWOW64\esentutl.exe File created: C:\Users\Public\alpha.pif Jump to dropped file
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Users\Public\Libraries\joedgvvL.pif NtClose: Indirect: 0x1DEAA56C
Source: C:\Users\Public\Libraries\joedgvvL.pif NtQueueApcThread: Indirect: 0x1DEAA4F2 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\Public\Libraries\joedgvvL.pif Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\Public\Libraries\joedgvvL.pif Section loaded: NULL target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and write Jump to behavior
Source: C:\Users\Public\Libraries\joedgvvL.pif Section loaded: NULL target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\Public\Libraries\joedgvvL.pif Thread register set: target process: 4004 Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Thread register set: target process: 4004 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\Public\Libraries\joedgvvL.pif Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\AppData\Local\Temp\x.exe Section unmapped: C:\Users\Public\Libraries\joedgvvL.pif base address: 400000 Jump to behavior
Source: C:\Users\Public\Libraries\joedgvvL.pif Section unmapped: C:\Windows\SysWOW64\cscript.exe base address: BF0000 Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\AppData\Local\Temp\x.exe Memory written: C:\Users\Public\Libraries\joedgvvL.pif base: 384008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\extrac32.exe extrac32 /y "C:\Users\user\Desktop\z1SWIFT_MT103_Payment_552016_cmd.bat" "C:\Users\user\AppData\Local\Temp\x.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Process created: C:\Users\Public\Libraries\joedgvvL.pif C:\Users\Public\Libraries\joedgvvL.pif Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\Public\Libraries\joedgvvL.pif" Jump to behavior
Source: explorer.exe, 0000000C.00000000.2235952852.00000000013A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.4578970001.00000000013A0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: IProgram Manager
Source: explorer.exe, 0000000C.00000000.2239908224.00000000048E0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2235952852.00000000013A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.4578970001.00000000013A0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000C.00000000.2235952852.00000000013A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.4578970001.00000000013A0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 0000000C.00000002.4578501898.0000000000D60000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2228233544.0000000000D69000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: +Progman
Source: explorer.exe, 0000000C.00000000.2235952852.00000000013A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.4578970001.00000000013A0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 0000000C.00000000.2252872203.00000000098AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.4587065407.00000000098AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.3075011568.00000000098AD000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd31A
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA, 4_2_031D5ACC
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: GetLocaleInfoA, 4_2_031DA7C4
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA, 4_2_031D5BD8
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: GetLocaleInfoA, 4_2_031DA810
Source: C:\Users\Public\alpha.pif Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale, 10_2_00D18572
Source: C:\Users\Public\alpha.pif Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,GetDateFormatW,memmove,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,GetLastError,realloc, 10_2_00D16854
Source: C:\Users\Public\alpha.pif Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW, 10_2_00D19310
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031D920C GetLocalTime, 4_2_031D920C
Source: C:\Users\user\AppData\Local\Temp\x.exe Code function: 4_2_031DB78C GetVersionExA, 4_2_031DB78C
AV process strings found (often used to terminate AV products)
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: cmdagent.exe
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: quhlpsvc.exe
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: avgamsvr.exe
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: TMBMSRV.exe
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Vsserv.exe
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: avgupsvc.exe
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: avgemc.exe
Source: x.exe, 00000004.00000003.2189787103.000000007F050000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000004.00000002.2251580298.000000007F2C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 11.1.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.1.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 11.1.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.joedgvvL.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.1.joedgvvL.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.2335559900.000000001DE60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000001.2213802564.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2251265510.0000000021C42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2335523108.000000001DE30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2313660201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.4578398893.0000000000A30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.4578591711.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.4578723016.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2250459092.00000000216FA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1545185 Sample: z1SWIFT_MT103_Payment_55201... Startdate: 30/10/2024 Architecture: WINDOWS Score: 100 58 www.zpp-at.xyz 2->58 60 www.specially-smou.xyz 2->60 62 10 other IPs or domains 2->62 76 Suricata IDS alerts for network traffic 2->76 78 Found malware configuration 2->78 80 Malicious sample detected (through community Yara rule) 2->80 84 9 other signatures 2->84 12 cmd.exe 1 2->12         started        signatures3 82 Performs DNS queries to domains with low reputation 60->82 process4 process5 14 x.exe 5 12->14         started        19 extrac32.exe 8 12->19         started        21 conhost.exe 12->21         started        dnsIp6 66 himalayastrek.com 50.116.93.185, 443, 49709, 49710 UNIFIEDLAYER-AS-1US United States 14->66 52 C:\Users\Public\Libraries\joedgvvL.pif, PE32 14->52 dropped 54 C:\Users\Public\Libraries\joedgvvL.cmd, DOS 14->54 dropped 68 Multi AV Scanner detection for dropped file 14->68 70 Machine Learning detection for dropped file 14->70 72 Drops PE files with a suspicious file extension 14->72 74 4 other signatures 14->74 23 joedgvvL.pif 14->23         started        26 cmd.exe 1 14->26         started        56 C:\Users\user\AppData\Local\Temp\x.exe, PE32 19->56 dropped file7 signatures8 process9 signatures10 86 Detected unpacking (changes PE section rights) 23->86 88 Modifies the context of a thread in another process (thread injection) 23->88 90 Maps a DLL or memory area into another process 23->90 92 5 other signatures 23->92 28 explorer.exe 60 1 23->28 injected 32 esentutl.exe 2 26->32         started        35 esentutl.exe 2 26->35         started        37 conhost.exe 26->37         started        39 alpha.pif 2 26->39         started        process11 dnsIp12 64 www.idstream.xyz 178.128.81.239, 57601, 80 DIGITALOCEAN-ASNUS Netherlands 28->64 102 System process connects to network (likely due to code injection or exploit) 28->102 41 cscript.exe 28->41         started        48 C:\Users\Public\alpha.pif, PE32 32->48 dropped 104 Drops PE files to the user root directory 32->104 106 Drops PE files with a suspicious file extension 32->106 108 Drops or copies cmd.exe with a different name (likely to bypass HIPS) 32->108 50 C:\Users\Public\xpha.pif, PE32 35->50 dropped file13 signatures14 process15 signatures16 94 Modifies the context of a thread in another process (thread injection) 41->94 96 Maps a DLL or memory area into another process 41->96 98 Tries to detect virtualization through RDTSC time measurements 41->98 100 Switches to a custom stack to bypass stack traces 41->100 44 cmd.exe 1 41->44         started        process17 process18 46 conhost.exe 44->46         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
50.116.93.185
 himalayastrek.com United States
46606 UNIFIEDLAYER-AS-1US true
178.128.81.239
 www.idstream.xyz Netherlands
14061 DIGITALOCEAN-ASNUS true

Contacted Domains

Name IP Active
himalayastrek.com 50.116.93.185 true
www.idstream.xyz 178.128.81.239 true
www.zpp-at.xyz unknown unknown
www.jdhfmq.live unknown unknown
www.ise-bjnh.xyz unknown unknown
www.byataltatweer.net unknown unknown
www.kimosskrupulslacker.cfd unknown unknown
www.ranxxletzz.xyz unknown unknown
www.ixedcontainerlogistics.today unknown unknown
www.ound-qlhmm.xyz unknown unknown
www.acaxtecameralcarers.cfd unknown unknown
www.specially-smou.xyz unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://himalayastrek.com/stein/233_Lvvgdeojree true
    		unknown
    www.kimosskrupulslacker.cfd/f29s/ true
      		unknown