Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1562756
MD5: 0a089e934eb856c3e809d0fac53000c7
SHA1: 661f86072031587be18ada0b6606ee82bb52038f
SHA256: f4e5ec593dcb18dca253d98f5133050e96f27f86c1e46b5882abf797fefe26b1
Tags: exeuser-Bitsight
Infos:

Detection

FormBook
Score: 88
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
AI detected suspicious sample
Injects a PE file into a foreign processes
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Costura Assembly Loader
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 21%
Yara detected FormBook
Source: Yara match File source: 2.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.2217550179.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2216787886.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 108.181.20.35:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: file.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: file.exe, 00000000.00000002.2133930517.0000000006CB0000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.00000000037D4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.00000000036A1000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: file.exe, 00000002.00000002.2217688499.0000000001620000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: file.exe, 00000000.00000002.2133930517.0000000006CB0000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.00000000037D4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.00000000036A1000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: file.exe, file.exe, 00000002.00000002.2217688499.0000000001620000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdbSHA256}Lq source: file.exe, 00000000.00000002.2133699660.0000000006B40000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.00000000039F9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.000000000393A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: file.exe, 00000000.00000002.2133699660.0000000006B40000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.00000000039F9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.000000000393A000.00000004.00000800.00020000.00000000.sdmp
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then jmp 069A2192h 0_2_069A1F90
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then jmp 069A2192h 0_2_069A1F80
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then jmp 069A7FCAh 0_2_069A7F51
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then jmp 069A7FCAh 0_2_069A7F60
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then jmp 069A9C73h 0_2_069A9580
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then jmp 069A7FCAh 0_2_069A8105
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /ne8lox.mp4 HTTP/1.1Host: files.catbox.moeConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 108.181.20.35 108.181.20.35
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /ne8lox.mp4 HTTP/1.1Host: files.catbox.moeConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: files.catbox.moe
Source: file.exe, 00000000.00000002.2111813386.00000000026A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: file.exe, 00000000.00000002.2111813386.00000000026A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://files.catbox.moe
Source: file.exe, 00000000.00000002.2111813386.00000000026A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://files.catbox.moe/ne8lox.mp4
Source: file.exe String found in binary or memory: https://files.catbox.moe/ne8lox.mp41OWRumaBvqxiIWy/UyUzNnQ==
Source: file.exe, 00000000.00000002.2133699660.0000000006B40000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.00000000039F9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.000000000393A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: file.exe, 00000000.00000002.2133699660.0000000006B40000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.00000000039F9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.000000000393A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: file.exe, 00000000.00000002.2133699660.0000000006B40000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.00000000039F9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.000000000393A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: file.exe, 00000000.00000002.2133699660.0000000006B40000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.00000000039F9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.000000000393A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: file.exe, 00000000.00000002.2133699660.0000000006B40000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.00000000039F9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2111813386.000000000274A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.000000000393A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: file.exe, 00000000.00000002.2133699660.0000000006B40000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.00000000039F9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.000000000393A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown HTTPS traffic detected: 108.181.20.35:443 -> 192.168.2.5:49704 version: TLS 1.2

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 2.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.2217550179.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2216787886.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Contains functionality to call native functions
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069C7728 NtProtectVirtualMemory, 0_2_069C7728
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069C9888 NtResumeThread, 0_2_069C9888
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069C7720 NtProtectVirtualMemory, 0_2_069C7720
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069C9880 NtResumeThread, 0_2_069C9880
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0042C7A3 NtClose, 2_2_0042C7A3
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692DF0 NtQuerySystemInformation,LdrInitializeThunk, 2_2_01692DF0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692C70 NtFreeVirtualMemory,LdrInitializeThunk, 2_2_01692C70
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016935C0 NtCreateMutant,LdrInitializeThunk, 2_2_016935C0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01694340 NtSetContextThread, 2_2_01694340
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01694650 NtSuspendThread, 2_2_01694650
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692B60 NtClose, 2_2_01692B60
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692BE0 NtQueryValueKey, 2_2_01692BE0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692BF0 NtAllocateVirtualMemory, 2_2_01692BF0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692BA0 NtEnumerateValueKey, 2_2_01692BA0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692B80 NtQueryInformationFile, 2_2_01692B80
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692AF0 NtWriteFile, 2_2_01692AF0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692AD0 NtReadFile, 2_2_01692AD0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692AB0 NtWaitForSingleObject, 2_2_01692AB0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692D30 NtUnmapViewOfSection, 2_2_01692D30
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692D00 NtSetInformationFile, 2_2_01692D00
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692D10 NtMapViewOfSection, 2_2_01692D10
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692DD0 NtDelayExecution, 2_2_01692DD0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692DB0 NtEnumerateKey, 2_2_01692DB0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692C60 NtCreateKey, 2_2_01692C60
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692C00 NtQueryInformationProcess, 2_2_01692C00
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692CF0 NtOpenProcess, 2_2_01692CF0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692CC0 NtQueryVirtualMemory, 2_2_01692CC0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692CA0 NtQueryInformationToken, 2_2_01692CA0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692F60 NtCreateProcessEx, 2_2_01692F60
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692F30 NtCreateSection, 2_2_01692F30
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692FE0 NtCreateFile, 2_2_01692FE0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692FA0 NtQuerySection, 2_2_01692FA0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692FB0 NtResumeThread, 2_2_01692FB0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692F90 NtProtectVirtualMemory, 2_2_01692F90
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692E30 NtWriteVirtualMemory, 2_2_01692E30
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692EE0 NtQueueApcThread, 2_2_01692EE0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692EA0 NtAdjustPrivilegesToken, 2_2_01692EA0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692E80 NtReadVirtualMemory, 2_2_01692E80
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01693010 NtOpenDirectoryObject, 2_2_01693010
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01693090 NtSetValueKey, 2_2_01693090
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016939B0 NtGetContextThread, 2_2_016939B0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01693D70 NtOpenThread, 2_2_01693D70
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01693D10 NtOpenProcessToken, 2_2_01693D10
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_024ECFE4 0_2_024ECFE4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_068F07D8 0_2_068F07D8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_068FF368 0_2_068FF368
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06993620 0_2_06993620
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0699B79E 0_2_0699B79E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0699B6F1 0_2_0699B6F1
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06993610 0_2_06993610
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0699C780 0_2_0699C780
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0699C770 0_2_0699C770
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06992A30 0_2_06992A30
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06992A40 0_2_06992A40
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06992310 0_2_06992310
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06992300 0_2_06992300
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06993B29 0_2_06993B29
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069A425D 0_2_069A425D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069A7758 0_2_069A7758
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069A7F51 0_2_069A7F51
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069A7F60 0_2_069A7F60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069A6250 0_2_069A6250
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069A624A 0_2_069A624A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069A8105 0_2_069A8105
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069C4260 0_2_069C4260
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069C7480 0_2_069C7480
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069CAA54 0_2_069CAA54
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069C4250 0_2_069C4250
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069CAB1D 0_2_069CAB1D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069CAB35 0_2_069CAB35
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069CA750 0_2_069CA750
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069CA741 0_2_069CA741
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069C7470 0_2_069C7470
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069CADB8 0_2_069CADB8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069CADA9 0_2_069CADA9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069D4CFA 0_2_069D4CFA
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069D666B 0_2_069D666B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069D39E8 0_2_069D39E8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069D0006 0_2_069D0006
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069D0040 0_2_069D0040
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069DA7B8 0_2_069DA7B8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069DA7A8 0_2_069DA7A8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069D39D9 0_2_069D39D9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06CA35B0 0_2_06CA35B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06CA0040 0_2_06CA0040
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06CA1248 0_2_06CA1248
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06CA0367 0_2_06CA0367
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06E4E6C0 0_2_06E4E6C0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06E4E2A0 0_2_06E4E2A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_004028C0 2_2_004028C0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_00410133 2_2_00410133
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_004031D0 2_2_004031D0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_00416A2E 2_2_00416A2E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_00416A33 2_2_00416A33
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_00410353 2_2_00410353
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0040E3D3 2_2_0040E3D3
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_00402530 2_2_00402530
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0042EDD3 2_2_0042EDD3
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E8158 2_2_016E8158
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01650100 2_2_01650100
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FA118 2_2_016FA118
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_017181CC 2_2_017181CC
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_017141A2 2_2_017141A2
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_017201AA 2_2_017201AA
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F2000 2_2_016F2000
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0171A352 2_2_0171A352
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_017203E6 2_2_017203E6
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0166E3F0 2_2_0166E3F0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01700274 2_2_01700274
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E02C0 2_2_016E02C0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660535 2_2_01660535
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01720591 2_2_01720591
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01712446 2_2_01712446
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01704420 2_2_01704420
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0170E4F6 2_2_0170E4F6
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660770 2_2_01660770
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01684750 2_2_01684750
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165C7C0 2_2_0165C7C0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167C6E0 2_2_0167C6E0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01676962 2_2_01676962
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016629A0 2_2_016629A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0172A9A6 2_2_0172A9A6
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01662840 2_2_01662840
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0166A840 2_2_0166A840
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168E8F0 2_2_0168E8F0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016468B8 2_2_016468B8
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0171AB40 2_2_0171AB40
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01716BD7 2_2_01716BD7
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165EA80 2_2_0165EA80
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0166AD00 2_2_0166AD00
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FCD1F 2_2_016FCD1F
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165ADE0 2_2_0165ADE0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01678DBF 2_2_01678DBF
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660C00 2_2_01660C00
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01650CF2 2_2_01650CF2
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01700CB5 2_2_01700CB5
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D4F40 2_2_016D4F40
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01702F30 2_2_01702F30
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016A2F28 2_2_016A2F28
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01680F30 2_2_01680F30
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0166CFE0 2_2_0166CFE0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01652FC8 2_2_01652FC8
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016DEFA0 2_2_016DEFA0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660E59 2_2_01660E59
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0171EE26 2_2_0171EE26
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0171EEDB 2_2_0171EEDB
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0171CE93 2_2_0171CE93
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01672E90 2_2_01672E90
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0169516C 2_2_0169516C
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164F172 2_2_0164F172
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0172B16B 2_2_0172B16B
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0166B1B0 2_2_0166B1B0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0171F0E0 2_2_0171F0E0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_017170E9 2_2_017170E9
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016670C0 2_2_016670C0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0170F0CC 2_2_0170F0CC
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164D34C 2_2_0164D34C
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0171132D 2_2_0171132D
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016A739A 2_2_016A739A
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_017012ED 2_2_017012ED
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167B2C0 2_2_0167B2C0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016652A0 2_2_016652A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01717571 2_2_01717571
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FD5B0 2_2_016FD5B0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01651460 2_2_01651460
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0171F43F 2_2_0171F43F
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0171F7B0 2_2_0171F7B0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_017116CC 2_2_017116CC
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01669950 2_2_01669950
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167B950 2_2_0167B950
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F5910 2_2_016F5910
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CD800 2_2_016CD800
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016638E0 2_2_016638E0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0171FB76 2_2_0171FB76
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0169DBF9 2_2_0169DBF9
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D5BF0 2_2_016D5BF0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167FB80 2_2_0167FB80
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D3A6C 2_2_016D3A6C
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01717A46 2_2_01717A46
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0171FA49 2_2_0171FA49
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0170DAC6 2_2_0170DAC6
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FDAAC 2_2_016FDAAC
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016A5AA0 2_2_016A5AA0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01701AA3 2_2_01701AA3
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01717D73 2_2_01717D73
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01663D40 2_2_01663D40
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01711D5A 2_2_01711D5A
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167FDC0 2_2_0167FDC0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D9C32 2_2_016D9C32
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0171FCF2 2_2_0171FCF2
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0171FF09 2_2_0171FF09
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0171FFB1 2_2_0171FFB1
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01661F92 2_2_01661F92
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01669EB0 2_2_01669EB0
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\file.exe Code function: String function: 0164B970 appears 280 times
Source: C:\Users\user\Desktop\file.exe Code function: String function: 016CEA12 appears 86 times
Source: C:\Users\user\Desktop\file.exe Code function: String function: 016A7E54 appears 102 times
Source: C:\Users\user\Desktop\file.exe Code function: String function: 016DF290 appears 105 times
Source: C:\Users\user\Desktop\file.exe Code function: String function: 01695130 appears 58 times
Sample file is different than original file name gathered from version info
Source: file.exe, 00000000.00000002.2133699660.0000000006B40000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs file.exe
Source: file.exe, 00000000.00000002.2111813386.00000000026F0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000002.2128950880.00000000039F9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs file.exe
Source: file.exe, 00000000.00000002.2133930517.0000000006CB0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs file.exe
Source: file.exe, 00000000.00000002.2110427135.000000000085E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000002.2128950880.00000000037D4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs file.exe
Source: file.exe, 00000000.00000002.2128950880.00000000036A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs file.exe
Source: file.exe, 00000000.00000002.2132372049.0000000006780000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameZseobxu.dll" vs file.exe
Source: file.exe, 00000000.00000002.2128950880.000000000393A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs file.exe
Source: file.exe, 00000000.00000000.2048140594.000000000030C000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameYxadnetaxoo.exe, vs file.exe
Source: file.exe, 00000002.00000002.2217688499.000000000174D000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs file.exe
Source: file.exe Binary or memory string: OriginalFilenameYxadnetaxoo.exe, vs file.exe
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 0.2.file.exe.37d4d38.3.raw.unpack, ITaskFolder.cs Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.file.exe.37d4d38.3.raw.unpack, TaskFolder.cs Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.file.exe.37d4d38.3.raw.unpack, Task.cs Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.file.exe.37d4d38.3.raw.unpack, TaskService.cs Task registration methods: 'CreateFromToken'
Source: 0.2.file.exe.6cb0000.9.raw.unpack, ITaskFolder.cs Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.file.exe.6cb0000.9.raw.unpack, TaskFolder.cs Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.file.exe.6cb0000.9.raw.unpack, TaskPrincipal.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.file.exe.3732110.1.raw.unpack, TaskPrincipal.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.file.exe.3732110.1.raw.unpack, Task.cs Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.file.exe.37d4d38.3.raw.unpack, Task.cs Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.file.exe.3732110.1.raw.unpack, User.cs Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.file.exe.3732110.1.raw.unpack, TaskFolder.cs Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.file.exe.37d4d38.3.raw.unpack, TaskSecurity.cs Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.file.exe.37d4d38.3.raw.unpack, TaskSecurity.cs Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.file.exe.6cb0000.9.raw.unpack, Task.cs Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.file.exe.37d4d38.3.raw.unpack, User.cs Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.file.exe.6cb0000.9.raw.unpack, TaskSecurity.cs Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.file.exe.6cb0000.9.raw.unpack, TaskSecurity.cs Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.file.exe.3732110.1.raw.unpack, TaskSecurity.cs Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.file.exe.3732110.1.raw.unpack, TaskSecurity.cs Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.file.exe.6cb0000.9.raw.unpack, User.cs Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.file.exe.6cb0000.9.raw.unpack, TaskFolder.cs Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.file.exe.37d4d38.3.raw.unpack, TaskPrincipal.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.file.exe.37d4d38.3.raw.unpack, TaskFolder.cs Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: classification engine Classification label: mal88.troj.evad.winEXE@3/0@1/1
Source: C:\Users\user\Desktop\file.exe Mutant created: NULL
Source: file.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: file.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: file.exe ReversingLabs: Detection: 21%
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: file.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: file.exe, 00000000.00000002.2133930517.0000000006CB0000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.00000000037D4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.00000000036A1000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: file.exe, 00000002.00000002.2217688499.0000000001620000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: file.exe, 00000000.00000002.2133930517.0000000006CB0000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.00000000037D4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.00000000036A1000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: file.exe, file.exe, 00000002.00000002.2217688499.0000000001620000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdbSHA256}Lq source: file.exe, 00000000.00000002.2133699660.0000000006B40000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.00000000039F9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.000000000393A000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: file.exe, 00000000.00000002.2133699660.0000000006B40000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.00000000039F9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128950880.000000000393A000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 0.2.file.exe.37d4d38.3.raw.unpack, ReflectionHelper.cs .Net Code: InvokeMethod
Source: 0.2.file.exe.37d4d38.3.raw.unpack, ReflectionHelper.cs .Net Code: InvokeMethod
Source: 0.2.file.exe.37d4d38.3.raw.unpack, XmlSerializationHelper.cs .Net Code: ReadObjectProperties
Source: 0.2.file.exe.6cb0000.9.raw.unpack, ReflectionHelper.cs .Net Code: InvokeMethod
Source: 0.2.file.exe.6cb0000.9.raw.unpack, ReflectionHelper.cs .Net Code: InvokeMethod
Source: 0.2.file.exe.6cb0000.9.raw.unpack, XmlSerializationHelper.cs .Net Code: ReadObjectProperties
Source: 0.2.file.exe.39a9ce8.0.raw.unpack, TypeModel.cs .Net Code: TryDeserializeList
Source: 0.2.file.exe.39a9ce8.0.raw.unpack, ListDecorator.cs .Net Code: Read
Source: 0.2.file.exe.39a9ce8.0.raw.unpack, TypeSerializer.cs .Net Code: CreateInstance
Source: 0.2.file.exe.39a9ce8.0.raw.unpack, TypeSerializer.cs .Net Code: EmitCreateInstance
Source: 0.2.file.exe.39a9ce8.0.raw.unpack, TypeSerializer.cs .Net Code: EmitCreateIfNull
Source: 0.2.file.exe.6b40000.8.raw.unpack, TypeModel.cs .Net Code: TryDeserializeList
Source: 0.2.file.exe.6b40000.8.raw.unpack, ListDecorator.cs .Net Code: Read
Source: 0.2.file.exe.6b40000.8.raw.unpack, TypeSerializer.cs .Net Code: CreateInstance
Source: 0.2.file.exe.6b40000.8.raw.unpack, TypeSerializer.cs .Net Code: EmitCreateInstance
Source: 0.2.file.exe.6b40000.8.raw.unpack, TypeSerializer.cs .Net Code: EmitCreateIfNull
Source: 0.2.file.exe.3732110.1.raw.unpack, ReflectionHelper.cs .Net Code: InvokeMethod
Source: 0.2.file.exe.3732110.1.raw.unpack, ReflectionHelper.cs .Net Code: InvokeMethod
Source: 0.2.file.exe.3732110.1.raw.unpack, XmlSerializationHelper.cs .Net Code: ReadObjectProperties
Yara detected Costura Assembly Loader
Source: Yara match File source: 0.2.file.exe.6a50000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2111813386.000000000274A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2133396929.0000000006A50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 1984, type: MEMORYSTR
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06951913 push eax; ret 0_2_0695191D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0699976E push es; ret 0_2_06999770
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0699F580 push es; ret 0_2_0699F630
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06999AC6 push es; retf 0_2_06999ADC
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06999A02 push es; iretd 0_2_06999A04
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06999889 push es; ret 0_2_06999894
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069A1BAD push BA04B4B4h; retf 0_2_069A1BB9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069A18AE push BA04B4B4h; ret 0_2_069A18B3
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069C6E87 push es; retf 0_2_069C6E90
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069C22C7 push es; retf 0_2_069C23A4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069C92F0 push esp; retf 0_2_069C92FD
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069C062D push es; ret 0_2_069C0664
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069C0665 push es; ret 0_2_069C0664
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069C23A5 push es; iretd 0_2_069C23C0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069C2325 push es; retf 0_2_069C23A4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069C58F3 push es; iretd 0_2_069C5940
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069CAC34 push es; ret 0_2_069CAC50
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069DB8D8 push es; iretd 0_2_069DB90C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069DB981 push es; iretd 0_2_069DB9A0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069D9F32 push es; iretd 0_2_069D9F7C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_069DB97D push es; iretd 0_2_069DB980
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06CA5405 push FFFFFF8Bh; iretd 0_2_06CA5407
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06CA552D push FFFFFF8Bh; iretd 0_2_06CA552F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06CA53EC push FFFFFF8Bh; ret 0_2_06CA53F0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06CA53B1 push FFFFFF8Bh; ret 0_2_06CA53B6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_06E335AF push esi; retf 0_2_06E335B0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0041A81A push ebx; retf 2_2_0041A823
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0041F276 push cs; ret 2_2_0041F29C
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_004192FE push esp; retf 2_2_004192FF
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0041F283 push cs; ret 2_2_0041F29C
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_00423A9F push ecx; iretd 2_2_00423AD4
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: file.exe PID: 1984, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: file.exe, 00000000.00000002.2111813386.000000000274A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\file.exe Memory allocated: 2440000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory allocated: 26A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory allocated: 2440000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0169096E rdtsc 2_2_0169096E
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 7373 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window / User API: threadDelayed 1705 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\file.exe API coverage: 0.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -23058430092136925s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2992 Thread sleep count: 7373 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2992 Thread sleep count: 1705 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -99875s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -99765s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -99657s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -99532s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -99407s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -99282s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -99172s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -99062s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -98953s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -98844s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -98733s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -98625s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -98516s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -98405s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -98297s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -98188s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -98071s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -97932s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -97828s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -97719s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -97594s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -97485s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -97360s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -97235s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -97110s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -96985s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -96860s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -96735s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -96610s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -96485s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -96360s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -96235s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -96110s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -95985s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -95860s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -95735s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -95610s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -95335s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -95205s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -95078s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -94969s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5660 Thread sleep time: -94860s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6540 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 99875 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 99765 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 99657 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 99532 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 99407 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 99282 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 99172 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 99062 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 98953 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 98844 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 98733 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 98625 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 98516 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 98405 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 98297 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 98188 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 98071 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 97932 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 97828 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 97719 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 97594 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 97485 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 97360 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 97235 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 97110 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 96985 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 96860 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 96735 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 96610 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 96485 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 96360 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 96235 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 96110 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 95985 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 95860 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 95735 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 95610 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 95335 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 95205 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 95078 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 94969 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 94860 Jump to behavior
Source: file.exe, 00000000.00000002.2111813386.000000000274A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SerialNumber0VMware|VIRTUAL|A M I|XenDselect * from Win32_ComputerSystem
Source: file.exe, 00000000.00000002.2111813386.000000000274A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: model0Microsoft|VMWare|Virtual
Source: file.exe, 00000000.00000002.2110427135.00000000008FD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0169096E rdtsc 2_2_0169096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_00417983 LdrLoadDll, 2_2_00417983
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E4144 mov eax, dword ptr fs:[00000030h] 2_2_016E4144
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E4144 mov eax, dword ptr fs:[00000030h] 2_2_016E4144
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E4144 mov ecx, dword ptr fs:[00000030h] 2_2_016E4144
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E4144 mov eax, dword ptr fs:[00000030h] 2_2_016E4144
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E4144 mov eax, dword ptr fs:[00000030h] 2_2_016E4144
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01656154 mov eax, dword ptr fs:[00000030h] 2_2_01656154
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01656154 mov eax, dword ptr fs:[00000030h] 2_2_01656154
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164C156 mov eax, dword ptr fs:[00000030h] 2_2_0164C156
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E8158 mov eax, dword ptr fs:[00000030h] 2_2_016E8158
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01680124 mov eax, dword ptr fs:[00000030h] 2_2_01680124
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FE10E mov eax, dword ptr fs:[00000030h] 2_2_016FE10E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FE10E mov ecx, dword ptr fs:[00000030h] 2_2_016FE10E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FE10E mov eax, dword ptr fs:[00000030h] 2_2_016FE10E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FE10E mov eax, dword ptr fs:[00000030h] 2_2_016FE10E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FE10E mov ecx, dword ptr fs:[00000030h] 2_2_016FE10E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FE10E mov eax, dword ptr fs:[00000030h] 2_2_016FE10E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FE10E mov eax, dword ptr fs:[00000030h] 2_2_016FE10E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FE10E mov ecx, dword ptr fs:[00000030h] 2_2_016FE10E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FE10E mov eax, dword ptr fs:[00000030h] 2_2_016FE10E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FE10E mov ecx, dword ptr fs:[00000030h] 2_2_016FE10E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01710115 mov eax, dword ptr fs:[00000030h] 2_2_01710115
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FA118 mov ecx, dword ptr fs:[00000030h] 2_2_016FA118
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FA118 mov eax, dword ptr fs:[00000030h] 2_2_016FA118
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FA118 mov eax, dword ptr fs:[00000030h] 2_2_016FA118
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FA118 mov eax, dword ptr fs:[00000030h] 2_2_016FA118
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016801F8 mov eax, dword ptr fs:[00000030h] 2_2_016801F8
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_017261E5 mov eax, dword ptr fs:[00000030h] 2_2_017261E5
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_017161C3 mov eax, dword ptr fs:[00000030h] 2_2_017161C3
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_017161C3 mov eax, dword ptr fs:[00000030h] 2_2_017161C3
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CE1D0 mov eax, dword ptr fs:[00000030h] 2_2_016CE1D0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CE1D0 mov eax, dword ptr fs:[00000030h] 2_2_016CE1D0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CE1D0 mov ecx, dword ptr fs:[00000030h] 2_2_016CE1D0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CE1D0 mov eax, dword ptr fs:[00000030h] 2_2_016CE1D0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CE1D0 mov eax, dword ptr fs:[00000030h] 2_2_016CE1D0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01690185 mov eax, dword ptr fs:[00000030h] 2_2_01690185
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F4180 mov eax, dword ptr fs:[00000030h] 2_2_016F4180
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F4180 mov eax, dword ptr fs:[00000030h] 2_2_016F4180
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D019F mov eax, dword ptr fs:[00000030h] 2_2_016D019F
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D019F mov eax, dword ptr fs:[00000030h] 2_2_016D019F
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D019F mov eax, dword ptr fs:[00000030h] 2_2_016D019F
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D019F mov eax, dword ptr fs:[00000030h] 2_2_016D019F
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164A197 mov eax, dword ptr fs:[00000030h] 2_2_0164A197
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164A197 mov eax, dword ptr fs:[00000030h] 2_2_0164A197
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164A197 mov eax, dword ptr fs:[00000030h] 2_2_0164A197
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0170C188 mov eax, dword ptr fs:[00000030h] 2_2_0170C188
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0170C188 mov eax, dword ptr fs:[00000030h] 2_2_0170C188
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167C073 mov eax, dword ptr fs:[00000030h] 2_2_0167C073
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01652050 mov eax, dword ptr fs:[00000030h] 2_2_01652050
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D6050 mov eax, dword ptr fs:[00000030h] 2_2_016D6050
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164A020 mov eax, dword ptr fs:[00000030h] 2_2_0164A020
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164C020 mov eax, dword ptr fs:[00000030h] 2_2_0164C020
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E6030 mov eax, dword ptr fs:[00000030h] 2_2_016E6030
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D4000 mov ecx, dword ptr fs:[00000030h] 2_2_016D4000
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F2000 mov eax, dword ptr fs:[00000030h] 2_2_016F2000
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F2000 mov eax, dword ptr fs:[00000030h] 2_2_016F2000
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F2000 mov eax, dword ptr fs:[00000030h] 2_2_016F2000
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F2000 mov eax, dword ptr fs:[00000030h] 2_2_016F2000
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F2000 mov eax, dword ptr fs:[00000030h] 2_2_016F2000
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F2000 mov eax, dword ptr fs:[00000030h] 2_2_016F2000
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F2000 mov eax, dword ptr fs:[00000030h] 2_2_016F2000
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F2000 mov eax, dword ptr fs:[00000030h] 2_2_016F2000
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0166E016 mov eax, dword ptr fs:[00000030h] 2_2_0166E016
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0166E016 mov eax, dword ptr fs:[00000030h] 2_2_0166E016
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0166E016 mov eax, dword ptr fs:[00000030h] 2_2_0166E016
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0166E016 mov eax, dword ptr fs:[00000030h] 2_2_0166E016
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164A0E3 mov ecx, dword ptr fs:[00000030h] 2_2_0164A0E3
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016580E9 mov eax, dword ptr fs:[00000030h] 2_2_016580E9
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D60E0 mov eax, dword ptr fs:[00000030h] 2_2_016D60E0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164C0F0 mov eax, dword ptr fs:[00000030h] 2_2_0164C0F0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016920F0 mov ecx, dword ptr fs:[00000030h] 2_2_016920F0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D20DE mov eax, dword ptr fs:[00000030h] 2_2_016D20DE
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E80A8 mov eax, dword ptr fs:[00000030h] 2_2_016E80A8
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_017160B8 mov eax, dword ptr fs:[00000030h] 2_2_017160B8
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_017160B8 mov ecx, dword ptr fs:[00000030h] 2_2_017160B8
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165208A mov eax, dword ptr fs:[00000030h] 2_2_0165208A
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F437C mov eax, dword ptr fs:[00000030h] 2_2_016F437C
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0171A352 mov eax, dword ptr fs:[00000030h] 2_2_0171A352
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D2349 mov eax, dword ptr fs:[00000030h] 2_2_016D2349
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D2349 mov eax, dword ptr fs:[00000030h] 2_2_016D2349
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D2349 mov eax, dword ptr fs:[00000030h] 2_2_016D2349
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D2349 mov eax, dword ptr fs:[00000030h] 2_2_016D2349
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D2349 mov eax, dword ptr fs:[00000030h] 2_2_016D2349
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D2349 mov eax, dword ptr fs:[00000030h] 2_2_016D2349
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D2349 mov eax, dword ptr fs:[00000030h] 2_2_016D2349
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D2349 mov eax, dword ptr fs:[00000030h] 2_2_016D2349
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D2349 mov eax, dword ptr fs:[00000030h] 2_2_016D2349
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D2349 mov eax, dword ptr fs:[00000030h] 2_2_016D2349
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D2349 mov eax, dword ptr fs:[00000030h] 2_2_016D2349
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D2349 mov eax, dword ptr fs:[00000030h] 2_2_016D2349
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D2349 mov eax, dword ptr fs:[00000030h] 2_2_016D2349
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D2349 mov eax, dword ptr fs:[00000030h] 2_2_016D2349
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D2349 mov eax, dword ptr fs:[00000030h] 2_2_016D2349
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D035C mov eax, dword ptr fs:[00000030h] 2_2_016D035C
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D035C mov eax, dword ptr fs:[00000030h] 2_2_016D035C
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D035C mov eax, dword ptr fs:[00000030h] 2_2_016D035C
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D035C mov ecx, dword ptr fs:[00000030h] 2_2_016D035C
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D035C mov eax, dword ptr fs:[00000030h] 2_2_016D035C
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D035C mov eax, dword ptr fs:[00000030h] 2_2_016D035C
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F8350 mov ecx, dword ptr fs:[00000030h] 2_2_016F8350
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168A30B mov eax, dword ptr fs:[00000030h] 2_2_0168A30B
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168A30B mov eax, dword ptr fs:[00000030h] 2_2_0168A30B
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168A30B mov eax, dword ptr fs:[00000030h] 2_2_0168A30B
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164C310 mov ecx, dword ptr fs:[00000030h] 2_2_0164C310
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01670310 mov ecx, dword ptr fs:[00000030h] 2_2_01670310
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016603E9 mov eax, dword ptr fs:[00000030h] 2_2_016603E9
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016603E9 mov eax, dword ptr fs:[00000030h] 2_2_016603E9
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016603E9 mov eax, dword ptr fs:[00000030h] 2_2_016603E9
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016603E9 mov eax, dword ptr fs:[00000030h] 2_2_016603E9
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016603E9 mov eax, dword ptr fs:[00000030h] 2_2_016603E9
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016603E9 mov eax, dword ptr fs:[00000030h] 2_2_016603E9
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016603E9 mov eax, dword ptr fs:[00000030h] 2_2_016603E9
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016603E9 mov eax, dword ptr fs:[00000030h] 2_2_016603E9
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0166E3F0 mov eax, dword ptr fs:[00000030h] 2_2_0166E3F0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0166E3F0 mov eax, dword ptr fs:[00000030h] 2_2_0166E3F0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0166E3F0 mov eax, dword ptr fs:[00000030h] 2_2_0166E3F0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016863FF mov eax, dword ptr fs:[00000030h] 2_2_016863FF
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165A3C0 mov eax, dword ptr fs:[00000030h] 2_2_0165A3C0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165A3C0 mov eax, dword ptr fs:[00000030h] 2_2_0165A3C0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165A3C0 mov eax, dword ptr fs:[00000030h] 2_2_0165A3C0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165A3C0 mov eax, dword ptr fs:[00000030h] 2_2_0165A3C0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165A3C0 mov eax, dword ptr fs:[00000030h] 2_2_0165A3C0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165A3C0 mov eax, dword ptr fs:[00000030h] 2_2_0165A3C0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016583C0 mov eax, dword ptr fs:[00000030h] 2_2_016583C0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016583C0 mov eax, dword ptr fs:[00000030h] 2_2_016583C0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016583C0 mov eax, dword ptr fs:[00000030h] 2_2_016583C0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016583C0 mov eax, dword ptr fs:[00000030h] 2_2_016583C0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D63C0 mov eax, dword ptr fs:[00000030h] 2_2_016D63C0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FE3DB mov eax, dword ptr fs:[00000030h] 2_2_016FE3DB
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FE3DB mov eax, dword ptr fs:[00000030h] 2_2_016FE3DB
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FE3DB mov ecx, dword ptr fs:[00000030h] 2_2_016FE3DB
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FE3DB mov eax, dword ptr fs:[00000030h] 2_2_016FE3DB
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F43D4 mov eax, dword ptr fs:[00000030h] 2_2_016F43D4
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F43D4 mov eax, dword ptr fs:[00000030h] 2_2_016F43D4
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0170C3CD mov eax, dword ptr fs:[00000030h] 2_2_0170C3CD
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167438F mov eax, dword ptr fs:[00000030h] 2_2_0167438F
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167438F mov eax, dword ptr fs:[00000030h] 2_2_0167438F
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164E388 mov eax, dword ptr fs:[00000030h] 2_2_0164E388
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164E388 mov eax, dword ptr fs:[00000030h] 2_2_0164E388
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164E388 mov eax, dword ptr fs:[00000030h] 2_2_0164E388
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01648397 mov eax, dword ptr fs:[00000030h] 2_2_01648397
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01648397 mov eax, dword ptr fs:[00000030h] 2_2_01648397
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01648397 mov eax, dword ptr fs:[00000030h] 2_2_01648397
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01700274 mov eax, dword ptr fs:[00000030h] 2_2_01700274
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01700274 mov eax, dword ptr fs:[00000030h] 2_2_01700274
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01700274 mov eax, dword ptr fs:[00000030h] 2_2_01700274
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01700274 mov eax, dword ptr fs:[00000030h] 2_2_01700274
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01700274 mov eax, dword ptr fs:[00000030h] 2_2_01700274
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01700274 mov eax, dword ptr fs:[00000030h] 2_2_01700274
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01700274 mov eax, dword ptr fs:[00000030h] 2_2_01700274
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01700274 mov eax, dword ptr fs:[00000030h] 2_2_01700274
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01700274 mov eax, dword ptr fs:[00000030h] 2_2_01700274
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01700274 mov eax, dword ptr fs:[00000030h] 2_2_01700274
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01700274 mov eax, dword ptr fs:[00000030h] 2_2_01700274
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01700274 mov eax, dword ptr fs:[00000030h] 2_2_01700274
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01654260 mov eax, dword ptr fs:[00000030h] 2_2_01654260
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01654260 mov eax, dword ptr fs:[00000030h] 2_2_01654260
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01654260 mov eax, dword ptr fs:[00000030h] 2_2_01654260
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164826B mov eax, dword ptr fs:[00000030h] 2_2_0164826B
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0170A250 mov eax, dword ptr fs:[00000030h] 2_2_0170A250
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0170A250 mov eax, dword ptr fs:[00000030h] 2_2_0170A250
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D8243 mov eax, dword ptr fs:[00000030h] 2_2_016D8243
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D8243 mov ecx, dword ptr fs:[00000030h] 2_2_016D8243
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164A250 mov eax, dword ptr fs:[00000030h] 2_2_0164A250
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01656259 mov eax, dword ptr fs:[00000030h] 2_2_01656259
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164823B mov eax, dword ptr fs:[00000030h] 2_2_0164823B
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016602E1 mov eax, dword ptr fs:[00000030h] 2_2_016602E1
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016602E1 mov eax, dword ptr fs:[00000030h] 2_2_016602E1
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016602E1 mov eax, dword ptr fs:[00000030h] 2_2_016602E1
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165A2C3 mov eax, dword ptr fs:[00000030h] 2_2_0165A2C3
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165A2C3 mov eax, dword ptr fs:[00000030h] 2_2_0165A2C3
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165A2C3 mov eax, dword ptr fs:[00000030h] 2_2_0165A2C3
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165A2C3 mov eax, dword ptr fs:[00000030h] 2_2_0165A2C3
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165A2C3 mov eax, dword ptr fs:[00000030h] 2_2_0165A2C3
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016602A0 mov eax, dword ptr fs:[00000030h] 2_2_016602A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016602A0 mov eax, dword ptr fs:[00000030h] 2_2_016602A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E62A0 mov eax, dword ptr fs:[00000030h] 2_2_016E62A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E62A0 mov ecx, dword ptr fs:[00000030h] 2_2_016E62A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E62A0 mov eax, dword ptr fs:[00000030h] 2_2_016E62A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E62A0 mov eax, dword ptr fs:[00000030h] 2_2_016E62A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E62A0 mov eax, dword ptr fs:[00000030h] 2_2_016E62A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E62A0 mov eax, dword ptr fs:[00000030h] 2_2_016E62A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168E284 mov eax, dword ptr fs:[00000030h] 2_2_0168E284
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168E284 mov eax, dword ptr fs:[00000030h] 2_2_0168E284
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D0283 mov eax, dword ptr fs:[00000030h] 2_2_016D0283
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D0283 mov eax, dword ptr fs:[00000030h] 2_2_016D0283
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D0283 mov eax, dword ptr fs:[00000030h] 2_2_016D0283
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168656A mov eax, dword ptr fs:[00000030h] 2_2_0168656A
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168656A mov eax, dword ptr fs:[00000030h] 2_2_0168656A
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168656A mov eax, dword ptr fs:[00000030h] 2_2_0168656A
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01658550 mov eax, dword ptr fs:[00000030h] 2_2_01658550
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01658550 mov eax, dword ptr fs:[00000030h] 2_2_01658550
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660535 mov eax, dword ptr fs:[00000030h] 2_2_01660535
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660535 mov eax, dword ptr fs:[00000030h] 2_2_01660535
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660535 mov eax, dword ptr fs:[00000030h] 2_2_01660535
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660535 mov eax, dword ptr fs:[00000030h] 2_2_01660535
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660535 mov eax, dword ptr fs:[00000030h] 2_2_01660535
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660535 mov eax, dword ptr fs:[00000030h] 2_2_01660535
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167E53E mov eax, dword ptr fs:[00000030h] 2_2_0167E53E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167E53E mov eax, dword ptr fs:[00000030h] 2_2_0167E53E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167E53E mov eax, dword ptr fs:[00000030h] 2_2_0167E53E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167E53E mov eax, dword ptr fs:[00000030h] 2_2_0167E53E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167E53E mov eax, dword ptr fs:[00000030h] 2_2_0167E53E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E6500 mov eax, dword ptr fs:[00000030h] 2_2_016E6500
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01724500 mov eax, dword ptr fs:[00000030h] 2_2_01724500
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01724500 mov eax, dword ptr fs:[00000030h] 2_2_01724500
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01724500 mov eax, dword ptr fs:[00000030h] 2_2_01724500
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01724500 mov eax, dword ptr fs:[00000030h] 2_2_01724500
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01724500 mov eax, dword ptr fs:[00000030h] 2_2_01724500
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01724500 mov eax, dword ptr fs:[00000030h] 2_2_01724500
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01724500 mov eax, dword ptr fs:[00000030h] 2_2_01724500
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167E5E7 mov eax, dword ptr fs:[00000030h] 2_2_0167E5E7
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167E5E7 mov eax, dword ptr fs:[00000030h] 2_2_0167E5E7
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167E5E7 mov eax, dword ptr fs:[00000030h] 2_2_0167E5E7
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167E5E7 mov eax, dword ptr fs:[00000030h] 2_2_0167E5E7
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167E5E7 mov eax, dword ptr fs:[00000030h] 2_2_0167E5E7
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167E5E7 mov eax, dword ptr fs:[00000030h] 2_2_0167E5E7
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167E5E7 mov eax, dword ptr fs:[00000030h] 2_2_0167E5E7
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167E5E7 mov eax, dword ptr fs:[00000030h] 2_2_0167E5E7
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016525E0 mov eax, dword ptr fs:[00000030h] 2_2_016525E0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168C5ED mov eax, dword ptr fs:[00000030h] 2_2_0168C5ED
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168C5ED mov eax, dword ptr fs:[00000030h] 2_2_0168C5ED
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168E5CF mov eax, dword ptr fs:[00000030h] 2_2_0168E5CF
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168E5CF mov eax, dword ptr fs:[00000030h] 2_2_0168E5CF
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016565D0 mov eax, dword ptr fs:[00000030h] 2_2_016565D0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168A5D0 mov eax, dword ptr fs:[00000030h] 2_2_0168A5D0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168A5D0 mov eax, dword ptr fs:[00000030h] 2_2_0168A5D0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D05A7 mov eax, dword ptr fs:[00000030h] 2_2_016D05A7
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D05A7 mov eax, dword ptr fs:[00000030h] 2_2_016D05A7
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D05A7 mov eax, dword ptr fs:[00000030h] 2_2_016D05A7
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016745B1 mov eax, dword ptr fs:[00000030h] 2_2_016745B1
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016745B1 mov eax, dword ptr fs:[00000030h] 2_2_016745B1
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01684588 mov eax, dword ptr fs:[00000030h] 2_2_01684588
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01652582 mov eax, dword ptr fs:[00000030h] 2_2_01652582
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01652582 mov ecx, dword ptr fs:[00000030h] 2_2_01652582
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168E59C mov eax, dword ptr fs:[00000030h] 2_2_0168E59C
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016DC460 mov ecx, dword ptr fs:[00000030h] 2_2_016DC460
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167A470 mov eax, dword ptr fs:[00000030h] 2_2_0167A470
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167A470 mov eax, dword ptr fs:[00000030h] 2_2_0167A470
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167A470 mov eax, dword ptr fs:[00000030h] 2_2_0167A470
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0170A456 mov eax, dword ptr fs:[00000030h] 2_2_0170A456
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168E443 mov eax, dword ptr fs:[00000030h] 2_2_0168E443
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168E443 mov eax, dword ptr fs:[00000030h] 2_2_0168E443
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168E443 mov eax, dword ptr fs:[00000030h] 2_2_0168E443
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168E443 mov eax, dword ptr fs:[00000030h] 2_2_0168E443
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168E443 mov eax, dword ptr fs:[00000030h] 2_2_0168E443
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168E443 mov eax, dword ptr fs:[00000030h] 2_2_0168E443
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168E443 mov eax, dword ptr fs:[00000030h] 2_2_0168E443
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168E443 mov eax, dword ptr fs:[00000030h] 2_2_0168E443
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164645D mov eax, dword ptr fs:[00000030h] 2_2_0164645D
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167245A mov eax, dword ptr fs:[00000030h] 2_2_0167245A
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164C427 mov eax, dword ptr fs:[00000030h] 2_2_0164C427
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164E420 mov eax, dword ptr fs:[00000030h] 2_2_0164E420
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164E420 mov eax, dword ptr fs:[00000030h] 2_2_0164E420
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164E420 mov eax, dword ptr fs:[00000030h] 2_2_0164E420
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D6420 mov eax, dword ptr fs:[00000030h] 2_2_016D6420
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D6420 mov eax, dword ptr fs:[00000030h] 2_2_016D6420
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D6420 mov eax, dword ptr fs:[00000030h] 2_2_016D6420
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D6420 mov eax, dword ptr fs:[00000030h] 2_2_016D6420
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D6420 mov eax, dword ptr fs:[00000030h] 2_2_016D6420
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D6420 mov eax, dword ptr fs:[00000030h] 2_2_016D6420
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D6420 mov eax, dword ptr fs:[00000030h] 2_2_016D6420
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168A430 mov eax, dword ptr fs:[00000030h] 2_2_0168A430
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01688402 mov eax, dword ptr fs:[00000030h] 2_2_01688402
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01688402 mov eax, dword ptr fs:[00000030h] 2_2_01688402
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01688402 mov eax, dword ptr fs:[00000030h] 2_2_01688402
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016504E5 mov ecx, dword ptr fs:[00000030h] 2_2_016504E5
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016564AB mov eax, dword ptr fs:[00000030h] 2_2_016564AB
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016844B0 mov ecx, dword ptr fs:[00000030h] 2_2_016844B0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016DA4B0 mov eax, dword ptr fs:[00000030h] 2_2_016DA4B0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0170A49A mov eax, dword ptr fs:[00000030h] 2_2_0170A49A
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01658770 mov eax, dword ptr fs:[00000030h] 2_2_01658770
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660770 mov eax, dword ptr fs:[00000030h] 2_2_01660770
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660770 mov eax, dword ptr fs:[00000030h] 2_2_01660770
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660770 mov eax, dword ptr fs:[00000030h] 2_2_01660770
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660770 mov eax, dword ptr fs:[00000030h] 2_2_01660770
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660770 mov eax, dword ptr fs:[00000030h] 2_2_01660770
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660770 mov eax, dword ptr fs:[00000030h] 2_2_01660770
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660770 mov eax, dword ptr fs:[00000030h] 2_2_01660770
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660770 mov eax, dword ptr fs:[00000030h] 2_2_01660770
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660770 mov eax, dword ptr fs:[00000030h] 2_2_01660770
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660770 mov eax, dword ptr fs:[00000030h] 2_2_01660770
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660770 mov eax, dword ptr fs:[00000030h] 2_2_01660770
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660770 mov eax, dword ptr fs:[00000030h] 2_2_01660770
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168674D mov esi, dword ptr fs:[00000030h] 2_2_0168674D
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168674D mov eax, dword ptr fs:[00000030h] 2_2_0168674D
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168674D mov eax, dword ptr fs:[00000030h] 2_2_0168674D
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016DE75D mov eax, dword ptr fs:[00000030h] 2_2_016DE75D
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01650750 mov eax, dword ptr fs:[00000030h] 2_2_01650750
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D4755 mov eax, dword ptr fs:[00000030h] 2_2_016D4755
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692750 mov eax, dword ptr fs:[00000030h] 2_2_01692750
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692750 mov eax, dword ptr fs:[00000030h] 2_2_01692750
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168C720 mov eax, dword ptr fs:[00000030h] 2_2_0168C720
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168C720 mov eax, dword ptr fs:[00000030h] 2_2_0168C720
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168273C mov eax, dword ptr fs:[00000030h] 2_2_0168273C
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168273C mov ecx, dword ptr fs:[00000030h] 2_2_0168273C
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168273C mov eax, dword ptr fs:[00000030h] 2_2_0168273C
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CC730 mov eax, dword ptr fs:[00000030h] 2_2_016CC730
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168C700 mov eax, dword ptr fs:[00000030h] 2_2_0168C700
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01650710 mov eax, dword ptr fs:[00000030h] 2_2_01650710
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01680710 mov eax, dword ptr fs:[00000030h] 2_2_01680710
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016727ED mov eax, dword ptr fs:[00000030h] 2_2_016727ED
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016727ED mov eax, dword ptr fs:[00000030h] 2_2_016727ED
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016727ED mov eax, dword ptr fs:[00000030h] 2_2_016727ED
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016DE7E1 mov eax, dword ptr fs:[00000030h] 2_2_016DE7E1
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016547FB mov eax, dword ptr fs:[00000030h] 2_2_016547FB
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016547FB mov eax, dword ptr fs:[00000030h] 2_2_016547FB
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165C7C0 mov eax, dword ptr fs:[00000030h] 2_2_0165C7C0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D07C3 mov eax, dword ptr fs:[00000030h] 2_2_016D07C3
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016507AF mov eax, dword ptr fs:[00000030h] 2_2_016507AF
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_017047A0 mov eax, dword ptr fs:[00000030h] 2_2_017047A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F678E mov eax, dword ptr fs:[00000030h] 2_2_016F678E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168A660 mov eax, dword ptr fs:[00000030h] 2_2_0168A660
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168A660 mov eax, dword ptr fs:[00000030h] 2_2_0168A660
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01682674 mov eax, dword ptr fs:[00000030h] 2_2_01682674
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0171866E mov eax, dword ptr fs:[00000030h] 2_2_0171866E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0171866E mov eax, dword ptr fs:[00000030h] 2_2_0171866E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0166C640 mov eax, dword ptr fs:[00000030h] 2_2_0166C640
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0166E627 mov eax, dword ptr fs:[00000030h] 2_2_0166E627
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01686620 mov eax, dword ptr fs:[00000030h] 2_2_01686620
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01688620 mov eax, dword ptr fs:[00000030h] 2_2_01688620
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165262C mov eax, dword ptr fs:[00000030h] 2_2_0165262C
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CE609 mov eax, dword ptr fs:[00000030h] 2_2_016CE609
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0166260B mov eax, dword ptr fs:[00000030h] 2_2_0166260B
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0166260B mov eax, dword ptr fs:[00000030h] 2_2_0166260B
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0166260B mov eax, dword ptr fs:[00000030h] 2_2_0166260B
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0166260B mov eax, dword ptr fs:[00000030h] 2_2_0166260B
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0166260B mov eax, dword ptr fs:[00000030h] 2_2_0166260B
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0166260B mov eax, dword ptr fs:[00000030h] 2_2_0166260B
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0166260B mov eax, dword ptr fs:[00000030h] 2_2_0166260B
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01692619 mov eax, dword ptr fs:[00000030h] 2_2_01692619
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D06F1 mov eax, dword ptr fs:[00000030h] 2_2_016D06F1
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D06F1 mov eax, dword ptr fs:[00000030h] 2_2_016D06F1
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CE6F2 mov eax, dword ptr fs:[00000030h] 2_2_016CE6F2
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CE6F2 mov eax, dword ptr fs:[00000030h] 2_2_016CE6F2
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CE6F2 mov eax, dword ptr fs:[00000030h] 2_2_016CE6F2
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CE6F2 mov eax, dword ptr fs:[00000030h] 2_2_016CE6F2
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168A6C7 mov ebx, dword ptr fs:[00000030h] 2_2_0168A6C7
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168A6C7 mov eax, dword ptr fs:[00000030h] 2_2_0168A6C7
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168C6A6 mov eax, dword ptr fs:[00000030h] 2_2_0168C6A6
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016866B0 mov eax, dword ptr fs:[00000030h] 2_2_016866B0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01654690 mov eax, dword ptr fs:[00000030h] 2_2_01654690
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01654690 mov eax, dword ptr fs:[00000030h] 2_2_01654690
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01676962 mov eax, dword ptr fs:[00000030h] 2_2_01676962
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01676962 mov eax, dword ptr fs:[00000030h] 2_2_01676962
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01676962 mov eax, dword ptr fs:[00000030h] 2_2_01676962
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0169096E mov eax, dword ptr fs:[00000030h] 2_2_0169096E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0169096E mov edx, dword ptr fs:[00000030h] 2_2_0169096E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0169096E mov eax, dword ptr fs:[00000030h] 2_2_0169096E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016DC97C mov eax, dword ptr fs:[00000030h] 2_2_016DC97C
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F4978 mov eax, dword ptr fs:[00000030h] 2_2_016F4978
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F4978 mov eax, dword ptr fs:[00000030h] 2_2_016F4978
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D0946 mov eax, dword ptr fs:[00000030h] 2_2_016D0946
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E892B mov eax, dword ptr fs:[00000030h] 2_2_016E892B
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D892A mov eax, dword ptr fs:[00000030h] 2_2_016D892A
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CE908 mov eax, dword ptr fs:[00000030h] 2_2_016CE908
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CE908 mov eax, dword ptr fs:[00000030h] 2_2_016CE908
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01648918 mov eax, dword ptr fs:[00000030h] 2_2_01648918
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01648918 mov eax, dword ptr fs:[00000030h] 2_2_01648918
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016DC912 mov eax, dword ptr fs:[00000030h] 2_2_016DC912
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016DE9E0 mov eax, dword ptr fs:[00000030h] 2_2_016DE9E0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016829F9 mov eax, dword ptr fs:[00000030h] 2_2_016829F9
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016829F9 mov eax, dword ptr fs:[00000030h] 2_2_016829F9
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0171A9D3 mov eax, dword ptr fs:[00000030h] 2_2_0171A9D3
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E69C0 mov eax, dword ptr fs:[00000030h] 2_2_016E69C0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165A9D0 mov eax, dword ptr fs:[00000030h] 2_2_0165A9D0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165A9D0 mov eax, dword ptr fs:[00000030h] 2_2_0165A9D0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165A9D0 mov eax, dword ptr fs:[00000030h] 2_2_0165A9D0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165A9D0 mov eax, dword ptr fs:[00000030h] 2_2_0165A9D0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165A9D0 mov eax, dword ptr fs:[00000030h] 2_2_0165A9D0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165A9D0 mov eax, dword ptr fs:[00000030h] 2_2_0165A9D0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016849D0 mov eax, dword ptr fs:[00000030h] 2_2_016849D0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016629A0 mov eax, dword ptr fs:[00000030h] 2_2_016629A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016629A0 mov eax, dword ptr fs:[00000030h] 2_2_016629A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016629A0 mov eax, dword ptr fs:[00000030h] 2_2_016629A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016629A0 mov eax, dword ptr fs:[00000030h] 2_2_016629A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016629A0 mov eax, dword ptr fs:[00000030h] 2_2_016629A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016629A0 mov eax, dword ptr fs:[00000030h] 2_2_016629A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016629A0 mov eax, dword ptr fs:[00000030h] 2_2_016629A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016629A0 mov eax, dword ptr fs:[00000030h] 2_2_016629A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016629A0 mov eax, dword ptr fs:[00000030h] 2_2_016629A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016629A0 mov eax, dword ptr fs:[00000030h] 2_2_016629A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016629A0 mov eax, dword ptr fs:[00000030h] 2_2_016629A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016629A0 mov eax, dword ptr fs:[00000030h] 2_2_016629A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016629A0 mov eax, dword ptr fs:[00000030h] 2_2_016629A0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016509AD mov eax, dword ptr fs:[00000030h] 2_2_016509AD
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016509AD mov eax, dword ptr fs:[00000030h] 2_2_016509AD
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D89B3 mov esi, dword ptr fs:[00000030h] 2_2_016D89B3
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D89B3 mov eax, dword ptr fs:[00000030h] 2_2_016D89B3
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016D89B3 mov eax, dword ptr fs:[00000030h] 2_2_016D89B3
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E6870 mov eax, dword ptr fs:[00000030h] 2_2_016E6870
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E6870 mov eax, dword ptr fs:[00000030h] 2_2_016E6870
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016DE872 mov eax, dword ptr fs:[00000030h] 2_2_016DE872
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016DE872 mov eax, dword ptr fs:[00000030h] 2_2_016DE872
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01662840 mov ecx, dword ptr fs:[00000030h] 2_2_01662840
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01654859 mov eax, dword ptr fs:[00000030h] 2_2_01654859
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01654859 mov eax, dword ptr fs:[00000030h] 2_2_01654859
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01680854 mov eax, dword ptr fs:[00000030h] 2_2_01680854
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01672835 mov eax, dword ptr fs:[00000030h] 2_2_01672835
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01672835 mov eax, dword ptr fs:[00000030h] 2_2_01672835
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01672835 mov eax, dword ptr fs:[00000030h] 2_2_01672835
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01672835 mov ecx, dword ptr fs:[00000030h] 2_2_01672835
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01672835 mov eax, dword ptr fs:[00000030h] 2_2_01672835
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01672835 mov eax, dword ptr fs:[00000030h] 2_2_01672835
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F483A mov eax, dword ptr fs:[00000030h] 2_2_016F483A
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F483A mov eax, dword ptr fs:[00000030h] 2_2_016F483A
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168A830 mov eax, dword ptr fs:[00000030h] 2_2_0168A830
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016DC810 mov eax, dword ptr fs:[00000030h] 2_2_016DC810
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168C8F9 mov eax, dword ptr fs:[00000030h] 2_2_0168C8F9
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168C8F9 mov eax, dword ptr fs:[00000030h] 2_2_0168C8F9
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0171A8E4 mov eax, dword ptr fs:[00000030h] 2_2_0171A8E4
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167E8C0 mov eax, dword ptr fs:[00000030h] 2_2_0167E8C0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01650887 mov eax, dword ptr fs:[00000030h] 2_2_01650887
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016DC89D mov eax, dword ptr fs:[00000030h] 2_2_016DC89D
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0164CB7E mov eax, dword ptr fs:[00000030h] 2_2_0164CB7E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016F8B42 mov eax, dword ptr fs:[00000030h] 2_2_016F8B42
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E6B40 mov eax, dword ptr fs:[00000030h] 2_2_016E6B40
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E6B40 mov eax, dword ptr fs:[00000030h] 2_2_016E6B40
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0171AB40 mov eax, dword ptr fs:[00000030h] 2_2_0171AB40
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01704B4B mov eax, dword ptr fs:[00000030h] 2_2_01704B4B
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01704B4B mov eax, dword ptr fs:[00000030h] 2_2_01704B4B
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FEB50 mov eax, dword ptr fs:[00000030h] 2_2_016FEB50
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167EB20 mov eax, dword ptr fs:[00000030h] 2_2_0167EB20
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167EB20 mov eax, dword ptr fs:[00000030h] 2_2_0167EB20
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01718B28 mov eax, dword ptr fs:[00000030h] 2_2_01718B28
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01718B28 mov eax, dword ptr fs:[00000030h] 2_2_01718B28
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CEB1D mov eax, dword ptr fs:[00000030h] 2_2_016CEB1D
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CEB1D mov eax, dword ptr fs:[00000030h] 2_2_016CEB1D
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CEB1D mov eax, dword ptr fs:[00000030h] 2_2_016CEB1D
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CEB1D mov eax, dword ptr fs:[00000030h] 2_2_016CEB1D
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CEB1D mov eax, dword ptr fs:[00000030h] 2_2_016CEB1D
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CEB1D mov eax, dword ptr fs:[00000030h] 2_2_016CEB1D
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CEB1D mov eax, dword ptr fs:[00000030h] 2_2_016CEB1D
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CEB1D mov eax, dword ptr fs:[00000030h] 2_2_016CEB1D
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CEB1D mov eax, dword ptr fs:[00000030h] 2_2_016CEB1D
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01658BF0 mov eax, dword ptr fs:[00000030h] 2_2_01658BF0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01658BF0 mov eax, dword ptr fs:[00000030h] 2_2_01658BF0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01658BF0 mov eax, dword ptr fs:[00000030h] 2_2_01658BF0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167EBFC mov eax, dword ptr fs:[00000030h] 2_2_0167EBFC
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016DCBF0 mov eax, dword ptr fs:[00000030h] 2_2_016DCBF0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01650BCD mov eax, dword ptr fs:[00000030h] 2_2_01650BCD
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01650BCD mov eax, dword ptr fs:[00000030h] 2_2_01650BCD
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01650BCD mov eax, dword ptr fs:[00000030h] 2_2_01650BCD
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01670BCB mov eax, dword ptr fs:[00000030h] 2_2_01670BCB
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01670BCB mov eax, dword ptr fs:[00000030h] 2_2_01670BCB
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01670BCB mov eax, dword ptr fs:[00000030h] 2_2_01670BCB
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FEBD0 mov eax, dword ptr fs:[00000030h] 2_2_016FEBD0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01704BB0 mov eax, dword ptr fs:[00000030h] 2_2_01704BB0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01704BB0 mov eax, dword ptr fs:[00000030h] 2_2_01704BB0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660BBE mov eax, dword ptr fs:[00000030h] 2_2_01660BBE
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660BBE mov eax, dword ptr fs:[00000030h] 2_2_01660BBE
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168CA6F mov eax, dword ptr fs:[00000030h] 2_2_0168CA6F
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168CA6F mov eax, dword ptr fs:[00000030h] 2_2_0168CA6F
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168CA6F mov eax, dword ptr fs:[00000030h] 2_2_0168CA6F
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016FEA60 mov eax, dword ptr fs:[00000030h] 2_2_016FEA60
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CCA72 mov eax, dword ptr fs:[00000030h] 2_2_016CCA72
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016CCA72 mov eax, dword ptr fs:[00000030h] 2_2_016CCA72
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01656A50 mov eax, dword ptr fs:[00000030h] 2_2_01656A50
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01656A50 mov eax, dword ptr fs:[00000030h] 2_2_01656A50
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01656A50 mov eax, dword ptr fs:[00000030h] 2_2_01656A50
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01656A50 mov eax, dword ptr fs:[00000030h] 2_2_01656A50
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01656A50 mov eax, dword ptr fs:[00000030h] 2_2_01656A50
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01656A50 mov eax, dword ptr fs:[00000030h] 2_2_01656A50
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01656A50 mov eax, dword ptr fs:[00000030h] 2_2_01656A50
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660A5B mov eax, dword ptr fs:[00000030h] 2_2_01660A5B
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01660A5B mov eax, dword ptr fs:[00000030h] 2_2_01660A5B
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0167EA2E mov eax, dword ptr fs:[00000030h] 2_2_0167EA2E
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168CA24 mov eax, dword ptr fs:[00000030h] 2_2_0168CA24
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168CA38 mov eax, dword ptr fs:[00000030h] 2_2_0168CA38
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01674A35 mov eax, dword ptr fs:[00000030h] 2_2_01674A35
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01674A35 mov eax, dword ptr fs:[00000030h] 2_2_01674A35
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016DCA11 mov eax, dword ptr fs:[00000030h] 2_2_016DCA11
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168AAEE mov eax, dword ptr fs:[00000030h] 2_2_0168AAEE
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0168AAEE mov eax, dword ptr fs:[00000030h] 2_2_0168AAEE
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016A6ACC mov eax, dword ptr fs:[00000030h] 2_2_016A6ACC
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016A6ACC mov eax, dword ptr fs:[00000030h] 2_2_016A6ACC
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016A6ACC mov eax, dword ptr fs:[00000030h] 2_2_016A6ACC
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01650AD0 mov eax, dword ptr fs:[00000030h] 2_2_01650AD0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01684AD0 mov eax, dword ptr fs:[00000030h] 2_2_01684AD0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01684AD0 mov eax, dword ptr fs:[00000030h] 2_2_01684AD0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01658AA0 mov eax, dword ptr fs:[00000030h] 2_2_01658AA0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01658AA0 mov eax, dword ptr fs:[00000030h] 2_2_01658AA0
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016A6AA4 mov eax, dword ptr fs:[00000030h] 2_2_016A6AA4
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165EA80 mov eax, dword ptr fs:[00000030h] 2_2_0165EA80
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165EA80 mov eax, dword ptr fs:[00000030h] 2_2_0165EA80
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165EA80 mov eax, dword ptr fs:[00000030h] 2_2_0165EA80
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165EA80 mov eax, dword ptr fs:[00000030h] 2_2_0165EA80
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165EA80 mov eax, dword ptr fs:[00000030h] 2_2_0165EA80
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165EA80 mov eax, dword ptr fs:[00000030h] 2_2_0165EA80
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165EA80 mov eax, dword ptr fs:[00000030h] 2_2_0165EA80
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165EA80 mov eax, dword ptr fs:[00000030h] 2_2_0165EA80
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_0165EA80 mov eax, dword ptr fs:[00000030h] 2_2_0165EA80
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01724A80 mov eax, dword ptr fs:[00000030h] 2_2_01724A80
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01688A90 mov edx, dword ptr fs:[00000030h] 2_2_01688A90
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_016E8D6B mov eax, dword ptr fs:[00000030h] 2_2_016E8D6B
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01650D59 mov eax, dword ptr fs:[00000030h] 2_2_01650D59
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01650D59 mov eax, dword ptr fs:[00000030h] 2_2_01650D59
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01650D59 mov eax, dword ptr fs:[00000030h] 2_2_01650D59
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01658D59 mov eax, dword ptr fs:[00000030h] 2_2_01658D59
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01658D59 mov eax, dword ptr fs:[00000030h] 2_2_01658D59
Source: C:\Users\user\Desktop\file.exe Code function: 2_2_01658D59 mov eax, dword ptr fs:[00000030h] 2_2_01658D59
Enables debug privileges
Source: C:\Users\user\Desktop\file.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Users\user\Desktop\file.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 2.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.2217550179.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2216787886.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 2.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.2217550179.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2216787886.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1562756 Sample: file.exe Startdate: 26/11/2024 Architecture: WINDOWS Score: 88 13 files.catbox.moe 2->13 17 Multi AV Scanner detection for submitted file 2->17 19 Yara detected FormBook 2->19 21 Yara detected AntiVM3 2->21 23 4 other signatures 2->23 7 file.exe 15 2 2->7         started        signatures3 process4 dnsIp5 15 files.catbox.moe 108.181.20.35, 443, 49704 ASN852CA Canada 7->15 25 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 7->25 27 Injects a PE file into a foreign processes 7->27 11 file.exe 7->11         started        signatures6 process7
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
108.181.20.35
 files.catbox.moe Canada
852 ASN852CA false

Contacted Domains

Name IP Active
files.catbox.moe 108.181.20.35 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://files.catbox.moe/ne8lox.mp4 false
    		high