Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
3P5I851G78.exe

Overview

General Information

Sample name:3P5I851G78.exe
renamed because original name is a hash value
Original sample name:010fc4f0e382f0c0de55b3fcf4b80f6284694833af9d759c584b63a7d540cf2f.exe
Analysis ID:1634820
MD5:02848368b72c81c30b3d30e901dc540f
SHA1:e951099851351bc1d4ba1376c800e1151054ca75
SHA256:010fc4f0e382f0c0de55b3fcf4b80f6284694833af9d759c584b63a7d540cf2f
Tags:exeFormbookuser-adrian__luca
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Rundll32 Execution Without CommandLine Parameters
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Tries to resolve many domain names, but no domain seems valid
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • 3P5I851G78.exe (PID: 6716 cmdline: "C:\Users\user\Desktop\3P5I851G78.exe" MD5: 02848368B72C81C30B3D30E901DC540F)
    • powershell.exe (PID: 1400 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3P5I851G78.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 3220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WmiPrvSE.exe (PID: 7144 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
    • 3P5I851G78.exe (PID: 3936 cmdline: "C:\Users\user\Desktop\3P5I851G78.exe" MD5: 02848368B72C81C30B3D30E901DC540F)
      • explorer.exe (PID: 4056 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
        • rundll32.exe (PID: 6696 cmdline: "C:\Windows\SysWOW64\rundll32.exe" MD5: 889B99C52A60DD49227C5E485A016679)
          • cmd.exe (PID: 2020 cmdline: /c del "C:\Users\user\Desktop\3P5I851G78.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 6776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • svchost.exe (PID: 4124 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.avada-casino-tlj.buzz/bc01/"], "decoy": ["epatitis-treatment-26155.bond", "52cy67sk.bond", "nline-degree-6987776.world", "ingxingdiandeng-2033.top", "mberbreeze.cyou", "48xc300mw.autos", "obs-for-seniors-39582.bond", "tpetersburg-3-tonn.online", "egafon-parser.online", "172jh.shop", "ltraman.pro", "bqfhnys.shop", "ntercash24-cad.homes", "uhtwister.cloud", "alk-in-tubs-27353.bond", "ucas-saaad.buzz", "oko.events", "8080713.xyz", "refabricated-homes-74404.bond", "inaa.boo", "nnevateknoloji.xyz", "ar-accident-lawyer-389.today", "ianju-fvqh092.vip", "ealthandwellnessly.digital", "qzxx.top", "q8189.top", "ecurity-service-22477.bond", "ractors-42621.bond", "astamadre.shop", "tonomushotel.xyz", "cowatt.fun", "olocaustaffirmer.net", "delphi.ltd", "mmwinni.buzz", "8009.top", "nline-gaming-ox-fr.xyz", "irtyeffingrancher.info", "omotech-dz.net", "akemoneyonline.bond", "ustbookin.online", "eals.lat", "irmag.online", "eddogbrands.website", "oifulcares.net", "aming-chair-83359.bond", "ewferg.top", "areless.net", "torygame168.online", "y-language-menu.net", "iring-cleaners-2507.xyz", "inancialenlightment.info", "ar-accident-lawyer-389.today", "sicologosportugueses.online", "ajabandot.website", "oidakings.net", "2ar1.shop", "comedia.lol", "kjbrosmm.shop", "ffpage.shop", "nfluencer-marketing-17923.bond", "ebshieldsrenew.live", "lkjuy.xyz", "lussalesapp.website", "hildrens-clothing.today"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.855098590.00000000040D9000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000000.00000002.855098590.00000000040D9000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000000.00000002.855098590.00000000040D9000.00000004.00000800.00020000.00000000.sdmpWindows_Trojan_Diceloader_15eeb7b9unknownunknown
      • 0x1fc29:$a1: E9 92 9D FF FF C3 E8
      • 0x4e049:$a1: E9 92 9D FF FF C3 E8
      • 0x7b469:$a1: E9 92 9D FF FF C3 E8
      00000000.00000002.855098590.00000000040D9000.00000004.00000800.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x6bc1:$a1: 3C 30 50 4F 53 54 74 09 40
      • 0x34fe1:$a1: 3C 30 50 4F 53 54 74 09 40
      • 0x62401:$a1: 3C 30 50 4F 53 54 74 09 40
      • 0x1d500:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x4b920:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x78d40:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0xb33f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x3975f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x66b7f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x16227:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      • 0x44647:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      • 0x71a67:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      00000000.00000002.855098590.00000000040D9000.00000004.00000800.00020000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0xa278:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0xa4f2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x38698:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x38912:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x65ab8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x65d32:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x16025:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x44445:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x71865:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x15b11:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x43f31:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x71351:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x16127:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x44547:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x71967:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x1629f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0x446bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0x71adf:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0xaf0a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x3932a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x6674a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      Click to see the 31 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      3.2.3P5I851G78.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        3.2.3P5I851G78.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          3.2.3P5I851G78.exe.400000.0.unpackWindows_Trojan_Diceloader_15eeb7b9unknownunknown
          • 0x1e4b9:$a1: E9 92 9D FF FF C3 E8
          3.2.3P5I851G78.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x5451:$a1: 3C 30 50 4F 53 54 74 09 40
          • 0x1bd90:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x9bcf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          • 0x14ab7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
          3.2.3P5I851G78.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x1aaf7:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1bafa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          Click to see the 7 entries

          Sigma Signatures

          System Summary

          barindex
          Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3P5I851G78.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3P5I851G78.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\3P5I851G78.exe", ParentImage: C:\Users\user\Desktop\3P5I851G78.exe, ParentProcessId: 6716, ParentProcessName: 3P5I851G78.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3P5I851G78.exe", ProcessId: 1400, ProcessName: powershell.exe
          Sigma detected: Rundll32 Execution Without CommandLine Parameters
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\SysWOW64\rundll32.exe", CommandLine: "C:\Windows\SysWOW64\rundll32.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 4056, ParentProcessName: explorer.exe, ProcessCommandLine: "C:\Windows\SysWOW64\rundll32.exe", ProcessId: 6696, ProcessName: rundll32.exe
          Sigma detected: Powershell Defender Exclusion
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3P5I851G78.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3P5I851G78.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\3P5I851G78.exe", ParentImage: C:\Users\user\Desktop\3P5I851G78.exe, ParentProcessId: 6716, ParentProcessName: 3P5I851G78.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3P5I851G78.exe", ProcessId: 1400, ProcessName: powershell.exe
          Sigma detected: Non Interactive PowerShell Process Spawned
          Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3P5I851G78.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3P5I851G78.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\3P5I851G78.exe", ParentImage: C:\Users\user\Desktop\3P5I851G78.exe, ParentProcessId: 6716, ParentProcessName: 3P5I851G78.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3P5I851G78.exe", ProcessId: 1400, ProcessName: powershell.exe
          Sigma detected: Windows Processes Suspicious Parent Directory
          Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 628, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4124, ProcessName: svchost.exe

          Suricata Signatures

          ⊘No Suricata rule has matched

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Antivirus / Scanner detection for submitted sample
          Source: 3P5I851G78.exeAvira: detected
          Antivirus detection for URL or domain
          Source: http://www.avada-casino-tlj.buzz/bc01/Avira URL Cloud: Label: malware
          Source: http://www.avada-casino-tlj.buzz/bc01/www.ajabandot.websiteAvira URL Cloud: Label: malware
          Source: www.avada-casino-tlj.buzz/bc01/Avira URL Cloud: Label: malware
          Found malware configuration
          Source: 00000000.00000002.855098590.00000000040D9000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.avada-casino-tlj.buzz/bc01/"], "decoy": ["epatitis-treatment-26155.bond", "52cy67sk.bond", "nline-degree-6987776.world", "ingxingdiandeng-2033.top", "mberbreeze.cyou", "48xc300mw.autos", "obs-for-seniors-39582.bond", "tpetersburg-3-tonn.online", "egafon-parser.online", "172jh.shop", "ltraman.pro", "bqfhnys.shop", "ntercash24-cad.homes", "uhtwister.cloud", "alk-in-tubs-27353.bond", "ucas-saaad.buzz", "oko.events", "8080713.xyz", "refabricated-homes-74404.bond", "inaa.boo", "nnevateknoloji.xyz", "ar-accident-lawyer-389.today", "ianju-fvqh092.vip", "ealthandwellnessly.digital", "qzxx.top", "q8189.top", "ecurity-service-22477.bond", "ractors-42621.bond", "astamadre.shop", "tonomushotel.xyz", "cowatt.fun", "olocaustaffirmer.net", "delphi.ltd", "mmwinni.buzz", "8009.top", "nline-gaming-ox-fr.xyz", "irtyeffingrancher.info", "omotech-dz.net", "akemoneyonline.bond", "ustbookin.online", "eals.lat", "irmag.online", "eddogbrands.website", "oifulcares.net", "aming-chair-83359.bond", "ewferg.top", "areless.net", "torygame168.online", "y-language-menu.net", "iring-cleaners-2507.xyz", "inancialenlightment.info", "ar-accident-lawyer-389.today", "sicologosportugueses.online", "ajabandot.website", "oidakings.net", "2ar1.shop", "comedia.lol", "kjbrosmm.shop", "ffpage.shop", "nfluencer-marketing-17923.bond", "ebshieldsrenew.live", "lkjuy.xyz", "lussalesapp.website", "hildrens-clothing.today"]}
          Multi AV Scanner detection for submitted file
          Source: 3P5I851G78.exeVirustotal: Detection: 77%Perma Link
          Source: 3P5I851G78.exeReversingLabs: Detection: 83%
          Yara detected FormBook
          Source: Yara matchFile source: 3.2.3P5I851G78.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 3.2.3P5I851G78.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000000.00000002.855098590.00000000040D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.3294789959.00000000043F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.3294895967.0000000004420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.913516599.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.3293228083.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Joe Sandbox ML detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
          Source: 3P5I851G78.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: 3P5I851G78.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Binary string: wntdll.pdbUGP source: 3P5I851G78.exe, 00000003.00000002.914290467.00000000013A0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.915857022.00000000043D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3295171067.0000000004580000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.914187722.0000000004227000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3295171067.000000000471E000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: 3P5I851G78.exe, 3P5I851G78.exe, 00000003.00000002.914290467.00000000013A0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, rundll32.exe, 00000007.00000003.915857022.00000000043D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3295171067.0000000004580000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.914187722.0000000004227000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3295171067.000000000471E000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: rundll32.pdb source: 3P5I851G78.exe, 00000003.00000002.913907607.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, 3P5I851G78.exe, 00000003.00000002.914211028.0000000001310000.00000040.10000000.00040000.00000000.sdmp, rundll32.exe, rundll32.exe, 00000007.00000002.3293589997.0000000000540000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: rundll32.pdbGCTL source: 3P5I851G78.exe, 00000003.00000002.913907607.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, 3P5I851G78.exe, 00000003.00000002.914211028.0000000001310000.00000040.10000000.00040000.00000000.sdmp, rundll32.exe, 00000007.00000002.3293589997.0000000000540000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: YEZu.pdb source: 3P5I851G78.exe
          Source: Binary string: YEZu.pdbSHA256=Q source: 3P5I851G78.exe
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 4x nop then jmp 0776AFD1h0_2_0776A7CA
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 4x nop then jmp 0776AFD1h0_2_0776A662
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 4x nop then jmp 0776AFD1h0_2_0776A4F3
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 4x nop then jmp 0776AFD1h0_2_0776A49E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 4x nop then jmp 0776AFD1h0_2_0776A8AE
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 4x nop then jmp 0776AFD1h0_2_0776A4C2
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 4x nop then jmp 0776AFD1h0_2_0776A982
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 4x nop then jmp 0776AFD1h0_2_0776A8F6
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 4x nop then pop edi3_2_0040E461
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4x nop then pop edi7_2_0048E461

          Networking

          barindex
          C2 URLs / IPs found in malware configuration
          Source: Malware configuration extractorURLs: www.avada-casino-tlj.buzz/bc01/
          Source: Joe Sandbox ViewIP Address: 204.79.197.203 204.79.197.203
          Source: Joe Sandbox ViewIP Address: 204.79.197.203 204.79.197.203
          Source: global trafficTCP traffic: 192.168.2.8:49671 -> 204.79.197.203:443
          Source: unknownDNS traffic detected: query: www.irtyeffingrancher.info replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.ucas-saaad.buzz replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.2ar1.shop replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.mberbreeze.cyou replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.cowatt.fun replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.lussalesapp.website replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.eddogbrands.website replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.ianju-fvqh092.vip replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.olocaustaffirmer.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.kjbrosmm.shop replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.48xc300mw.autos replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.irtyeffingrancher.info replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.ucas-saaad.buzz replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.2ar1.shop replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.mberbreeze.cyou replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.cowatt.fun replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.lussalesapp.website replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.eddogbrands.website replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.ianju-fvqh092.vip replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.olocaustaffirmer.net replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.kjbrosmm.shop replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.48xc300mw.autos replaycode: Name error (3)
          Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
          Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
          Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
          Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
          Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
          Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
          Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: global trafficDNS traffic detected: DNS query: www.olocaustaffirmer.net
          Source: global trafficDNS traffic detected: DNS query: www.2ar1.shop
          Source: global trafficDNS traffic detected: DNS query: www.cowatt.fun
          Source: global trafficDNS traffic detected: DNS query: www.eddogbrands.website
          Source: global trafficDNS traffic detected: DNS query: www.irtyeffingrancher.info
          Source: global trafficDNS traffic detected: DNS query: www.48xc300mw.autos
          Source: global trafficDNS traffic detected: DNS query: www.ucas-saaad.buzz
          Source: global trafficDNS traffic detected: DNS query: www.ianju-fvqh092.vip
          Source: global trafficDNS traffic detected: DNS query: www.kjbrosmm.shop
          Source: global trafficDNS traffic detected: DNS query: www.mberbreeze.cyou
          Source: global trafficDNS traffic detected: DNS query: www.lussalesapp.website
          Source: explorer.exe, 00000005.00000000.857830401.0000000007459000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.862222610.000000000974B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3075864636.0000000007491000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3303728058.0000000007498000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1782562029.0000000007495000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.853262365.0000000000C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
          Source: explorer.exe, 00000005.00000000.857830401.0000000007459000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.862222610.000000000974B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3075864636.0000000007491000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3303728058.0000000007498000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1782562029.0000000007495000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.853262365.0000000000C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
          Source: qmgr.db.11.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
          Source: qmgr.db.11.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
          Source: qmgr.db.11.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
          Source: qmgr.db.11.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
          Source: qmgr.db.11.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
          Source: qmgr.db.11.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
          Source: qmgr.db.11.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
          Source: explorer.exe, 00000005.00000000.857830401.0000000007459000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.862222610.000000000974B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3075864636.0000000007491000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3303728058.0000000007498000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1782562029.0000000007495000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.853262365.0000000000C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
          Source: explorer.exe, 00000005.00000002.3305943202.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.862222610.00000000096DF000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crl
          Source: explorer.exe, 00000005.00000002.3310613328.000000000C46D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780682027.000000000C468000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1778062210.000000000C464000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076529844.000000000C468000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.micr
          Source: explorer.exe, 00000005.00000002.3304397394.0000000007940000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.861919061.00000000086A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.3305438794.0000000008680000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
          Source: 3P5I851G78.exe, 00000000.00000002.853915217.0000000003115000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
          Source: 3P5I851G78.exeString found in binary or memory: http://tempuri.org/EchipamenteDataSet.xsd
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.2ar1.shop
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.2ar1.shop/bc01/
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.2ar1.shop/bc01/www.cowatt.fun
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.2ar1.shopReferer:
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.48xc300mw.autos
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.48xc300mw.autos/bc01/
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.48xc300mw.autos/bc01/www.ucas-saaad.buzz
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.48xc300mw.autosReferer:
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ajabandot.website
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ajabandot.website/bc01/
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ajabandot.website/bc01/www.oko.events
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ajabandot.websiteReferer:
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.avada-casino-tlj.buzz
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.avada-casino-tlj.buzz/bc01/
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.avada-casino-tlj.buzz/bc01/www.ajabandot.website
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.avada-casino-tlj.buzzReferer:
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.cowatt.fun
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.cowatt.fun/bc01/
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.cowatt.fun/bc01/www.eddogbrands.website
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.cowatt.funReferer:
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.eddogbrands.website
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.eddogbrands.website/bc01/
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.eddogbrands.website/bc01/www.lkjuy.xyz
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.eddogbrands.websiteReferer:
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ianju-fvqh092.vip
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ianju-fvqh092.vip/bc01/
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ianju-fvqh092.vip/bc01/www.kjbrosmm.shop
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ianju-fvqh092.vipReferer:
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.irtyeffingrancher.info
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.irtyeffingrancher.info/bc01/
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.irtyeffingrancher.info/bc01/www.48xc300mw.autos
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.irtyeffingrancher.infoReferer:
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.kjbrosmm.shop
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.kjbrosmm.shop/bc01/
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.kjbrosmm.shop/bc01/www.mberbreeze.cyou
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.kjbrosmm.shopReferer:
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.lkjuy.xyz
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.lkjuy.xyz/bc01/
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.lkjuy.xyz/bc01/www.irtyeffingrancher.info
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.lkjuy.xyzReferer:
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.lussalesapp.website
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.lussalesapp.website/bc01/
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.lussalesapp.website/bc01/www.avada-casino-tlj.buzz
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.lussalesapp.websiteReferer:
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.mberbreeze.cyou
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.mberbreeze.cyou/bc01/
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.mberbreeze.cyou/bc01/www.lussalesapp.website
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.mberbreeze.cyouReferer:
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.oidakings.net
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.oidakings.net/bc01/
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.oidakings.net/bc01/Pm
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.oidakings.netReferer:
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.oko.events
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.oko.events/bc01/
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.oko.events/bc01/www.oidakings.net
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.oko.eventsReferer:
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.olocaustaffirmer.net
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.olocaustaffirmer.net/bc01/
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.olocaustaffirmer.net/bc01/www.2ar1.shop
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.olocaustaffirmer.netReferer:
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ucas-saaad.buzz
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ucas-saaad.buzz/bc01/
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ucas-saaad.buzz/bc01/www.ianju-fvqh092.vip
          Source: explorer.exe, 00000005.00000003.1780345292.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3076738989.000000000C39D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3310508252.000000000C380000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1780982012.000000000C39D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ucas-saaad.buzzReferer:
          Source: explorer.exe, 00000005.00000000.867214121.000000000C201000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
          Source: explorer.exe, 00000005.00000002.3309574612.000000000C18E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.867214121.000000000C18E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
          Source: explorer.exe, 00000005.00000002.3309574612.000000000C18E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.867214121.000000000C18E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOSI
          Source: explorer.exe, 00000005.00000002.3309574612.000000000C18E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.867214121.000000000C18E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOSd
          Source: explorer.exe, 00000005.00000000.862222610.00000000095B2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3305943202.00000000095B2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
          Source: explorer.exe, 00000005.00000002.3305943202.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.862222610.00000000096DF000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0E948A694F8C48079B908C8EA9DDF9EA&timeOut=5000&oc
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
          Source: explorer.exe, 00000005.00000000.862222610.00000000096C4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3305943202.00000000096C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.com
          Source: explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
          Source: explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k-dark
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA-dark
          Source: explorer.exe, 00000005.00000002.3305943202.0000000009741000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.862222610.0000000009741000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1779102746.0000000009741000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
          Source: explorer.exe, 00000005.00000000.867214121.000000000C201000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3309574612.000000000C201000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.comPh
          Source: svchost.exe, 0000000B.00000003.1203070187.000002C690121000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.11.drString found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
          Source: svchost.exe, 0000000B.00000003.1203070187.000002C6900B0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.11.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1b2aMG.img
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hGNsX.img
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAT0qC2.img
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBYTL1i.img
          Source: explorer.exe, 00000005.00000000.867214121.000000000C201000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3309574612.000000000C201000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.com
          Source: explorer.exe, 00000005.00000000.867214121.000000000C201000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3309574612.000000000C201000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.com_
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/thumb/8/84/Zealandia-Continent_map_en.svg/1870px-Zeal
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
          Source: explorer.exe, 00000005.00000002.3309574612.000000000C18E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.867214121.000000000C18E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/
          Source: explorer.exe, 00000005.00000000.867214121.000000000C201000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3309574612.000000000C201000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.comTM~1
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-big-3-mistakes-financial-advisors-say-that-the-1
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/other/predicting-what-the-pac-12-would-look-like-after-expansion-wi
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/other/washington-state-ad-asks-ncaa-for-compassion-and-understandin
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/first-map-of-earth-s-lost-continent-has-been-published/
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/stop-planting-new-forests-scientists-say/ar-AA1hFI09
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
          Source: explorer.exe, 00000005.00000002.3300695016.0000000007386000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com:443/en-us/feed
          Source: unknownNetwork traffic detected: HTTP traffic on port 49671 -> 443

          E-Banking Fraud

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 3.2.3P5I851G78.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 3.2.3P5I851G78.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000000.00000002.855098590.00000000040D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.3294789959.00000000043F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.3294895967.0000000004420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.913516599.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.3293228083.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 3.2.3P5I851G78.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Diceloader_15eeb7b9 Author: unknown
          Source: 3.2.3P5I851G78.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 3.2.3P5I851G78.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 3.2.3P5I851G78.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 3.2.3P5I851G78.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Diceloader_15eeb7b9 Author: unknown
          Source: 3.2.3P5I851G78.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 3.2.3P5I851G78.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 3.2.3P5I851G78.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000000.00000002.855098590.00000000040D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Diceloader_15eeb7b9 Author: unknown
          Source: 00000000.00000002.855098590.00000000040D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000000.00000002.855098590.00000000040D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000000.00000002.855098590.00000000040D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000003.00000002.913848993.0000000000F1F000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Diceloader_15eeb7b9 Author: unknown
          Source: 00000007.00000002.3294789959.00000000043F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Diceloader_15eeb7b9 Author: unknown
          Source: 00000007.00000002.3294789959.00000000043F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000007.00000002.3294789959.00000000043F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000002.3294789959.00000000043F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000002.3294895967.0000000004420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Diceloader_15eeb7b9 Author: unknown
          Source: 00000007.00000002.3294895967.0000000004420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000007.00000002.3294895967.0000000004420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000002.3294895967.0000000004420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000003.00000002.913516599.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Diceloader_15eeb7b9 Author: unknown
          Source: 00000003.00000002.913516599.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000003.00000002.913516599.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000003.00000002.913516599.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000002.3293228083.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Diceloader_15eeb7b9 Author: unknown
          Source: 00000007.00000002.3293228083.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000007.00000002.3293228083.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000002.3293228083.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000005.00000002.3310801757.000000000E2D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
          Source: Process Memory Space: 3P5I851G78.exe PID: 6716, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: 3P5I851G78.exe PID: 3936, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: rundll32.exe PID: 6696, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0041A330 NtCreateFile,3_2_0041A330
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0041A3E0 NtReadFile,3_2_0041A3E0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0041A460 NtClose,3_2_0041A460
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0041A510 NtAllocateVirtualMemory,3_2_0041A510
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0041A3DB NtReadFile,3_2_0041A3DB
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0041A50F NtAllocateVirtualMemory,3_2_0041A50F
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412B60 NtClose,LdrInitializeThunk,3_2_01412B60
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412BF0 NtAllocateVirtualMemory,LdrInitializeThunk,3_2_01412BF0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412AD0 NtReadFile,LdrInitializeThunk,3_2_01412AD0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412D10 NtMapViewOfSection,LdrInitializeThunk,3_2_01412D10
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412D30 NtUnmapViewOfSection,LdrInitializeThunk,3_2_01412D30
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412DD0 NtDelayExecution,LdrInitializeThunk,3_2_01412DD0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412DF0 NtQuerySystemInformation,LdrInitializeThunk,3_2_01412DF0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412C70 NtFreeVirtualMemory,LdrInitializeThunk,3_2_01412C70
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412CA0 NtQueryInformationToken,LdrInitializeThunk,3_2_01412CA0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412F30 NtCreateSection,LdrInitializeThunk,3_2_01412F30
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412FE0 NtCreateFile,LdrInitializeThunk,3_2_01412FE0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412F90 NtProtectVirtualMemory,LdrInitializeThunk,3_2_01412F90
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412FB0 NtResumeThread,LdrInitializeThunk,3_2_01412FB0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412E80 NtReadVirtualMemory,LdrInitializeThunk,3_2_01412E80
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,3_2_01412EA0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01414340 NtSetContextThread,3_2_01414340
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01414650 NtSuspendThread,3_2_01414650
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412BE0 NtQueryValueKey,3_2_01412BE0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412B80 NtQueryInformationFile,3_2_01412B80
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412BA0 NtEnumerateValueKey,3_2_01412BA0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412AF0 NtWriteFile,3_2_01412AF0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412AB0 NtWaitForSingleObject,3_2_01412AB0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412D00 NtSetInformationFile,3_2_01412D00
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412DB0 NtEnumerateKey,3_2_01412DB0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412C60 NtCreateKey,3_2_01412C60
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412C00 NtQueryInformationProcess,3_2_01412C00
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412CC0 NtQueryVirtualMemory,3_2_01412CC0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412CF0 NtOpenProcess,3_2_01412CF0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412F60 NtCreateProcessEx,3_2_01412F60
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412FA0 NtQuerySection,3_2_01412FA0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412E30 NtWriteVirtualMemory,3_2_01412E30
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412EE0 NtQueueApcThread,3_2_01412EE0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01413010 NtOpenDirectoryObject,3_2_01413010
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01413090 NtSetValueKey,3_2_01413090
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014135C0 NtCreateMutant,3_2_014135C0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014139B0 NtGetContextThread,3_2_014139B0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01413D70 NtOpenThread,3_2_01413D70
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01413D10 NtOpenProcessToken,3_2_01413D10
          Source: C:\Windows\explorer.exeCode function: 5_2_0E2B8232 NtCreateFile,5_2_0E2B8232
          Source: C:\Windows\explorer.exeCode function: 5_2_0E2B9E12 NtProtectVirtualMemory,5_2_0E2B9E12
          Source: C:\Windows\explorer.exeCode function: 5_2_0E2B9E0A NtProtectVirtualMemory,5_2_0E2B9E0A
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_00545CF1 NtQueryInformationToken,NtQueryInformationToken,RtlNtStatusToDosError,7_2_00545CF1
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_005440B1 NtQuerySystemInformation,7_2_005440B1
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_00545D6A NtOpenProcessToken,RtlNtStatusToDosError,NtClose,QueryActCtxW,NtOpenProcessToken,NtSetInformationToken,NtClose,7_2_00545D6A
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_00544136 HeapSetInformation,NtSetInformationProcess,AttachConsole,LocalAlloc,LoadLibraryExW,GetProcAddress,SetErrorMode,FreeLibrary,LocalFree,DeactivateActCtx,ReleaseActCtx,FreeLibrary,LocalFree,FreeConsole,ExitProcess,7_2_00544136
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2C70 NtFreeVirtualMemory,LdrInitializeThunk,7_2_045F2C70
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2C60 NtCreateKey,LdrInitializeThunk,7_2_045F2C60
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2CA0 NtQueryInformationToken,LdrInitializeThunk,7_2_045F2CA0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2D10 NtMapViewOfSection,LdrInitializeThunk,7_2_045F2D10
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2DD0 NtDelayExecution,LdrInitializeThunk,7_2_045F2DD0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2DF0 NtQuerySystemInformation,LdrInitializeThunk,7_2_045F2DF0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,7_2_045F2EA0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2F30 NtCreateSection,LdrInitializeThunk,7_2_045F2F30
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2FE0 NtCreateFile,LdrInitializeThunk,7_2_045F2FE0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2AD0 NtReadFile,LdrInitializeThunk,7_2_045F2AD0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2B60 NtClose,LdrInitializeThunk,7_2_045F2B60
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,7_2_045F2BF0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2BE0 NtQueryValueKey,LdrInitializeThunk,7_2_045F2BE0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F35C0 NtCreateMutant,LdrInitializeThunk,7_2_045F35C0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F4650 NtSuspendThread,7_2_045F4650
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F4340 NtSetContextThread,7_2_045F4340
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2C00 NtQueryInformationProcess,7_2_045F2C00
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2CC0 NtQueryVirtualMemory,7_2_045F2CC0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2CF0 NtOpenProcess,7_2_045F2CF0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2D00 NtSetInformationFile,7_2_045F2D00
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2D30 NtUnmapViewOfSection,7_2_045F2D30
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2DB0 NtEnumerateKey,7_2_045F2DB0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2E30 NtWriteVirtualMemory,7_2_045F2E30
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2EE0 NtQueueApcThread,7_2_045F2EE0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2E80 NtReadVirtualMemory,7_2_045F2E80
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2F60 NtCreateProcessEx,7_2_045F2F60
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2F90 NtProtectVirtualMemory,7_2_045F2F90
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2FB0 NtResumeThread,7_2_045F2FB0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2FA0 NtQuerySection,7_2_045F2FA0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2AF0 NtWriteFile,7_2_045F2AF0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2AB0 NtWaitForSingleObject,7_2_045F2AB0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2B80 NtQueryInformationFile,7_2_045F2B80
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F2BA0 NtEnumerateValueKey,7_2_045F2BA0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F3010 NtOpenDirectoryObject,7_2_045F3010
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F3090 NtSetValueKey,7_2_045F3090
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F3D70 NtOpenThread,7_2_045F3D70
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F3D10 NtOpenProcessToken,7_2_045F3D10
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F39B0 NtGetContextThread,7_2_045F39B0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0049A330 NtCreateFile,7_2_0049A330
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0049A3E0 NtReadFile,7_2_0049A3E0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0049A460 NtClose,7_2_0049A460
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0049A510 NtAllocateVirtualMemory,7_2_0049A510
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0049A3DB NtReadFile,7_2_0049A3DB
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0049A50F NtAllocateVirtualMemory,7_2_0049A50F
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_048DA036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread,7_2_048DA036
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_048D9BAF NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose,7_2_048D9BAF
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_048DA042 NtQueryInformationProcess,7_2_048DA042
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_048D9BB2 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,7_2_048D9BB2
          Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmpJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 0_2_018E42100_2_018E4210
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 0_2_018E6F900_2_018E6F90
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 0_2_018EDE740_2_018EDE74
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 0_2_057500400_2_05750040
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 0_2_057500070_2_05750007
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 0_2_07416F500_2_07416F50
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 0_2_07415F600_2_07415F60
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 0_2_0741EA430_2_0741EA43
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 0_2_077685000_2_07768500
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 0_2_077684EF0_2_077684EF
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 0_2_077664A80_2_077664A8
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 0_2_077660610_2_07766061
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 0_2_07767FF00_2_07767FF0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 0_2_07765C380_2_07765C38
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0041E8573_2_0041E857
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_004010303_2_00401030
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0041DAED3_2_0041DAED
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0041DA9C3_2_0041DA9C
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0041E4DB3_2_0041E4DB
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0041D5733_2_0041D573
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_00402D893_2_00402D89
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_00402D903_2_00402D90
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0041EE4C3_2_0041EE4C
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_00409E5B3_2_00409E5B
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_00409E603_2_00409E60
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_00402FB03_2_00402FB0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014681583_2_01468158
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D01003_2_013D0100
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147A1183_2_0147A118
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014981CC3_2_014981CC
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014A01AA3_2_014A01AA
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014941A23_2_014941A2
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014720003_2_01472000
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0149A3523_2_0149A352
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014A03E63_2_014A03E6
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013EE3F03_2_013EE3F0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014802743_2_01480274
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014602C03_2_014602C0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E05353_2_013E0535
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014A05913_2_014A0591
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014924463_2_01492446
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014844203_2_01484420
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0148E4F63_2_0148E4F6
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014047503_2_01404750
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E07703_2_013E0770
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DC7C03_2_013DC7C0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FC6E03_2_013FC6E0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F69623_2_013F6962
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E29A03_2_013E29A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014AA9A63_2_014AA9A6
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013EA8403_2_013EA840
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E28403_2_013E2840
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013C68B83_2_013C68B8
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140E8F03_2_0140E8F0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0149AB403_2_0149AB40
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01496BD73_2_01496BD7
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DEA803_2_013DEA80
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013EAD003_2_013EAD00
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147CD1F3_2_0147CD1F
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F8DBF3_2_013F8DBF
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DADE03_2_013DADE0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0C003_2_013E0C00
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D0CF23_2_013D0CF2
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01480CB53_2_01480CB5
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01454F403_2_01454F40
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01422F283_2_01422F28
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01400F303_2_01400F30
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01482F303_2_01482F30
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013ECFE03_2_013ECFE0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145EFA03_2_0145EFA0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D2FC83_2_013D2FC8
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0E593_2_013E0E59
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0149EE263_2_0149EE26
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0149EEDB3_2_0149EEDB
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F2E903_2_013F2E90
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0149CE933_2_0149CE93
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014AB16B3_2_014AB16B
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0141516C3_2_0141516C
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013CF1723_2_013CF172
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013EB1B03_2_013EB1B0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0148F0CC3_2_0148F0CC
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014970E93_2_014970E9
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0149F0E03_2_0149F0E0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E70C03_2_013E70C0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0149132D3_2_0149132D
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013CD34C3_2_013CD34C
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0142739A3_2_0142739A
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E52A03_2_013E52A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014812ED3_2_014812ED
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FB2C03_2_013FB2C0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014975713_2_01497571
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147D5B03_2_0147D5B0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D14603_2_013D1460
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0149F43F3_2_0149F43F
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0149F7B03_2_0149F7B0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014916CC3_2_014916CC
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014759103_2_01475910
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E99503_2_013E9950
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FB9503_2_013FB950
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144D8003_2_0144D800
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E38E03_2_013E38E0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0149FB763_2_0149FB76
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01455BF03_2_01455BF0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0141DBF93_2_0141DBF9
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FFB803_2_013FFB80
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0149FA493_2_0149FA49
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01497A463_2_01497A46
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01453A6C3_2_01453A6C
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0148DAC63_2_0148DAC6
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01425AA03_2_01425AA0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147DAAC3_2_0147DAAC
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01481AA33_2_01481AA3
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01491D5A3_2_01491D5A
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01497D733_2_01497D73
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E3D403_2_013E3D40
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FFDC03_2_013FFDC0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01459C323_2_01459C32
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0149FCF23_2_0149FCF2
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0149FF093_2_0149FF09
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E1F923_2_013E1F92
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013A3FD23_2_013A3FD2
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013A3FD53_2_013A3FD5
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0149FFB13_2_0149FFB1
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E9EB03_2_013E9EB0
          Source: C:\Windows\explorer.exeCode function: 5_2_0BE89B305_2_0BE89B30
          Source: C:\Windows\explorer.exeCode function: 5_2_0BE89B325_2_0BE89B32
          Source: C:\Windows\explorer.exeCode function: 5_2_0BE8F2325_2_0BE8F232
          Source: C:\Windows\explorer.exeCode function: 5_2_0BE925CD5_2_0BE925CD
          Source: C:\Windows\explorer.exeCode function: 5_2_0BE86D025_2_0BE86D02
          Source: C:\Windows\explorer.exeCode function: 5_2_0BE8C9125_2_0BE8C912
          Source: C:\Windows\explorer.exeCode function: 5_2_0BE850825_2_0BE85082
          Source: C:\Windows\explorer.exeCode function: 5_2_0BE8E0365_2_0BE8E036
          Source: C:\Windows\explorer.exeCode function: 5_2_0E2B82325_2_0E2B8232
          Source: C:\Windows\explorer.exeCode function: 5_2_0E2B70365_2_0E2B7036
          Source: C:\Windows\explorer.exeCode function: 5_2_0E2AE0825_2_0E2AE082
          Source: C:\Windows\explorer.exeCode function: 5_2_0E2B2B325_2_0E2B2B32
          Source: C:\Windows\explorer.exeCode function: 5_2_0E2B2B305_2_0E2B2B30
          Source: C:\Windows\explorer.exeCode function: 5_2_0E2AFD025_2_0E2AFD02
          Source: C:\Windows\explorer.exeCode function: 5_2_0E2B59125_2_0E2B5912
          Source: C:\Windows\explorer.exeCode function: 5_2_0E2BB5CD5_2_0E2BB5CD
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_046724467_2_04672446
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_046644207_2_04664420
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0466E4F67_2_0466E4F6
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045C05357_2_045C0535
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_046805917_2_04680591
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045DC6E07_2_045DC6E0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045E47507_2_045E4750
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045C07707_2_045C0770
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045BC7C07_2_045BC7C0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_046520007_2_04652000
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_046481587_2_04648158
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045B01007_2_045B0100
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0465A1187_2_0465A118
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_046781CC7_2_046781CC
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_046801AA7_2_046801AA
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_046741A27_2_046741A2
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_046602747_2_04660274
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_046402C07_2_046402C0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0467A3527_2_0467A352
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_046803E67_2_046803E6
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045CE3F07_2_045CE3F0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045C0C007_2_045C0C00
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045B0CF27_2_045B0CF2
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_04660CB57_2_04660CB5
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045CAD007_2_045CAD00
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0465CD1F7_2_0465CD1F
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045BADE07_2_045BADE0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045D8DBF7_2_045D8DBF
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045C0E597_2_045C0E59
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0467EE267_2_0467EE26
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0467EEDB7_2_0467EEDB
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045D2E907_2_045D2E90
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0467CE937_2_0467CE93
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_04634F407_2_04634F40
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_04602F287_2_04602F28
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_04662F307_2_04662F30
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045E0F307_2_045E0F30
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045B2FC87_2_045B2FC8
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045CCFE07_2_045CCFE0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0463EFA07_2_0463EFA0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045CA8407_2_045CA840
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045C28407_2_045C2840
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045EE8F07_2_045EE8F0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045A68B87_2_045A68B8
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045D69627_2_045D6962
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0468A9A67_2_0468A9A6
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045C29A07_2_045C29A0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045BEA807_2_045BEA80
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0467AB407_2_0467AB40
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_04676BD77_2_04676BD7
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045B14607_2_045B1460
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0467F43F7_2_0467F43F
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_046775717_2_04677571
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_046895C37_2_046895C3
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0465D5B07_2_0465D5B0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_046056307_2_04605630
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_046716CC7_2_046716CC
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0467F7B07_2_0467F7B0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0467F0E07_2_0467F0E0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045C70C07_2_045C70C0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0466F0CC7_2_0466F0CC
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0468B16B7_2_0468B16B
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045AF1727_2_045AF172
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045F516C7_2_045F516C
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045CB1B07_2_045CB1B0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_046612ED7_2_046612ED
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045DB2C07_2_045DB2C0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045C52A07_2_045C52A0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045AD34C7_2_045AD34C
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0467132D7_2_0467132D
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0460739A7_2_0460739A
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_04639C327_2_04639C32
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0467FCF27_2_0467FCF2
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_04677D737_2_04677D73
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045C3D407_2_045C3D40
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_04671D5A7_2_04671D5A
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045DFDC07_2_045DFDC0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045C9EB07_2_045C9EB0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0467FF097_2_0467FF09
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_04583FD27_2_04583FD2
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_04583FD57_2_04583FD5
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045C1F927_2_045C1F92
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0467FFB17_2_0467FFB1
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0462D8007_2_0462D800
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045C38E07_2_045C38E0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045C99507_2_045C9950
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045DB9507_2_045DB950
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_046559107_2_04655910
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_04633A6C7_2_04633A6C
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_04677A467_2_04677A46
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0467FA497_2_0467FA49
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0466DAC67_2_0466DAC6
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_04605AA07_2_04605AA0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_04661AA37_2_04661AA3
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0465DAAC7_2_0465DAAC
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0467FB767_2_0467FB76
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_04635BF07_2_04635BF0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045FDBF97_2_045FDBF9
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045DFB807_2_045DFB80
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0049E4CE7_2_0049E4CE
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0049D5737_2_0049D573
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0049E8577_2_0049E857
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0049DA9C7_2_0049DA9C
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_00482D897_2_00482D89
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_00482D907_2_00482D90
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0049EE4C7_2_0049EE4C
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_00489E5B7_2_00489E5B
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_00489E607_2_00489E60
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_00482FB07_2_00482FB0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_048DA0367_2_048DA036
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_048DE5CD7_2_048DE5CD
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_048D2D027_2_048D2D02
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_048D10827_2_048D1082
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_048D89127_2_048D8912
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_048DB2327_2_048DB232
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_048D5B307_2_048D5B30
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_048D5B327_2_048D5B32
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: String function: 0145F290 appears 105 times
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: String function: 013CB970 appears 280 times
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: String function: 01427E54 appears 102 times
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: String function: 0144EA12 appears 86 times
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: String function: 01415130 appears 58 times
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 0463F290 appears 105 times
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 045AB970 appears 280 times
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 04607E54 appears 111 times
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 045F5130 appears 58 times
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 0462EA12 appears 86 times
          Source: 3P5I851G78.exe, 00000000.00000000.825396087.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameYEZu.exe8 vs 3P5I851G78.exe
          Source: 3P5I851G78.exe, 00000000.00000002.857589805.00000000076D0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs 3P5I851G78.exe
          Source: 3P5I851G78.exe, 00000000.00000002.856943890.00000000073E0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameTL.dll" vs 3P5I851G78.exe
          Source: 3P5I851G78.exe, 00000000.00000002.837827845.000000000139E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs 3P5I851G78.exe
          Source: 3P5I851G78.exe, 00000000.00000002.853915217.0000000003121000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTL.dll" vs 3P5I851G78.exe
          Source: 3P5I851G78.exe, 00000003.00000002.913907607.0000000000F5F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameRUNDLL32.EXEj% vs 3P5I851G78.exe
          Source: 3P5I851G78.exe, 00000003.00000002.913907607.0000000000F37000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameRUNDLL32.EXEj% vs 3P5I851G78.exe
          Source: 3P5I851G78.exe, 00000003.00000002.914290467.00000000014CD000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs 3P5I851G78.exe
          Source: 3P5I851G78.exe, 00000003.00000002.914211028.000000000131C000.00000040.10000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameRUNDLL32.EXEj% vs 3P5I851G78.exe
          Source: 3P5I851G78.exeBinary or memory string: OriginalFilenameYEZu.exe8 vs 3P5I851G78.exe
          Source: 3P5I851G78.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: 3.2.3P5I851G78.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Diceloader_15eeb7b9 reference_sample = a1202df600d11ad2c61050e7ba33701c22c2771b676f54edd1846ef418bea746, os = windows, severity = x86, creation_date = 2021-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Diceloader, fingerprint = 4cc70bec5d241c6f84010fbfe2eafbc6ec6d753df2bb3f52d9498b54b11fc8cb, id = 15eeb7b9-311f-477b-8ae1-b8f689a154b7, last_modified = 2021-08-23
          Source: 3.2.3P5I851G78.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 3.2.3P5I851G78.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 3.2.3P5I851G78.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 3.2.3P5I851G78.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Diceloader_15eeb7b9 reference_sample = a1202df600d11ad2c61050e7ba33701c22c2771b676f54edd1846ef418bea746, os = windows, severity = x86, creation_date = 2021-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Diceloader, fingerprint = 4cc70bec5d241c6f84010fbfe2eafbc6ec6d753df2bb3f52d9498b54b11fc8cb, id = 15eeb7b9-311f-477b-8ae1-b8f689a154b7, last_modified = 2021-08-23
          Source: 3.2.3P5I851G78.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 3.2.3P5I851G78.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 3.2.3P5I851G78.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000000.00000002.855098590.00000000040D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Diceloader_15eeb7b9 reference_sample = a1202df600d11ad2c61050e7ba33701c22c2771b676f54edd1846ef418bea746, os = windows, severity = x86, creation_date = 2021-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Diceloader, fingerprint = 4cc70bec5d241c6f84010fbfe2eafbc6ec6d753df2bb3f52d9498b54b11fc8cb, id = 15eeb7b9-311f-477b-8ae1-b8f689a154b7, last_modified = 2021-08-23
          Source: 00000000.00000002.855098590.00000000040D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000000.00000002.855098590.00000000040D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000000.00000002.855098590.00000000040D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000003.00000002.913848993.0000000000F1F000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Diceloader_15eeb7b9 reference_sample = a1202df600d11ad2c61050e7ba33701c22c2771b676f54edd1846ef418bea746, os = windows, severity = x86, creation_date = 2021-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Diceloader, fingerprint = 4cc70bec5d241c6f84010fbfe2eafbc6ec6d753df2bb3f52d9498b54b11fc8cb, id = 15eeb7b9-311f-477b-8ae1-b8f689a154b7, last_modified = 2021-08-23
          Source: 00000007.00000002.3294789959.00000000043F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Diceloader_15eeb7b9 reference_sample = a1202df600d11ad2c61050e7ba33701c22c2771b676f54edd1846ef418bea746, os = windows, severity = x86, creation_date = 2021-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Diceloader, fingerprint = 4cc70bec5d241c6f84010fbfe2eafbc6ec6d753df2bb3f52d9498b54b11fc8cb, id = 15eeb7b9-311f-477b-8ae1-b8f689a154b7, last_modified = 2021-08-23
          Source: 00000007.00000002.3294789959.00000000043F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000007.00000002.3294789959.00000000043F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000002.3294789959.00000000043F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000002.3294895967.0000000004420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Diceloader_15eeb7b9 reference_sample = a1202df600d11ad2c61050e7ba33701c22c2771b676f54edd1846ef418bea746, os = windows, severity = x86, creation_date = 2021-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Diceloader, fingerprint = 4cc70bec5d241c6f84010fbfe2eafbc6ec6d753df2bb3f52d9498b54b11fc8cb, id = 15eeb7b9-311f-477b-8ae1-b8f689a154b7, last_modified = 2021-08-23
          Source: 00000007.00000002.3294895967.0000000004420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000007.00000002.3294895967.0000000004420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000002.3294895967.0000000004420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000003.00000002.913516599.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Diceloader_15eeb7b9 reference_sample = a1202df600d11ad2c61050e7ba33701c22c2771b676f54edd1846ef418bea746, os = windows, severity = x86, creation_date = 2021-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Diceloader, fingerprint = 4cc70bec5d241c6f84010fbfe2eafbc6ec6d753df2bb3f52d9498b54b11fc8cb, id = 15eeb7b9-311f-477b-8ae1-b8f689a154b7, last_modified = 2021-08-23
          Source: 00000003.00000002.913516599.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000003.00000002.913516599.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000003.00000002.913516599.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000002.3293228083.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Diceloader_15eeb7b9 reference_sample = a1202df600d11ad2c61050e7ba33701c22c2771b676f54edd1846ef418bea746, os = windows, severity = x86, creation_date = 2021-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Diceloader, fingerprint = 4cc70bec5d241c6f84010fbfe2eafbc6ec6d753df2bb3f52d9498b54b11fc8cb, id = 15eeb7b9-311f-477b-8ae1-b8f689a154b7, last_modified = 2021-08-23
          Source: 00000007.00000002.3293228083.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000007.00000002.3293228083.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000002.3293228083.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000005.00000002.3310801757.000000000E2D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
          Source: Process Memory Space: 3P5I851G78.exe PID: 6716, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: 3P5I851G78.exe PID: 3936, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: rundll32.exe PID: 6696, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 3P5I851G78.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, Attqs9I4XaQw8dR5ep.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, Attqs9I4XaQw8dR5ep.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, NnE4Gv1rLj40w0G79X.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, NnE4Gv1rLj40w0G79X.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, NnE4Gv1rLj40w0G79X.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
          Source: classification engineClassification label: mal100.troj.evad.winEXE@262/8@11/2
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_00543C66 LoadLibraryExW,GetLastError,FormatMessageW,RtlImageNtHeader,SetProcessMitigationPolicy,7_2_00543C66
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0054205A CoCreateInstance,7_2_0054205A
          Source: C:\Users\user\Desktop\3P5I851G78.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3P5I851G78.exe.logJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3220:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6776:120:WilError_03
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yvmkkv4v.ipv.ps1Jump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeCommand line argument: WLDP.DLL7_2_00544136
          Source: C:\Windows\SysWOW64\rundll32.exeCommand line argument: localserver7_2_00544136
          Source: 3P5I851G78.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: 3P5I851G78.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
          Source: C:\Users\user\Desktop\3P5I851G78.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"
          Source: 3P5I851G78.exe, 00000000.00000000.825321659.0000000000D42000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3294453327.0000000004322000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3296285767.0000000004B6F000.00000004.10000000.00040000.00000000.sdmpBinary or memory string: INSERT INTO [dbo].[Table] ([Id], [Nume], [Grupa_muschi], [Data_livrare], [Pret]) VALUES (@Id, @Nume, @Grupa_muschi, @Data_livrare, @Pret);
          Source: 3P5I851G78.exe, 00000000.00000000.825321659.0000000000D42000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3294453327.0000000004322000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3296285767.0000000004B6F000.00000004.10000000.00040000.00000000.sdmpBinary or memory string: UPDATE [dbo].[Table] SET [Id] = @Id, [Nume] = @Nume, [Grupa_muschi] = @Grupa_muschi, [Data_livrare] = @Data_livrare, [Pret] = @Pret WHERE (([Id] = @Original_Id) AND ([Nume] = @Original_Nume) AND ([Grupa_muschi] = @Original_Grupa_muschi) AND ([Data_livrare] = @Original_Data_livrare) AND ([Pret] = @Original_Pret));
          Source: 3P5I851G78.exeVirustotal: Detection: 77%
          Source: 3P5I851G78.exeReversingLabs: Detection: 83%
          Source: unknownProcess created: C:\Users\user\Desktop\3P5I851G78.exe "C:\Users\user\Desktop\3P5I851G78.exe"
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3P5I851G78.exe"
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess created: C:\Users\user\Desktop\3P5I851G78.exe "C:\Users\user\Desktop\3P5I851G78.exe"
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"
          Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\3P5I851G78.exe"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3P5I851G78.exe"Jump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess created: C:\Users\user\Desktop\3P5I851G78.exe "C:\Users\user\Desktop\3P5I851G78.exe"Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\3P5I851G78.exe"Jump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: version.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: dwrite.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: textshaping.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: windowscodecs.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: edputil.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: windows.staterepositoryps.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: appresolver.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: bcp47langs.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: slc.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: onecorecommonproxystub.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wscinterop.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wscapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: werconcpl.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: framedynos.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wer.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: hcproviders.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.internal.shell.broker.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: esent.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: mi.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: webio.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: es.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dllJump to behavior
          Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dllJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: C:\Users\user\Desktop\3P5I851G78.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
          Source: 3P5I851G78.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
          Source: 3P5I851G78.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: 3P5I851G78.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: Binary string: wntdll.pdbUGP source: 3P5I851G78.exe, 00000003.00000002.914290467.00000000013A0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.915857022.00000000043D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3295171067.0000000004580000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.914187722.0000000004227000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3295171067.000000000471E000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: 3P5I851G78.exe, 3P5I851G78.exe, 00000003.00000002.914290467.00000000013A0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, rundll32.exe, 00000007.00000003.915857022.00000000043D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3295171067.0000000004580000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.914187722.0000000004227000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3295171067.000000000471E000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: rundll32.pdb source: 3P5I851G78.exe, 00000003.00000002.913907607.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, 3P5I851G78.exe, 00000003.00000002.914211028.0000000001310000.00000040.10000000.00040000.00000000.sdmp, rundll32.exe, rundll32.exe, 00000007.00000002.3293589997.0000000000540000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: rundll32.pdbGCTL source: 3P5I851G78.exe, 00000003.00000002.913907607.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, 3P5I851G78.exe, 00000003.00000002.914211028.0000000001310000.00000040.10000000.00040000.00000000.sdmp, rundll32.exe, 00000007.00000002.3293589997.0000000000540000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: YEZu.pdb source: 3P5I851G78.exe
          Source: Binary string: YEZu.pdbSHA256=Q source: 3P5I851G78.exe

          Data Obfuscation

          barindex
          .NET source code contains potential unpacker
          Source: 3P5I851G78.exe, Login.cs.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, NnE4Gv1rLj40w0G79X.cs.Net Code: gricDlP4ig System.Reflection.Assembly.Load(byte[])
          Source: 0.2.3P5I851G78.exe.73e0000.0.raw.unpack, .cs.Net Code: System.Reflection.Assembly.Load(byte[])
          Source: 5.2.explorer.exe.106df840.0.raw.unpack, Login.cs.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
          Source: 7.2.rundll32.exe.4b6f840.3.raw.unpack, Login.cs.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
          Source: 3P5I851G78.exeStatic PE information: 0xDEA210F1 [Wed May 12 01:18:41 2088 UTC]
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 0_2_07769610 pushfd ; retf 0_2_07769619
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 0_2_0776C320 pushad ; iretd 0_2_0776C32D
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 0_2_0776D395 push FFFFFF8Bh; iretd 0_2_0776D397
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0041B863 push esi; iretd 3_2_0041B866
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_00416B15 push 560BADFBh; retf 3_2_00416B1A
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0040E44C push fs; iretd 3_2_0040E453
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0041D4D2 push eax; ret 3_2_0041D4D8
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0041D4DB push eax; ret 3_2_0041D542
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0041D485 push eax; ret 3_2_0041D4D8
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0041D53C push eax; ret 3_2_0041D542
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013A225F pushad ; ret 3_2_013A27F9
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013A27FA pushad ; ret 3_2_013A27F9
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D09AD push ecx; mov dword ptr [esp], ecx3_2_013D09B6
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013A283D push eax; iretd 3_2_013A2858
          Source: C:\Windows\explorer.exeCode function: 5_2_0BE92B02 push esp; retn 0000h5_2_0BE92B03
          Source: C:\Windows\explorer.exeCode function: 5_2_0BE92B1E push esp; retn 0000h5_2_0BE92B1F
          Source: C:\Windows\explorer.exeCode function: 5_2_0BE929B5 push esp; retn 0000h5_2_0BE92AE7
          Source: C:\Windows\explorer.exeCode function: 5_2_0E2BBB02 push esp; retn 0000h5_2_0E2BBB03
          Source: C:\Windows\explorer.exeCode function: 5_2_0E2BBB1E push esp; retn 0000h5_2_0E2BBB1F
          Source: C:\Windows\explorer.exeCode function: 5_2_0E2BB9B5 push esp; retn 0000h5_2_0E2BBAE7
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0054682D push ecx; ret 7_2_00546840
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_00546883 push ecx; ret 7_2_00546896
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045827FA pushad ; ret 7_2_045827F9
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0458225F pushad ; ret 7_2_045827F9
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0458283D push eax; iretd 7_2_04582858
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_045B09AD push ecx; mov dword ptr [esp], ecx7_2_045B09B6
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0458135E push eax; iretd 7_2_04581369
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0048E44C push fs; iretd 7_2_0048E453
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0049D4DB push eax; ret 7_2_0049D542
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0049D4D2 push eax; ret 7_2_0049D4D8
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_0049D485 push eax; ret 7_2_0049D4D8
          Source: 3P5I851G78.exeStatic PE information: section name: .text entropy: 7.515728887545596
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, XuqctHqdTtyaSw03QR.csHigh entropy of concatenated method names: 'kpDVSZosNj', 'uYRVgeAtwa', 'VyRJdj4evG', 'DT9JWB32T2', 'pdmJrOk3Pp', 'TUYJBEwq81', 'ENPJ7syRc8', 'HpGJicRJ4c', 'bB6JyaadH3', 'WPBJnrIUOf'
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, ThMFiE89nZSu8w5YIL.csHigh entropy of concatenated method names: 'AiCM2ij9xW', 'njTM36idVV', 'Qg2Cp5ieK0', 'fSoClwJgCl', 'VbyMjjv5nM', 'bHKMYQIN26', 'NJbMU5uOIa', 'XHYMbLbPEm', 'jEAM68X9cv', 'ghgMxWYfBr'
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, ldQhZXll7DWVJ8p0fxS.csHigh entropy of concatenated method names: 'v7sv33lrPF', 'lX6vzicysK', 'U8TTpx7VPL', 'lTiTlEBa8J', 'PFNT9Wl79J', 'KoRTEWdBQk', 'AjPTcKYHeS', 'zjsTZdvpkg', 'oGGTKsaQL9', 'pNwTogtuy5'
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, pynNHXyOmy3HdffU08.csHigh entropy of concatenated method names: 'lb3LmuVBmn', 'nShLelj5xG', 'IblLDrVLiJ', 'C7NLk5lS8T', 'xPKLSoosJ3', 'PsXLGm98MB', 'h8NLgR60hw', 'GqZLIgrWWl', 'n16LRKJk0Y', 'lWLLqmaDwa'
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, W5HArt4CCmEmHPwRqq.csHigh entropy of concatenated method names: 'RoAPZy1oZ0', 'z0UPorIkKg', 'LGBPVbyqRU', 'VH4PL5LGvg', 'liNP1Is8Td', 'HS6VuC3wBy', 'Kc7V8kdr1b', 'skgVAVH2Gq', 'ThpV2bcpLQ', 'hIwVwVLqFT'
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, RHKFhM75AlZtioMX4k.csHigh entropy of concatenated method names: 'OchLKaopU6', 'btrLJWGQai', 'RX1LPIASwC', 'xlvP3iItfN', 'bw0Pz1qfAq', 'sDmLppnvE4', 'berLlre3WY', 'mnFL9BZoFy', 'IZeLEAmT5c', 'HEdLcisqkB'
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, Attqs9I4XaQw8dR5ep.csHigh entropy of concatenated method names: 'ssOob6bjXC', 'WZ5o6euxkp', 'SsvoxkKXr8', 'AALofNy5g2', 'IqSouqdF2y', 'DnFo85dkGY', 'uXIoAQ0ZaX', 'L59o2osnV3', 'gZeow54aCp', 'fQQo3p0Amk'
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, kRVLFRxPPdA1om01wQ.csHigh entropy of concatenated method names: 'ToString', 'gAdNj4P5j4', 'JbBNtfib8o', 'H6WNdwSsWj', 'ogkNWGHjC7', 'fUxNr6bvM9', 'bi4NBMXWp1', 'VveN74cbKC', 'frfNiTeSXV', 'apVNyHklHQ'
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, CoAOoJAP4Jm9DLDrtQ.csHigh entropy of concatenated method names: 'aebO5qD0Ip', 'AHvOM2YbK9', 'VGQOOV6TXO', 'ngfOTDNp7v', 'qDROFDknjo', 'mG0OsmfyJZ', 'Dispose', 'wePCKGwQqU', 'O7ZCo6LE9Z', 'NgVCJg7r94'
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, uteAvrlcpLqrxkTlwV2.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'OpkaOcxbsl', 'FYNavdQK6H', 'ElOaTMgyJ6', 'xPsaaccl42', 'r5taFVtWFu', 'r64aH0ZFIC', 'CyhasQpfjZ'
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, tDRWvHUeA4AbnwQHGO.csHigh entropy of concatenated method names: 'iBLQIQwJr1', 'mh2QRPSXrm', 'bToQ4q9LD7', 'UlkQtZJy9u', 'g7hQW3mYC8', 'q5vQrWs2rD', 'eA5Q7jmTsH', 'gSLQiHkUxE', 'aNGQnT5SwS', 'KtCQjV8E0q'
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, lBM7hsJloWh9HxwHoL.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'ARa9wLV6di', 'umX93MwaU7', 'TP49zkYJLE', 'u3QEp8IE2g', 'SuFEl6QxZs', 'DAmE9owRnM', 'UL2EE4ei8E', 'z70j3BwKyxtrX0OTwV7'
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, MHVXvicEvIY6VjtFia.csHigh entropy of concatenated method names: 'ypklLttqs9', 'GXal1Qw8dR', 'fgrl0n3o30', 'tOJlXUwuqc', 'X03l5QR25H', 'WrtlNCCmEm', 'lMshK0lAedqiGEHL2L', 'QdlO3AicmVbbyL4hIo', 'OJclliLtR8', 'mW2lETWnQR'
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, iyXJg4wAhglxAHC4go.csHigh entropy of concatenated method names: 'iRZO4iTDjM', 'JsWOtZIyxp', 'hZQOd0mDJr', 'CP0OWB0mqV', 'nnVOraGWJ3', 'RjsOBBPeX8', 'Q80O7AfLc9', 'tB9OilRA5U', 'AjVOyA6U5O', 'NCqOnRCw1i'
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, KZvlnj9oIroObZ9DMw.csHigh entropy of concatenated method names: 'qV2DjxM4u', 'jglkCHvA8', 'WmjGqgUtL', 't12gtHK2d', 'u6tRJ1nAg', 'tM6qfV6Jx', 'bxdxv3j1vtFUtcHVBm', 'qSVoL4VbaR4tTsD0MB', 'SMXCefdDL', 'fr7vXJt4h'
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, PHWj2Yz26KOvC5YYpI.csHigh entropy of concatenated method names: 'KqkvGJGSOT', 'xIuvIxsdmD', 'LAxvRjMhts', 'UZev40Ukxl', 'OfivtYX4H0', 'B9pvWgi4Yr', 'vwcvrZKePr', 'uFqvsB79p0', 'MC6vmxYh3T', 'CNTveimrHd'
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, gpOcnxorTfdAp1XbPX.csHigh entropy of concatenated method names: 'Dispose', 'hm9lwDLDrt', 'KZV9tGEacD', 'sltqdaAvNU', 'nbll3s2ykl', 'FFHlzPi8KU', 'ProcessDialogKey', 'pnP9pyXJg4', 'Vhg9llxAHC', 'Ggo99sStgt'
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, WNklqKRgrn3o30TOJU.csHigh entropy of concatenated method names: 'IWjJkg0EEn', 'uXbJGmaj8m', 'GDSJIA7DUy', 'XjPJRBVak9', 'CBXJ5tUgdC', 'n7kJNsC1Bl', 'tb3JMkuWId', 'QN2JC1DHVQ', 'BjgJOdbpOO', 'HmWJvhHGCs'
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, xStgtr3yXQJT4CDMsH.csHigh entropy of concatenated method names: 'elGvJttSBZ', 'KhBvVqOvyY', 'IOhvP5jlGT', 'BwPvLQjLer', 'uZcvOy0kTu', 'LbWv12l2h6', 'Next', 'Next', 'Next', 'NextBytes'
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, NnE4Gv1rLj40w0G79X.csHigh entropy of concatenated method names: 'Js4EZ1w4LI', 'l2YEKfoipI', 'TYEEo1kAAV', 'kivEJCDfj9', 'O86EVpsHrD', 'CTHEPTMDwy', 'rMXELSoXmO', 'Ol7E1smo4k', 'IllEhG4MKV', 'GfoE01NUv5'
          Source: 0.2.3P5I851G78.exe.76d0000.1.raw.unpack, LGtpewlphXFsD4Z1bYS.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'B8KvjIgeHY', 'QScvYpxFUO', 'THMvUFlf4F', 'NxDvbnsUl8', 'vw7v6q7Qtq', 'coJvx4DEUV', 'hsYvfIj8k7'

          Hooking and other Techniques for Hiding and Protection

          barindex
          Loading BitLocker PowerShell Module
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

          Malware Analysis System Evasion

          barindex
          Yara detected AntiVM3
          Source: Yara matchFile source: Process Memory Space: 3P5I851G78.exe PID: 6716, type: MEMORYSTR
          Switches to a custom stack to bypass stack traces
          Source: C:\Users\user\Desktop\3P5I851G78.exeAPI/Special instruction interceptor: Address: 7FF9B762D324
          Source: C:\Users\user\Desktop\3P5I851G78.exeAPI/Special instruction interceptor: Address: 7FF9B7630774
          Source: C:\Users\user\Desktop\3P5I851G78.exeAPI/Special instruction interceptor: Address: 7FF9B7630154
          Source: C:\Users\user\Desktop\3P5I851G78.exeAPI/Special instruction interceptor: Address: 7FF9B762D8A4
          Source: C:\Users\user\Desktop\3P5I851G78.exeAPI/Special instruction interceptor: Address: 7FF9B762DA44
          Source: C:\Users\user\Desktop\3P5I851G78.exeAPI/Special instruction interceptor: Address: 7FF9B762D1E4
          Tries to detect virtualization through RDTSC time measurements
          Source: C:\Users\user\Desktop\3P5I851G78.exeRDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\3P5I851G78.exeRDTSC instruction interceptor: First address: 409B7E second address: 409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 489904 second address: 48990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\rundll32.exeRDTSC instruction interceptor: First address: 489B7E second address: 489B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\3P5I851G78.exeMemory allocated: 18E0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeMemory allocated: 30D0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeMemory allocated: 50D0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeMemory allocated: 9260000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeMemory allocated: A260000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeMemory allocated: A460000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeMemory allocated: B460000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_00409AB0 rdtsc 3_2_00409AB0
          Source: C:\Users\user\Desktop\3P5I851G78.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5545Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4056Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 2382Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 7561Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 872Jump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeWindow / User API: threadDelayed 993Jump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeWindow / User API: threadDelayed 8978Jump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeAPI coverage: 1.7 %
          Source: C:\Windows\SysWOW64\rundll32.exeAPI coverage: 2.0 %
          Source: C:\Users\user\Desktop\3P5I851G78.exe TID: 6712Thread sleep time: -922337203685477s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6844Thread sleep time: -5534023222112862s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exe TID: 6732Thread sleep count: 2382 > 30Jump to behavior
          Source: C:\Windows\explorer.exe TID: 6732Thread sleep time: -4764000s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exe TID: 6732Thread sleep count: 7561 > 30Jump to behavior
          Source: C:\Windows\explorer.exe TID: 6732Thread sleep time: -15122000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exe TID: 5572Thread sleep count: 993 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exe TID: 5572Thread sleep time: -1986000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exe TID: 5572Thread sleep count: 8978 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exe TID: 5572Thread sleep time: -17956000s >= -30000sJump to behavior
          Source: C:\Windows\System32\svchost.exe TID: 984Thread sleep time: -30000s >= -30000sJump to behavior
          Source: C:\Windows\System32\svchost.exe TID: 984Thread sleep time: -30000s >= -30000sJump to behavior
          Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\rundll32.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\3P5I851G78.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: explorer.exe, 00000005.00000003.1782300507.00000000098F3000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: 11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}CA
          Source: explorer.exe, 00000005.00000003.3076967277.00000000031BD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000bb'
          Source: explorer.exe, 00000005.00000003.1775490955.00000000097CB000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
          Source: explorer.exe, 00000005.00000003.3081125823.000000000984F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
          Source: 3P5I851G78.exe, 00000000.00000002.837827845.000000000140A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000005.00000000.853262365.0000000000BD9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000_
          Source: explorer.exe, 00000005.00000003.1779102746.0000000009741000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00_
          Source: explorer.exe, 00000005.00000000.853262365.0000000000BA0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bProd_VMware_SATA
          Source: explorer.exe, 00000005.00000003.1775490955.00000000097CB000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTVMWare
          Source: explorer.exe, 00000005.00000000.862222610.00000000095B2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3305943202.00000000095B2000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWt mouse
          Source: explorer.exe, 00000005.00000000.854752204.00000000031A0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM00000001
          Source: 3P5I851G78.exe, 00000000.00000002.837827845.000000000140A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
          Source: explorer.exe, 00000005.00000002.3305943202.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.862222610.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3305943202.0000000009741000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.862222610.0000000009741000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.1779102746.0000000009741000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2866049001.000002C69025B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2865414385.000002C68AC2B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: explorer.exe, 00000005.00000003.3081125823.000000000984F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
          Source: explorer.exe, 00000005.00000000.854752204.00000000031A0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM
          Source: explorer.exe, 00000005.00000000.853262365.0000000000BD9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Ji
          Source: explorer.exe, 00000005.00000000.853262365.0000000000BD9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000o
          Source: explorer.exe, 00000005.00000003.1775490955.00000000097CB000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000005.00000000.857830401.0000000007386000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPortJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_00409AB0 rdtsc 3_2_00409AB0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0040ACF0 LdrLoadDll,3_2_0040ACF0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_005425B2 GetCurrentThreadId,IsDebuggerPresent,OutputDebugStringW,7_2_005425B2
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01464144 mov eax, dword ptr fs:[00000030h]3_2_01464144
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01464144 mov eax, dword ptr fs:[00000030h]3_2_01464144
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01464144 mov ecx, dword ptr fs:[00000030h]3_2_01464144
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01464144 mov eax, dword ptr fs:[00000030h]3_2_01464144
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01464144 mov eax, dword ptr fs:[00000030h]3_2_01464144
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01468158 mov eax, dword ptr fs:[00000030h]3_2_01468158
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147E10E mov eax, dword ptr fs:[00000030h]3_2_0147E10E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147E10E mov ecx, dword ptr fs:[00000030h]3_2_0147E10E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147E10E mov eax, dword ptr fs:[00000030h]3_2_0147E10E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147E10E mov eax, dword ptr fs:[00000030h]3_2_0147E10E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147E10E mov ecx, dword ptr fs:[00000030h]3_2_0147E10E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147E10E mov eax, dword ptr fs:[00000030h]3_2_0147E10E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147E10E mov eax, dword ptr fs:[00000030h]3_2_0147E10E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147E10E mov ecx, dword ptr fs:[00000030h]3_2_0147E10E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147E10E mov eax, dword ptr fs:[00000030h]3_2_0147E10E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147E10E mov ecx, dword ptr fs:[00000030h]3_2_0147E10E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01490115 mov eax, dword ptr fs:[00000030h]3_2_01490115
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147A118 mov ecx, dword ptr fs:[00000030h]3_2_0147A118
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147A118 mov eax, dword ptr fs:[00000030h]3_2_0147A118
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147A118 mov eax, dword ptr fs:[00000030h]3_2_0147A118
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147A118 mov eax, dword ptr fs:[00000030h]3_2_0147A118
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01400124 mov eax, dword ptr fs:[00000030h]3_2_01400124
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D6154 mov eax, dword ptr fs:[00000030h]3_2_013D6154
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D6154 mov eax, dword ptr fs:[00000030h]3_2_013D6154
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013CC156 mov eax, dword ptr fs:[00000030h]3_2_013CC156
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014961C3 mov eax, dword ptr fs:[00000030h]3_2_014961C3
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014961C3 mov eax, dword ptr fs:[00000030h]3_2_014961C3
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144E1D0 mov eax, dword ptr fs:[00000030h]3_2_0144E1D0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144E1D0 mov eax, dword ptr fs:[00000030h]3_2_0144E1D0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144E1D0 mov ecx, dword ptr fs:[00000030h]3_2_0144E1D0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144E1D0 mov eax, dword ptr fs:[00000030h]3_2_0144E1D0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144E1D0 mov eax, dword ptr fs:[00000030h]3_2_0144E1D0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013CA197 mov eax, dword ptr fs:[00000030h]3_2_013CA197
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013CA197 mov eax, dword ptr fs:[00000030h]3_2_013CA197
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013CA197 mov eax, dword ptr fs:[00000030h]3_2_013CA197
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014A61E5 mov eax, dword ptr fs:[00000030h]3_2_014A61E5
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014001F8 mov eax, dword ptr fs:[00000030h]3_2_014001F8
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0148C188 mov eax, dword ptr fs:[00000030h]3_2_0148C188
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0148C188 mov eax, dword ptr fs:[00000030h]3_2_0148C188
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01410185 mov eax, dword ptr fs:[00000030h]3_2_01410185
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01474180 mov eax, dword ptr fs:[00000030h]3_2_01474180
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01474180 mov eax, dword ptr fs:[00000030h]3_2_01474180
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145019F mov eax, dword ptr fs:[00000030h]3_2_0145019F
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145019F mov eax, dword ptr fs:[00000030h]3_2_0145019F
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145019F mov eax, dword ptr fs:[00000030h]3_2_0145019F
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145019F mov eax, dword ptr fs:[00000030h]3_2_0145019F
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01456050 mov eax, dword ptr fs:[00000030h]3_2_01456050
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013CA020 mov eax, dword ptr fs:[00000030h]3_2_013CA020
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013CC020 mov eax, dword ptr fs:[00000030h]3_2_013CC020
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013EE016 mov eax, dword ptr fs:[00000030h]3_2_013EE016
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013EE016 mov eax, dword ptr fs:[00000030h]3_2_013EE016
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013EE016 mov eax, dword ptr fs:[00000030h]3_2_013EE016
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013EE016 mov eax, dword ptr fs:[00000030h]3_2_013EE016
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01454000 mov ecx, dword ptr fs:[00000030h]3_2_01454000
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01472000 mov eax, dword ptr fs:[00000030h]3_2_01472000
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01472000 mov eax, dword ptr fs:[00000030h]3_2_01472000
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01472000 mov eax, dword ptr fs:[00000030h]3_2_01472000
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01472000 mov eax, dword ptr fs:[00000030h]3_2_01472000
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01472000 mov eax, dword ptr fs:[00000030h]3_2_01472000
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01472000 mov eax, dword ptr fs:[00000030h]3_2_01472000
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01472000 mov eax, dword ptr fs:[00000030h]3_2_01472000
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01472000 mov eax, dword ptr fs:[00000030h]3_2_01472000
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FC073 mov eax, dword ptr fs:[00000030h]3_2_013FC073
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D2050 mov eax, dword ptr fs:[00000030h]3_2_013D2050
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01466030 mov eax, dword ptr fs:[00000030h]3_2_01466030
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014520DE mov eax, dword ptr fs:[00000030h]3_2_014520DE
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014560E0 mov eax, dword ptr fs:[00000030h]3_2_014560E0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014120F0 mov ecx, dword ptr fs:[00000030h]3_2_014120F0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D208A mov eax, dword ptr fs:[00000030h]3_2_013D208A
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013CC0F0 mov eax, dword ptr fs:[00000030h]3_2_013CC0F0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D80E9 mov eax, dword ptr fs:[00000030h]3_2_013D80E9
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013CA0E3 mov ecx, dword ptr fs:[00000030h]3_2_013CA0E3
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014680A8 mov eax, dword ptr fs:[00000030h]3_2_014680A8
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014960B8 mov eax, dword ptr fs:[00000030h]3_2_014960B8
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014960B8 mov ecx, dword ptr fs:[00000030h]3_2_014960B8
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01452349 mov eax, dword ptr fs:[00000030h]3_2_01452349
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01452349 mov eax, dword ptr fs:[00000030h]3_2_01452349
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01452349 mov eax, dword ptr fs:[00000030h]3_2_01452349
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01452349 mov eax, dword ptr fs:[00000030h]3_2_01452349
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01452349 mov eax, dword ptr fs:[00000030h]3_2_01452349
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01452349 mov eax, dword ptr fs:[00000030h]3_2_01452349
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01452349 mov eax, dword ptr fs:[00000030h]3_2_01452349
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01452349 mov eax, dword ptr fs:[00000030h]3_2_01452349
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01452349 mov eax, dword ptr fs:[00000030h]3_2_01452349
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01452349 mov eax, dword ptr fs:[00000030h]3_2_01452349
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01452349 mov eax, dword ptr fs:[00000030h]3_2_01452349
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01452349 mov eax, dword ptr fs:[00000030h]3_2_01452349
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01452349 mov eax, dword ptr fs:[00000030h]3_2_01452349
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01452349 mov eax, dword ptr fs:[00000030h]3_2_01452349
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01452349 mov eax, dword ptr fs:[00000030h]3_2_01452349
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01478350 mov ecx, dword ptr fs:[00000030h]3_2_01478350
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145035C mov eax, dword ptr fs:[00000030h]3_2_0145035C
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145035C mov eax, dword ptr fs:[00000030h]3_2_0145035C
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145035C mov eax, dword ptr fs:[00000030h]3_2_0145035C
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145035C mov ecx, dword ptr fs:[00000030h]3_2_0145035C
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145035C mov eax, dword ptr fs:[00000030h]3_2_0145035C
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145035C mov eax, dword ptr fs:[00000030h]3_2_0145035C
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0149A352 mov eax, dword ptr fs:[00000030h]3_2_0149A352
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013CC310 mov ecx, dword ptr fs:[00000030h]3_2_013CC310
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F0310 mov ecx, dword ptr fs:[00000030h]3_2_013F0310
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147437C mov eax, dword ptr fs:[00000030h]3_2_0147437C
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140A30B mov eax, dword ptr fs:[00000030h]3_2_0140A30B
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140A30B mov eax, dword ptr fs:[00000030h]3_2_0140A30B
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140A30B mov eax, dword ptr fs:[00000030h]3_2_0140A30B
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0148C3CD mov eax, dword ptr fs:[00000030h]3_2_0148C3CD
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014563C0 mov eax, dword ptr fs:[00000030h]3_2_014563C0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014743D4 mov eax, dword ptr fs:[00000030h]3_2_014743D4
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014743D4 mov eax, dword ptr fs:[00000030h]3_2_014743D4
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147E3DB mov eax, dword ptr fs:[00000030h]3_2_0147E3DB
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147E3DB mov eax, dword ptr fs:[00000030h]3_2_0147E3DB
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147E3DB mov ecx, dword ptr fs:[00000030h]3_2_0147E3DB
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147E3DB mov eax, dword ptr fs:[00000030h]3_2_0147E3DB
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013C8397 mov eax, dword ptr fs:[00000030h]3_2_013C8397
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013C8397 mov eax, dword ptr fs:[00000030h]3_2_013C8397
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013C8397 mov eax, dword ptr fs:[00000030h]3_2_013C8397
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F438F mov eax, dword ptr fs:[00000030h]3_2_013F438F
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F438F mov eax, dword ptr fs:[00000030h]3_2_013F438F
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013CE388 mov eax, dword ptr fs:[00000030h]3_2_013CE388
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013CE388 mov eax, dword ptr fs:[00000030h]3_2_013CE388
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013CE388 mov eax, dword ptr fs:[00000030h]3_2_013CE388
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014063FF mov eax, dword ptr fs:[00000030h]3_2_014063FF
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013EE3F0 mov eax, dword ptr fs:[00000030h]3_2_013EE3F0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013EE3F0 mov eax, dword ptr fs:[00000030h]3_2_013EE3F0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013EE3F0 mov eax, dword ptr fs:[00000030h]3_2_013EE3F0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E03E9 mov eax, dword ptr fs:[00000030h]3_2_013E03E9
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E03E9 mov eax, dword ptr fs:[00000030h]3_2_013E03E9
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E03E9 mov eax, dword ptr fs:[00000030h]3_2_013E03E9
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E03E9 mov eax, dword ptr fs:[00000030h]3_2_013E03E9
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E03E9 mov eax, dword ptr fs:[00000030h]3_2_013E03E9
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E03E9 mov eax, dword ptr fs:[00000030h]3_2_013E03E9
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E03E9 mov eax, dword ptr fs:[00000030h]3_2_013E03E9
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E03E9 mov eax, dword ptr fs:[00000030h]3_2_013E03E9
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DA3C0 mov eax, dword ptr fs:[00000030h]3_2_013DA3C0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DA3C0 mov eax, dword ptr fs:[00000030h]3_2_013DA3C0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DA3C0 mov eax, dword ptr fs:[00000030h]3_2_013DA3C0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DA3C0 mov eax, dword ptr fs:[00000030h]3_2_013DA3C0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DA3C0 mov eax, dword ptr fs:[00000030h]3_2_013DA3C0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DA3C0 mov eax, dword ptr fs:[00000030h]3_2_013DA3C0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D83C0 mov eax, dword ptr fs:[00000030h]3_2_013D83C0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D83C0 mov eax, dword ptr fs:[00000030h]3_2_013D83C0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D83C0 mov eax, dword ptr fs:[00000030h]3_2_013D83C0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D83C0 mov eax, dword ptr fs:[00000030h]3_2_013D83C0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01458243 mov eax, dword ptr fs:[00000030h]3_2_01458243
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01458243 mov ecx, dword ptr fs:[00000030h]3_2_01458243
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013C823B mov eax, dword ptr fs:[00000030h]3_2_013C823B
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0148A250 mov eax, dword ptr fs:[00000030h]3_2_0148A250
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0148A250 mov eax, dword ptr fs:[00000030h]3_2_0148A250
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01480274 mov eax, dword ptr fs:[00000030h]3_2_01480274
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01480274 mov eax, dword ptr fs:[00000030h]3_2_01480274
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01480274 mov eax, dword ptr fs:[00000030h]3_2_01480274
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01480274 mov eax, dword ptr fs:[00000030h]3_2_01480274
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01480274 mov eax, dword ptr fs:[00000030h]3_2_01480274
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01480274 mov eax, dword ptr fs:[00000030h]3_2_01480274
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01480274 mov eax, dword ptr fs:[00000030h]3_2_01480274
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01480274 mov eax, dword ptr fs:[00000030h]3_2_01480274
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01480274 mov eax, dword ptr fs:[00000030h]3_2_01480274
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01480274 mov eax, dword ptr fs:[00000030h]3_2_01480274
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01480274 mov eax, dword ptr fs:[00000030h]3_2_01480274
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01480274 mov eax, dword ptr fs:[00000030h]3_2_01480274
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013C826B mov eax, dword ptr fs:[00000030h]3_2_013C826B
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D4260 mov eax, dword ptr fs:[00000030h]3_2_013D4260
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D4260 mov eax, dword ptr fs:[00000030h]3_2_013D4260
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D4260 mov eax, dword ptr fs:[00000030h]3_2_013D4260
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D6259 mov eax, dword ptr fs:[00000030h]3_2_013D6259
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013CA250 mov eax, dword ptr fs:[00000030h]3_2_013CA250
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E02A0 mov eax, dword ptr fs:[00000030h]3_2_013E02A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E02A0 mov eax, dword ptr fs:[00000030h]3_2_013E02A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140E284 mov eax, dword ptr fs:[00000030h]3_2_0140E284
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140E284 mov eax, dword ptr fs:[00000030h]3_2_0140E284
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01450283 mov eax, dword ptr fs:[00000030h]3_2_01450283
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01450283 mov eax, dword ptr fs:[00000030h]3_2_01450283
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01450283 mov eax, dword ptr fs:[00000030h]3_2_01450283
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E02E1 mov eax, dword ptr fs:[00000030h]3_2_013E02E1
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E02E1 mov eax, dword ptr fs:[00000030h]3_2_013E02E1
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E02E1 mov eax, dword ptr fs:[00000030h]3_2_013E02E1
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014662A0 mov eax, dword ptr fs:[00000030h]3_2_014662A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014662A0 mov ecx, dword ptr fs:[00000030h]3_2_014662A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014662A0 mov eax, dword ptr fs:[00000030h]3_2_014662A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014662A0 mov eax, dword ptr fs:[00000030h]3_2_014662A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014662A0 mov eax, dword ptr fs:[00000030h]3_2_014662A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014662A0 mov eax, dword ptr fs:[00000030h]3_2_014662A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DA2C3 mov eax, dword ptr fs:[00000030h]3_2_013DA2C3
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DA2C3 mov eax, dword ptr fs:[00000030h]3_2_013DA2C3
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DA2C3 mov eax, dword ptr fs:[00000030h]3_2_013DA2C3
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DA2C3 mov eax, dword ptr fs:[00000030h]3_2_013DA2C3
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DA2C3 mov eax, dword ptr fs:[00000030h]3_2_013DA2C3
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FE53E mov eax, dword ptr fs:[00000030h]3_2_013FE53E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FE53E mov eax, dword ptr fs:[00000030h]3_2_013FE53E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FE53E mov eax, dword ptr fs:[00000030h]3_2_013FE53E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FE53E mov eax, dword ptr fs:[00000030h]3_2_013FE53E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FE53E mov eax, dword ptr fs:[00000030h]3_2_013FE53E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0535 mov eax, dword ptr fs:[00000030h]3_2_013E0535
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0535 mov eax, dword ptr fs:[00000030h]3_2_013E0535
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0535 mov eax, dword ptr fs:[00000030h]3_2_013E0535
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0535 mov eax, dword ptr fs:[00000030h]3_2_013E0535
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0535 mov eax, dword ptr fs:[00000030h]3_2_013E0535
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0535 mov eax, dword ptr fs:[00000030h]3_2_013E0535
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140656A mov eax, dword ptr fs:[00000030h]3_2_0140656A
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140656A mov eax, dword ptr fs:[00000030h]3_2_0140656A
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140656A mov eax, dword ptr fs:[00000030h]3_2_0140656A
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01466500 mov eax, dword ptr fs:[00000030h]3_2_01466500
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014A4500 mov eax, dword ptr fs:[00000030h]3_2_014A4500
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014A4500 mov eax, dword ptr fs:[00000030h]3_2_014A4500
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014A4500 mov eax, dword ptr fs:[00000030h]3_2_014A4500
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014A4500 mov eax, dword ptr fs:[00000030h]3_2_014A4500
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014A4500 mov eax, dword ptr fs:[00000030h]3_2_014A4500
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014A4500 mov eax, dword ptr fs:[00000030h]3_2_014A4500
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014A4500 mov eax, dword ptr fs:[00000030h]3_2_014A4500
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D8550 mov eax, dword ptr fs:[00000030h]3_2_013D8550
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D8550 mov eax, dword ptr fs:[00000030h]3_2_013D8550
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F45B1 mov eax, dword ptr fs:[00000030h]3_2_013F45B1
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F45B1 mov eax, dword ptr fs:[00000030h]3_2_013F45B1
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140E5CF mov eax, dword ptr fs:[00000030h]3_2_0140E5CF
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140E5CF mov eax, dword ptr fs:[00000030h]3_2_0140E5CF
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140A5D0 mov eax, dword ptr fs:[00000030h]3_2_0140A5D0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140A5D0 mov eax, dword ptr fs:[00000030h]3_2_0140A5D0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140C5ED mov eax, dword ptr fs:[00000030h]3_2_0140C5ED
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140C5ED mov eax, dword ptr fs:[00000030h]3_2_0140C5ED
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D2582 mov eax, dword ptr fs:[00000030h]3_2_013D2582
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D2582 mov ecx, dword ptr fs:[00000030h]3_2_013D2582
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01404588 mov eax, dword ptr fs:[00000030h]3_2_01404588
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FE5E7 mov eax, dword ptr fs:[00000030h]3_2_013FE5E7
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FE5E7 mov eax, dword ptr fs:[00000030h]3_2_013FE5E7
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FE5E7 mov eax, dword ptr fs:[00000030h]3_2_013FE5E7
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FE5E7 mov eax, dword ptr fs:[00000030h]3_2_013FE5E7
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FE5E7 mov eax, dword ptr fs:[00000030h]3_2_013FE5E7
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FE5E7 mov eax, dword ptr fs:[00000030h]3_2_013FE5E7
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FE5E7 mov eax, dword ptr fs:[00000030h]3_2_013FE5E7
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FE5E7 mov eax, dword ptr fs:[00000030h]3_2_013FE5E7
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140E59C mov eax, dword ptr fs:[00000030h]3_2_0140E59C
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D25E0 mov eax, dword ptr fs:[00000030h]3_2_013D25E0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014505A7 mov eax, dword ptr fs:[00000030h]3_2_014505A7
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014505A7 mov eax, dword ptr fs:[00000030h]3_2_014505A7
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014505A7 mov eax, dword ptr fs:[00000030h]3_2_014505A7
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D65D0 mov eax, dword ptr fs:[00000030h]3_2_013D65D0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140E443 mov eax, dword ptr fs:[00000030h]3_2_0140E443
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140E443 mov eax, dword ptr fs:[00000030h]3_2_0140E443
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140E443 mov eax, dword ptr fs:[00000030h]3_2_0140E443
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140E443 mov eax, dword ptr fs:[00000030h]3_2_0140E443
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140E443 mov eax, dword ptr fs:[00000030h]3_2_0140E443
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140E443 mov eax, dword ptr fs:[00000030h]3_2_0140E443
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140E443 mov eax, dword ptr fs:[00000030h]3_2_0140E443
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140E443 mov eax, dword ptr fs:[00000030h]3_2_0140E443
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013CC427 mov eax, dword ptr fs:[00000030h]3_2_013CC427
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013CE420 mov eax, dword ptr fs:[00000030h]3_2_013CE420
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013CE420 mov eax, dword ptr fs:[00000030h]3_2_013CE420
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013CE420 mov eax, dword ptr fs:[00000030h]3_2_013CE420
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0148A456 mov eax, dword ptr fs:[00000030h]3_2_0148A456
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145C460 mov ecx, dword ptr fs:[00000030h]3_2_0145C460
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01408402 mov eax, dword ptr fs:[00000030h]3_2_01408402
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01408402 mov eax, dword ptr fs:[00000030h]3_2_01408402
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01408402 mov eax, dword ptr fs:[00000030h]3_2_01408402
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FA470 mov eax, dword ptr fs:[00000030h]3_2_013FA470
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FA470 mov eax, dword ptr fs:[00000030h]3_2_013FA470
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FA470 mov eax, dword ptr fs:[00000030h]3_2_013FA470
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013C645D mov eax, dword ptr fs:[00000030h]3_2_013C645D
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F245A mov eax, dword ptr fs:[00000030h]3_2_013F245A
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01456420 mov eax, dword ptr fs:[00000030h]3_2_01456420
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01456420 mov eax, dword ptr fs:[00000030h]3_2_01456420
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01456420 mov eax, dword ptr fs:[00000030h]3_2_01456420
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01456420 mov eax, dword ptr fs:[00000030h]3_2_01456420
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01456420 mov eax, dword ptr fs:[00000030h]3_2_01456420
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01456420 mov eax, dword ptr fs:[00000030h]3_2_01456420
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01456420 mov eax, dword ptr fs:[00000030h]3_2_01456420
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140A430 mov eax, dword ptr fs:[00000030h]3_2_0140A430
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D64AB mov eax, dword ptr fs:[00000030h]3_2_013D64AB
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0148A49A mov eax, dword ptr fs:[00000030h]3_2_0148A49A
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D04E5 mov ecx, dword ptr fs:[00000030h]3_2_013D04E5
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014044B0 mov ecx, dword ptr fs:[00000030h]3_2_014044B0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145A4B0 mov eax, dword ptr fs:[00000030h]3_2_0145A4B0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140674D mov esi, dword ptr fs:[00000030h]3_2_0140674D
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140674D mov eax, dword ptr fs:[00000030h]3_2_0140674D
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140674D mov eax, dword ptr fs:[00000030h]3_2_0140674D
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01454755 mov eax, dword ptr fs:[00000030h]3_2_01454755
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412750 mov eax, dword ptr fs:[00000030h]3_2_01412750
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412750 mov eax, dword ptr fs:[00000030h]3_2_01412750
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145E75D mov eax, dword ptr fs:[00000030h]3_2_0145E75D
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D0710 mov eax, dword ptr fs:[00000030h]3_2_013D0710
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140C700 mov eax, dword ptr fs:[00000030h]3_2_0140C700
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D8770 mov eax, dword ptr fs:[00000030h]3_2_013D8770
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0770 mov eax, dword ptr fs:[00000030h]3_2_013E0770
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0770 mov eax, dword ptr fs:[00000030h]3_2_013E0770
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0770 mov eax, dword ptr fs:[00000030h]3_2_013E0770
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0770 mov eax, dword ptr fs:[00000030h]3_2_013E0770
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0770 mov eax, dword ptr fs:[00000030h]3_2_013E0770
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0770 mov eax, dword ptr fs:[00000030h]3_2_013E0770
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0770 mov eax, dword ptr fs:[00000030h]3_2_013E0770
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0770 mov eax, dword ptr fs:[00000030h]3_2_013E0770
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0770 mov eax, dword ptr fs:[00000030h]3_2_013E0770
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0770 mov eax, dword ptr fs:[00000030h]3_2_013E0770
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0770 mov eax, dword ptr fs:[00000030h]3_2_013E0770
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0770 mov eax, dword ptr fs:[00000030h]3_2_013E0770
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01400710 mov eax, dword ptr fs:[00000030h]3_2_01400710
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140C720 mov eax, dword ptr fs:[00000030h]3_2_0140C720
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140C720 mov eax, dword ptr fs:[00000030h]3_2_0140C720
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D0750 mov eax, dword ptr fs:[00000030h]3_2_013D0750
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144C730 mov eax, dword ptr fs:[00000030h]3_2_0144C730
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140273C mov eax, dword ptr fs:[00000030h]3_2_0140273C
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140273C mov ecx, dword ptr fs:[00000030h]3_2_0140273C
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140273C mov eax, dword ptr fs:[00000030h]3_2_0140273C
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014507C3 mov eax, dword ptr fs:[00000030h]3_2_014507C3
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D07AF mov eax, dword ptr fs:[00000030h]3_2_013D07AF
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145E7E1 mov eax, dword ptr fs:[00000030h]3_2_0145E7E1
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D47FB mov eax, dword ptr fs:[00000030h]3_2_013D47FB
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D47FB mov eax, dword ptr fs:[00000030h]3_2_013D47FB
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147678E mov eax, dword ptr fs:[00000030h]3_2_0147678E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F27ED mov eax, dword ptr fs:[00000030h]3_2_013F27ED
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F27ED mov eax, dword ptr fs:[00000030h]3_2_013F27ED
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F27ED mov eax, dword ptr fs:[00000030h]3_2_013F27ED
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014847A0 mov eax, dword ptr fs:[00000030h]3_2_014847A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DC7C0 mov eax, dword ptr fs:[00000030h]3_2_013DC7C0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D262C mov eax, dword ptr fs:[00000030h]3_2_013D262C
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013EE627 mov eax, dword ptr fs:[00000030h]3_2_013EE627
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140A660 mov eax, dword ptr fs:[00000030h]3_2_0140A660
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140A660 mov eax, dword ptr fs:[00000030h]3_2_0140A660
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0149866E mov eax, dword ptr fs:[00000030h]3_2_0149866E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0149866E mov eax, dword ptr fs:[00000030h]3_2_0149866E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01402674 mov eax, dword ptr fs:[00000030h]3_2_01402674
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E260B mov eax, dword ptr fs:[00000030h]3_2_013E260B
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E260B mov eax, dword ptr fs:[00000030h]3_2_013E260B
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E260B mov eax, dword ptr fs:[00000030h]3_2_013E260B
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E260B mov eax, dword ptr fs:[00000030h]3_2_013E260B
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E260B mov eax, dword ptr fs:[00000030h]3_2_013E260B
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E260B mov eax, dword ptr fs:[00000030h]3_2_013E260B
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E260B mov eax, dword ptr fs:[00000030h]3_2_013E260B
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144E609 mov eax, dword ptr fs:[00000030h]3_2_0144E609
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01412619 mov eax, dword ptr fs:[00000030h]3_2_01412619
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01406620 mov eax, dword ptr fs:[00000030h]3_2_01406620
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01408620 mov eax, dword ptr fs:[00000030h]3_2_01408620
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013EC640 mov eax, dword ptr fs:[00000030h]3_2_013EC640
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140A6C7 mov ebx, dword ptr fs:[00000030h]3_2_0140A6C7
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140A6C7 mov eax, dword ptr fs:[00000030h]3_2_0140A6C7
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D4690 mov eax, dword ptr fs:[00000030h]3_2_013D4690
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D4690 mov eax, dword ptr fs:[00000030h]3_2_013D4690
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014506F1 mov eax, dword ptr fs:[00000030h]3_2_014506F1
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014506F1 mov eax, dword ptr fs:[00000030h]3_2_014506F1
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144E6F2 mov eax, dword ptr fs:[00000030h]3_2_0144E6F2
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144E6F2 mov eax, dword ptr fs:[00000030h]3_2_0144E6F2
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144E6F2 mov eax, dword ptr fs:[00000030h]3_2_0144E6F2
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144E6F2 mov eax, dword ptr fs:[00000030h]3_2_0144E6F2
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140C6A6 mov eax, dword ptr fs:[00000030h]3_2_0140C6A6
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014066B0 mov eax, dword ptr fs:[00000030h]3_2_014066B0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01450946 mov eax, dword ptr fs:[00000030h]3_2_01450946
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013C8918 mov eax, dword ptr fs:[00000030h]3_2_013C8918
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013C8918 mov eax, dword ptr fs:[00000030h]3_2_013C8918
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0141096E mov eax, dword ptr fs:[00000030h]3_2_0141096E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0141096E mov edx, dword ptr fs:[00000030h]3_2_0141096E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0141096E mov eax, dword ptr fs:[00000030h]3_2_0141096E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145C97C mov eax, dword ptr fs:[00000030h]3_2_0145C97C
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01474978 mov eax, dword ptr fs:[00000030h]3_2_01474978
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01474978 mov eax, dword ptr fs:[00000030h]3_2_01474978
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144E908 mov eax, dword ptr fs:[00000030h]3_2_0144E908
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144E908 mov eax, dword ptr fs:[00000030h]3_2_0144E908
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145C912 mov eax, dword ptr fs:[00000030h]3_2_0145C912
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F6962 mov eax, dword ptr fs:[00000030h]3_2_013F6962
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F6962 mov eax, dword ptr fs:[00000030h]3_2_013F6962
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F6962 mov eax, dword ptr fs:[00000030h]3_2_013F6962
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0146892B mov eax, dword ptr fs:[00000030h]3_2_0146892B
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145892A mov eax, dword ptr fs:[00000030h]3_2_0145892A
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014669C0 mov eax, dword ptr fs:[00000030h]3_2_014669C0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D09AD mov eax, dword ptr fs:[00000030h]3_2_013D09AD
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D09AD mov eax, dword ptr fs:[00000030h]3_2_013D09AD
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014049D0 mov eax, dword ptr fs:[00000030h]3_2_014049D0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0149A9D3 mov eax, dword ptr fs:[00000030h]3_2_0149A9D3
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E29A0 mov eax, dword ptr fs:[00000030h]3_2_013E29A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E29A0 mov eax, dword ptr fs:[00000030h]3_2_013E29A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E29A0 mov eax, dword ptr fs:[00000030h]3_2_013E29A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E29A0 mov eax, dword ptr fs:[00000030h]3_2_013E29A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E29A0 mov eax, dword ptr fs:[00000030h]3_2_013E29A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E29A0 mov eax, dword ptr fs:[00000030h]3_2_013E29A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E29A0 mov eax, dword ptr fs:[00000030h]3_2_013E29A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E29A0 mov eax, dword ptr fs:[00000030h]3_2_013E29A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E29A0 mov eax, dword ptr fs:[00000030h]3_2_013E29A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E29A0 mov eax, dword ptr fs:[00000030h]3_2_013E29A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E29A0 mov eax, dword ptr fs:[00000030h]3_2_013E29A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E29A0 mov eax, dword ptr fs:[00000030h]3_2_013E29A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E29A0 mov eax, dword ptr fs:[00000030h]3_2_013E29A0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145E9E0 mov eax, dword ptr fs:[00000030h]3_2_0145E9E0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014029F9 mov eax, dword ptr fs:[00000030h]3_2_014029F9
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014029F9 mov eax, dword ptr fs:[00000030h]3_2_014029F9
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DA9D0 mov eax, dword ptr fs:[00000030h]3_2_013DA9D0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DA9D0 mov eax, dword ptr fs:[00000030h]3_2_013DA9D0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DA9D0 mov eax, dword ptr fs:[00000030h]3_2_013DA9D0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DA9D0 mov eax, dword ptr fs:[00000030h]3_2_013DA9D0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DA9D0 mov eax, dword ptr fs:[00000030h]3_2_013DA9D0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DA9D0 mov eax, dword ptr fs:[00000030h]3_2_013DA9D0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014589B3 mov esi, dword ptr fs:[00000030h]3_2_014589B3
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014589B3 mov eax, dword ptr fs:[00000030h]3_2_014589B3
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014589B3 mov eax, dword ptr fs:[00000030h]3_2_014589B3
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F2835 mov eax, dword ptr fs:[00000030h]3_2_013F2835
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F2835 mov eax, dword ptr fs:[00000030h]3_2_013F2835
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F2835 mov eax, dword ptr fs:[00000030h]3_2_013F2835
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F2835 mov ecx, dword ptr fs:[00000030h]3_2_013F2835
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F2835 mov eax, dword ptr fs:[00000030h]3_2_013F2835
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F2835 mov eax, dword ptr fs:[00000030h]3_2_013F2835
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01400854 mov eax, dword ptr fs:[00000030h]3_2_01400854
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01466870 mov eax, dword ptr fs:[00000030h]3_2_01466870
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01466870 mov eax, dword ptr fs:[00000030h]3_2_01466870
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145E872 mov eax, dword ptr fs:[00000030h]3_2_0145E872
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145E872 mov eax, dword ptr fs:[00000030h]3_2_0145E872
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145C810 mov eax, dword ptr fs:[00000030h]3_2_0145C810
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D4859 mov eax, dword ptr fs:[00000030h]3_2_013D4859
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D4859 mov eax, dword ptr fs:[00000030h]3_2_013D4859
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140A830 mov eax, dword ptr fs:[00000030h]3_2_0140A830
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147483A mov eax, dword ptr fs:[00000030h]3_2_0147483A
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147483A mov eax, dword ptr fs:[00000030h]3_2_0147483A
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E2840 mov ecx, dword ptr fs:[00000030h]3_2_013E2840
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0149A8E4 mov eax, dword ptr fs:[00000030h]3_2_0149A8E4
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140C8F9 mov eax, dword ptr fs:[00000030h]3_2_0140C8F9
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140C8F9 mov eax, dword ptr fs:[00000030h]3_2_0140C8F9
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D0887 mov eax, dword ptr fs:[00000030h]3_2_013D0887
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145C89D mov eax, dword ptr fs:[00000030h]3_2_0145C89D
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FE8C0 mov eax, dword ptr fs:[00000030h]3_2_013FE8C0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01484B4B mov eax, dword ptr fs:[00000030h]3_2_01484B4B
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01484B4B mov eax, dword ptr fs:[00000030h]3_2_01484B4B
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01478B42 mov eax, dword ptr fs:[00000030h]3_2_01478B42
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01466B40 mov eax, dword ptr fs:[00000030h]3_2_01466B40
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01466B40 mov eax, dword ptr fs:[00000030h]3_2_01466B40
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0149AB40 mov eax, dword ptr fs:[00000030h]3_2_0149AB40
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147EB50 mov eax, dword ptr fs:[00000030h]3_2_0147EB50
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FEB20 mov eax, dword ptr fs:[00000030h]3_2_013FEB20
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FEB20 mov eax, dword ptr fs:[00000030h]3_2_013FEB20
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013CCB7E mov eax, dword ptr fs:[00000030h]3_2_013CCB7E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144EB1D mov eax, dword ptr fs:[00000030h]3_2_0144EB1D
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144EB1D mov eax, dword ptr fs:[00000030h]3_2_0144EB1D
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144EB1D mov eax, dword ptr fs:[00000030h]3_2_0144EB1D
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144EB1D mov eax, dword ptr fs:[00000030h]3_2_0144EB1D
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144EB1D mov eax, dword ptr fs:[00000030h]3_2_0144EB1D
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144EB1D mov eax, dword ptr fs:[00000030h]3_2_0144EB1D
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144EB1D mov eax, dword ptr fs:[00000030h]3_2_0144EB1D
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144EB1D mov eax, dword ptr fs:[00000030h]3_2_0144EB1D
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144EB1D mov eax, dword ptr fs:[00000030h]3_2_0144EB1D
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01498B28 mov eax, dword ptr fs:[00000030h]3_2_01498B28
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01498B28 mov eax, dword ptr fs:[00000030h]3_2_01498B28
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0BBE mov eax, dword ptr fs:[00000030h]3_2_013E0BBE
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0BBE mov eax, dword ptr fs:[00000030h]3_2_013E0BBE
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147EBD0 mov eax, dword ptr fs:[00000030h]3_2_0147EBD0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145CBF0 mov eax, dword ptr fs:[00000030h]3_2_0145CBF0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FEBFC mov eax, dword ptr fs:[00000030h]3_2_013FEBFC
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D8BF0 mov eax, dword ptr fs:[00000030h]3_2_013D8BF0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D8BF0 mov eax, dword ptr fs:[00000030h]3_2_013D8BF0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D8BF0 mov eax, dword ptr fs:[00000030h]3_2_013D8BF0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D0BCD mov eax, dword ptr fs:[00000030h]3_2_013D0BCD
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D0BCD mov eax, dword ptr fs:[00000030h]3_2_013D0BCD
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D0BCD mov eax, dword ptr fs:[00000030h]3_2_013D0BCD
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F0BCB mov eax, dword ptr fs:[00000030h]3_2_013F0BCB
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F0BCB mov eax, dword ptr fs:[00000030h]3_2_013F0BCB
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F0BCB mov eax, dword ptr fs:[00000030h]3_2_013F0BCB
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01484BB0 mov eax, dword ptr fs:[00000030h]3_2_01484BB0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01484BB0 mov eax, dword ptr fs:[00000030h]3_2_01484BB0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F4A35 mov eax, dword ptr fs:[00000030h]3_2_013F4A35
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013F4A35 mov eax, dword ptr fs:[00000030h]3_2_013F4A35
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013FEA2E mov eax, dword ptr fs:[00000030h]3_2_013FEA2E
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0147EA60 mov eax, dword ptr fs:[00000030h]3_2_0147EA60
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140CA6F mov eax, dword ptr fs:[00000030h]3_2_0140CA6F
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140CA6F mov eax, dword ptr fs:[00000030h]3_2_0140CA6F
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140CA6F mov eax, dword ptr fs:[00000030h]3_2_0140CA6F
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144CA72 mov eax, dword ptr fs:[00000030h]3_2_0144CA72
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0144CA72 mov eax, dword ptr fs:[00000030h]3_2_0144CA72
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0145CA11 mov eax, dword ptr fs:[00000030h]3_2_0145CA11
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140CA24 mov eax, dword ptr fs:[00000030h]3_2_0140CA24
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0A5B mov eax, dword ptr fs:[00000030h]3_2_013E0A5B
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013E0A5B mov eax, dword ptr fs:[00000030h]3_2_013E0A5B
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D6A50 mov eax, dword ptr fs:[00000030h]3_2_013D6A50
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D6A50 mov eax, dword ptr fs:[00000030h]3_2_013D6A50
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D6A50 mov eax, dword ptr fs:[00000030h]3_2_013D6A50
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D6A50 mov eax, dword ptr fs:[00000030h]3_2_013D6A50
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D6A50 mov eax, dword ptr fs:[00000030h]3_2_013D6A50
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D6A50 mov eax, dword ptr fs:[00000030h]3_2_013D6A50
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D6A50 mov eax, dword ptr fs:[00000030h]3_2_013D6A50
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140CA38 mov eax, dword ptr fs:[00000030h]3_2_0140CA38
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01426ACC mov eax, dword ptr fs:[00000030h]3_2_01426ACC
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01426ACC mov eax, dword ptr fs:[00000030h]3_2_01426ACC
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01426ACC mov eax, dword ptr fs:[00000030h]3_2_01426ACC
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01404AD0 mov eax, dword ptr fs:[00000030h]3_2_01404AD0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01404AD0 mov eax, dword ptr fs:[00000030h]3_2_01404AD0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D8AA0 mov eax, dword ptr fs:[00000030h]3_2_013D8AA0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D8AA0 mov eax, dword ptr fs:[00000030h]3_2_013D8AA0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140AAEE mov eax, dword ptr fs:[00000030h]3_2_0140AAEE
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_0140AAEE mov eax, dword ptr fs:[00000030h]3_2_0140AAEE
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DEA80 mov eax, dword ptr fs:[00000030h]3_2_013DEA80
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DEA80 mov eax, dword ptr fs:[00000030h]3_2_013DEA80
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DEA80 mov eax, dword ptr fs:[00000030h]3_2_013DEA80
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DEA80 mov eax, dword ptr fs:[00000030h]3_2_013DEA80
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DEA80 mov eax, dword ptr fs:[00000030h]3_2_013DEA80
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DEA80 mov eax, dword ptr fs:[00000030h]3_2_013DEA80
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DEA80 mov eax, dword ptr fs:[00000030h]3_2_013DEA80
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DEA80 mov eax, dword ptr fs:[00000030h]3_2_013DEA80
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013DEA80 mov eax, dword ptr fs:[00000030h]3_2_013DEA80
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_014A4A80 mov eax, dword ptr fs:[00000030h]3_2_014A4A80
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01408A90 mov edx, dword ptr fs:[00000030h]3_2_01408A90
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01426AA4 mov eax, dword ptr fs:[00000030h]3_2_01426AA4
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013D0AD0 mov eax, dword ptr fs:[00000030h]3_2_013D0AD0
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013C6D10 mov eax, dword ptr fs:[00000030h]3_2_013C6D10
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013C6D10 mov eax, dword ptr fs:[00000030h]3_2_013C6D10
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013C6D10 mov eax, dword ptr fs:[00000030h]3_2_013C6D10
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_01468D6B mov eax, dword ptr fs:[00000030h]3_2_01468D6B
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013EAD00 mov eax, dword ptr fs:[00000030h]3_2_013EAD00
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013EAD00 mov eax, dword ptr fs:[00000030h]3_2_013EAD00
          Source: C:\Users\user\Desktop\3P5I851G78.exeCode function: 3_2_013EAD00 mov eax, dword ptr fs:[00000030h]3_2_013EAD00
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_00542E62 GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,7_2_00542E62
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_00546510 SetUnhandledExceptionFilter,7_2_00546510
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_005461C0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_2_005461C0
          Source: C:\Users\user\Desktop\3P5I851G78.exeMemory allocated: page read and write | page guardJump to behavior

          HIPS / PFW / Operating System Protection Evasion

          barindex
          Adds a directory exclusion to Windows Defender
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3P5I851G78.exe"
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3P5I851G78.exe"Jump to behavior
          Found direct / indirect Syscall (likely to bypass EDR)
          Source: C:\Users\user\Desktop\3P5I851G78.exeNtQueueApcThread: Indirect: 0x12FA4F2Jump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeNtClose: Indirect: 0x12FA56C
          Injects a PE file into a foreign processes
          Source: C:\Users\user\Desktop\3P5I851G78.exeMemory written: C:\Users\user\Desktop\3P5I851G78.exe base: 400000 value starts with: 4D5AJump to behavior
          Maps a DLL or memory area into another process
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: NULL target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection loaded: NULL target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read writeJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Modifies the context of a thread in another process (thread injection)
          Source: C:\Users\user\Desktop\3P5I851G78.exeThread register set: target process: 4056Jump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeThread register set: target process: 4056Jump to behavior
          Queues an APC in another process (thread injection)
          Source: C:\Users\user\Desktop\3P5I851G78.exeThread APC queued: target process: C:\Windows\explorer.exeJump to behavior
          Sample uses process hollowing technique
          Source: C:\Users\user\Desktop\3P5I851G78.exeSection unmapped: C:\Windows\SysWOW64\rundll32.exe base address: 540000Jump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3P5I851G78.exe"Jump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeProcess created: C:\Users\user\Desktop\3P5I851G78.exe "C:\Users\user\Desktop\3P5I851G78.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\3P5I851G78.exe"Jump to behavior
          Source: explorer.exe, 00000005.00000002.3294933502.0000000001231000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.853708562.0000000001231000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager
          Source: explorer.exe, 00000005.00000000.863432920.000000000988D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3293654879.0000000000C50000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.857213109.0000000004810000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 00000005.00000000.853262365.0000000000BA8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3294933502.0000000001231000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.3293654879.0000000000BA0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Progman
          Source: explorer.exe, 00000005.00000002.3294933502.0000000001231000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.853708562.0000000001231000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
          Source: C:\Users\user\Desktop\3P5I851G78.exeQueries volume information: C:\Users\user\Desktop\3P5I851G78.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\3P5I851G78.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: unknown VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: unknown VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: unknown VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_00546735 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,7_2_00546735
          Source: C:\Users\user\Desktop\3P5I851G78.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

          Stealing of Sensitive Information

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 3.2.3P5I851G78.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 3.2.3P5I851G78.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000000.00000002.855098590.00000000040D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.3294789959.00000000043F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.3294895967.0000000004420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.913516599.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.3293228083.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

          Remote Access Functionality

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 3.2.3P5I851G78.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 3.2.3P5I851G78.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000000.00000002.855098590.00000000040D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.3294789959.00000000043F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.3294895967.0000000004420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.913516599.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.3293228083.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
          Command and Scripting Interpreter          		1
          DLL Side-Loading          		512
          Process Injection          		11
          Masquerading          		OS Credential Dumping1
          System Time Discovery          		Remote Services1
          Archive Collected Data          		12
          Encrypted Channel          		Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault Accounts1
          Shared Modules          		Boot or Logon Initialization Scripts1
          Abuse Elevation Control Mechanism          		11
          Disable or Modify Tools          		LSASS Memory251
          Security Software Discovery          		Remote Desktop ProtocolData from Removable Media1
          Non-Application Layer Protocol          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
          DLL Side-Loading          		51
          Virtualization/Sandbox Evasion          		Security Account Manager2
          Process Discovery          		SMB/Windows Admin SharesData from Network Shared Drive12
          Application Layer Protocol          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook512
          Process Injection          		NTDS51
          Virtualization/Sandbox Evasion          		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
          Deobfuscate/Decode Files or Information          		LSA Secrets1
          Application Window Discovery          		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
          Abuse Elevation Control Mechanism          		Cached Domain Credentials1
          File and Directory Discovery          		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items4
          Obfuscated Files or Information          		DCSync223
          System Information Discovery          		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
          Rundll32          		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
          Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt12
          Software Packing          		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
          IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
          Timestomp          		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
          Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd1
          DLL Side-Loading          		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1634820 Sample: 3P5I851G78.exe Startdate: 11/03/2025 Architecture: WINDOWS Score: 100 39 www.ucas-saaad.buzz 2->39 41 www.olocaustaffirmer.net 2->41 43 9 other IPs or domains 2->43 59 Found malware configuration 2->59 61 Malicious sample detected (through community Yara rule) 2->61 63 Antivirus detection for URL or domain 2->63 65 9 other signatures 2->65 11 3P5I851G78.exe 4 2->11         started        15 svchost.exe 1 1 2->15         started        signatures3 process4 dnsIp5 37 C:\Users\user\AppData\...\3P5I851G78.exe.log, ASCII 11->37 dropped 67 Adds a directory exclusion to Windows Defender 11->67 69 Tries to detect virtualization through RDTSC time measurements 11->69 71 Injects a PE file into a foreign processes 11->71 73 Switches to a custom stack to bypass stack traces 11->73 18 3P5I851G78.exe 11->18         started        21 powershell.exe 23 11->21         started        47 127.0.0.1 unknown unknown 15->47 file6 signatures7 process8 signatures9 49 Modifies the context of a thread in another process (thread injection) 18->49 51 Maps a DLL or memory area into another process 18->51 53 Sample uses process hollowing technique 18->53 57 2 other signatures 18->57 23 explorer.exe 62 1 18->23 injected 55 Loading BitLocker PowerShell Module 21->55 26 WmiPrvSE.exe 21->26         started        28 conhost.exe 21->28         started        process10 dnsIp11 45 204.79.197.203, 443 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 23->45 30 rundll32.exe 23->30         started        process12 signatures13 75 Modifies the context of a thread in another process (thread injection) 30->75 77 Maps a DLL or memory area into another process 30->77 79 Tries to detect virtualization through RDTSC time measurements 30->79 33 cmd.exe 1 30->33         started        process14 process15 35 conhost.exe 33->35         started       

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.