Edit tour

Windows Analysis Report
4lHZn6Ri2B.exe

Overview

General Information

Sample name:	4lHZn6Ri2B.exe renamed because original name is a hash value
Original sample name:	ddd294075c549d450ca2980348b9aa282fbc1cdc1f032b62f12f991365412fa5.exe
Analysis ID:	1634881
MD5:	a5fa3174d7fc5565473f1b8e899030be
SHA1:	625957f7de2742b5bd9157a278dd74973425ecb9
SHA256:	ddd294075c549d450ca2980348b9aa282fbc1cdc1f032b62f12f991365412fa5
Tags:	exeFormbookuser-adrian__luca
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected FormBook

.NET source code contains potential unpacker

.NET source code contains very large strings

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Uses netstat to query active network connections and open ports

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Tries to resolve many domain names, but no domain seems valid

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

4lHZn6Ri2B.exe (PID: 7136 cmdline: "C:\Users\user\Desktop\4lHZn6Ri2B.exe" MD5: A5FA3174D7FC5565473F1B8E899030BE)

powershell.exe (PID: 5396 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\4lHZn6Ri2B.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 6628 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

4lHZn6Ri2B.exe (PID: 5152 cmdline: "C:\Users\user\Desktop\4lHZn6Ri2B.exe" MD5: A5FA3174D7FC5565473F1B8E899030BE)

explorer.exe (PID: 2528 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

NETSTAT.EXE (PID: 6024 cmdline: "C:\Windows\SysWOW64\NETSTAT.EXE" MD5: 9DB170ED520A6DD57B5AC92EC537368A)

cmd.exe (PID: 6216 cmdline: /c del "C:\Users\user\Desktop\4lHZn6Ri2B.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 312 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.uittttttttt17.sbs/sm05/"], "decoy": ["oduodesign.net", "rofitfunnelgo.net", "grexvc.online", "royecto10k.online", "asminivorytancherry.top", "isard.online", "fbzhvub.xyz", "artners-smart.fun", "dventistbridgingcare.info", "jhwzcqf.xyz", "uoysbuddy.online", "ome-care-jobs-362514.today", "tp7-ditogel.xyz", "ssentialshub.shop", "etwinner-casinos-spins.buzz", "eikuang.lol", "howupii.online", "univon.homes", "irewood-2025-at.cfd", "ropelatacadao.online", "cctlink.net", "dealofferforyou.website", "hilduzzw.click", "30a.xyz", "lowingweddingsgrace.beauty", "indow-replacement-67522.bond", "mericanadtrader.online", "ovostniknearby.click", "nklere-norge.online", "atestmoviereview.xyz", "ewelscrwn.net", "awwaanntogell.net", "leaningtasks-met-sas.click", "ental-health-test-95794.bond", "ppseeks.net", "kzemuot.xyz", "etflix711.fun", "hefrenchzone.online", "anding.ninja", "atzhall.wine", "adiantweddingscharm.beauty", "ouqiu8.net", "tp-toto88.info", "abynameshub.shop", "inup-casino-rkw3.top", "indgoodfranchises.info", "hsg.xyz", "eetastrion.shop", "gx0301.online", "arrefitnessassociation.xyz", "nsightyogaboston.online", "bandoned-houses-83535.bond", "onghuan.lol", "judecomcarinho.fun", "w2ir.shop", "oshigaya-clinic-266665868.today", "sicroi.shop", "leaning-jobs-94377.bond", "hunpeng.lol", "sedolu.info", "ontent-mint.xyz", "stekklima.net", "uoding.lol", "emax.ltd"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.3520154106.00000000004B0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.3520154106.00000000004B0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000007.00000002.3520154106.00000000004B0000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb90:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000007.00000002.3520154106.00000000004B0000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8fa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.3520154106.00000000004B0000.00000040.80000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.3521233716.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.3521233716.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000007.00000002.3521233716.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb90:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000007.00000002.3521233716.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8fa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.3521233716.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.1066684814.00000000042C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.1066684814.00000000042C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000000.00000002.1066684814.00000000042C1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x61e41:$a1: 3C 30 50 4F 53 54 74 09 40 0x90461:$a1: 3C 30 50 4F 53 54 74 09 40 0x78780:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa6da0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x665bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x94bdf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x714a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83 0x9fac7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000000.00000002.1066684814.00000000042C1000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x654f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x65772:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x93b18:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x93d92:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x712a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x9f8c5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x70d91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x9f3b1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x713a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x9f9c7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x7151f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x9fb3f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x6618a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x947aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x7000c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9e62c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x66e83:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x954a3:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x774e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xa5b07:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x784ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.1066684814.00000000042C1000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x74409:$sqlite3step: 68 34 1C 7B E1 0x7451c:$sqlite3step: 68 34 1C 7B E1 0xa2a29:$sqlite3step: 68 34 1C 7B E1 0xa2b3c:$sqlite3step: 68 34 1C 7B E1 0x74438:$sqlite3text: 68 38 2A 90 C5 0x7455d:$sqlite3text: 68 38 2A 90 C5 0xa2a58:$sqlite3text: 68 38 2A 90 C5 0xa2b7d:$sqlite3text: 68 38 2A 90 C5 0x7444b:$sqlite3blob: 68 53 D8 7F 8C 0x74573:$sqlite3blob: 68 53 D8 7F 8C 0xa2a6b:$sqlite3blob: 68 53 D8 7F 8C 0xa2b93:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.1121066600.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.1121066600.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.1121066600.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb90:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000004.00000002.1121066600.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8fa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.1121066600.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.3521121426.0000000002B20000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.3521121426.0000000002B20000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000007.00000002.3521121426.0000000002B20000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb90:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000007.00000002.3521121426.0000000002B20000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8fa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.3521121426.0000000002B20000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.1066684814.0000000004B8E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.1066684814.0000000004B8E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000000.00000002.1066684814.0000000004B8E000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2c8a81:$a1: 3C 30 50 4F 53 54 74 09 40 0x2df3c0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x2cd1ff:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x2d80e7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000000.00000002.1066684814.0000000004B8E000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x2cc138:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x2cc3b2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x2d7ee5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x2d79d1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x2d7fe7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x2d815f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x2ccdca:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x2d6c4c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x2cdac3:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x2de127:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x2df12a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.1066684814.0000000004B8E000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x2db049:$sqlite3step: 68 34 1C 7B E1 0x2db15c:$sqlite3step: 68 34 1C 7B E1 0x2db078:$sqlite3text: 68 38 2A 90 C5 0x2db19d:$sqlite3text: 68 38 2A 90 C5 0x2db08b:$sqlite3blob: 68 53 D8 7F 8C 0x2db1b3:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: 4lHZn6Ri2B.exe PID: 7136	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 4lHZn6Ri2B.exe PID: 7136	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x527f5:$a1: 3C 30 50 4F 53 54 74 09 40 0xf378c:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: 4lHZn6Ri2B.exe PID: 5152	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x62ae1:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: NETSTAT.EXE PID: 6024	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x3af8:$a1: 3C 30 50 4F 53 54 74 09 40 0xf423:$a1: 3C 30 50 4F 53 54 74 09 40 0x1fccf1:$a1: 3C 30 50 4F 53 54 74 09 40
Click to see the 29 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.4lHZn6Ri2B.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
4.2.4lHZn6Ri2B.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
4.2.4lHZn6Ri2B.exe.400000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x5451:$a1: 3C 30 50 4F 53 54 74 09 40 0x1bd90:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9bcf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x14ab7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
4.2.4lHZn6Ri2B.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aaf7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bafa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
4.2.4lHZn6Ri2B.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a19:$sqlite3step: 68 34 1C 7B E1 0x17b2c:$sqlite3step: 68 34 1C 7B E1 0x17a48:$sqlite3text: 68 38 2A 90 C5 0x17b6d:$sqlite3text: 68 38 2A 90 C5 0x17a5b:$sqlite3blob: 68 53 D8 7F 8C 0x17b83:$sqlite3blob: 68 53 D8 7F 8C
4.2.4lHZn6Ri2B.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
4.2.4lHZn6Ri2B.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
4.2.4lHZn6Ri2B.exe.400000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cb90:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
4.2.4lHZn6Ri2B.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8fa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
4.2.4lHZn6Ri2B.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18819:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x18848:$sqlite3text: 68 38 2A 90 C5 0x1896d:$sqlite3text: 68 38 2A 90 C5 0x1885b:$sqlite3blob: 68 53 D8 7F 8C 0x18983:$sqlite3blob: 68 53 D8 7F 8C
0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x77e71:$a1: 3C 30 50 4F 53 54 74 09 40 0x8e7b0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x7c5ef:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x874d7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7b528:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b7a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x872d5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x86dc1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x873d7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x8754f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x7c1ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x8603c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x7ceb3:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x8d517:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x8e51a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x8a439:$sqlite3step: 68 34 1C 7B E1 0x8a54c:$sqlite3step: 68 34 1C 7B E1 0x8a468:$sqlite3text: 68 38 2A 90 C5 0x8a58d:$sqlite3text: 68 38 2A 90 C5 0x8a47b:$sqlite3blob: 68 53 D8 7F 8C 0x8a5a3:$sqlite3blob: 68 53 D8 7F 8C
0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0xeaa91:$a1: 3C 30 50 4F 53 54 74 09 40 0x1013d0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xef20f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0xfa0f7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xee148:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xee3c2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xf9ef5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0xf99e1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xf9ff7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xfa16f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xeedda:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0xf8c5c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xefad3:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x100137:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x10113a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0xfd059:$sqlite3step: 68 34 1C 7B E1 0xfd16c:$sqlite3step: 68 34 1C 7B E1 0xfd088:$sqlite3text: 68 38 2A 90 C5 0xfd1ad:$sqlite3text: 68 38 2A 90 C5 0xfd09b:$sqlite3blob: 68 53 D8 7F 8C 0xfd1c3:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\4lHZn6Ri2B.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\4lHZn6Ri2B.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\4lHZn6Ri2B.exe", ParentImage: C:\Users\user\Desktop\4lHZn6Ri2B.exe, ParentProcessId: 7136, ParentProcessName: 4lHZn6Ri2B.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\4lHZn6Ri2B.exe", ProcessId: 5396, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\4lHZn6Ri2B.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\4lHZn6Ri2B.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\4lHZn6Ri2B.exe", ParentImage: C:\Users\user\Desktop\4lHZn6Ri2B.exe, ParentProcessId: 7136, ParentProcessName: 4lHZn6Ri2B.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\4lHZn6Ri2B.exe", ProcessId: 5396, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 628, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 312, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 4lHZn6Ri2B.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://www.irewood-2025-at.cfd	Avira URL Cloud: Label: malware
Source: http://www.leaning-jobs-94377.bond/sm05/	Avira URL Cloud: Label: malware
Source: http://www.uoding.lol/sm05/www.grexvc.online	Avira URL Cloud: Label: malware
Source: http://www.arrefitnessassociation.xyz/sm05/	Avira URL Cloud: Label: malware
Source: www.uittttttttt17.sbs/sm05/	Avira URL Cloud: Label: malware
Source: http://www.grexvc.online/sm05/	Avira URL Cloud: Label: malware
Source: http://www.etflix711.fun	Avira URL Cloud: Label: malware
Source: http://www.oduodesign.net/sm05/www.etflix711.fun	Avira URL Cloud: Label: malware
Source: http://www.mericanadtrader.online/sm05/www.ental-health-test-95794.bond	Avira URL Cloud: Label: malware
Source: http://www.mericanadtrader.online/sm05/	Avira URL Cloud: Label: malware
Source: http://www.uoysbuddy.online/sm05/	Avira URL Cloud: Label: malware
Source: http://www.uoding.lol/sm05/	Avira URL Cloud: Label: malware
Source: http://www.ental-health-test-95794.bond	Avira URL Cloud: Label: malware
Source: http://www.grexvc.online/sm05/www.leaning-jobs-94377.bond	Avira URL Cloud: Label: malware
Source: http://www.onghuan.lol/sm05/	Avira URL Cloud: Label: malware
Source: http://www.onghuan.lol/sm05/www.ropelatacadao.online	Avira URL Cloud: Label: malware
Source: http://www.ental-health-test-95794.bond/sm05/	Avira URL Cloud: Label: malware
Source: http://www.etflix711.fun/sm05/www.uittttttttt17.sbs	Avira URL Cloud: Label: malware
Source: http://www.uittttttttt17.sbs/sm05/	Avira URL Cloud: Label: malware
Source: http://www.oduodesign.net	Avira URL Cloud: Label: malware
Source: http://www.etflix711.fun/sm05/	Avira URL Cloud: Label: malware
Source: http://www.irewood-2025-at.cfd/sm05/	Avira URL Cloud: Label: malware
Source: http://www.oduodesign.net/sm05/	Avira URL Cloud: Label: malware
Source: http://www.uittttttttt17.sbs/sm05/www.hsg.xyz	Avira URL Cloud: Label: malware
Source: http://www.onghuan.lol	Avira URL Cloud: Label: malware
Source: http://www.ropelatacadao.online/sm05/	Avira URL Cloud: Label: malware
Source: http://www.abynameshub.shop/sm05/	Avira URL Cloud: Label: malware
Source: http://www.abynameshub.shop/sm05/www.onghuan.lol	Avira URL Cloud: Label: malware
Source: http://www.hsg.xyz/sm05/	Avira URL Cloud: Label: malware
Source: http://www.arrefitnessassociation.xyz/sm05/www.hefrenchzone.online	Avira URL Cloud: Label: malware
Source: http://www.leaning-jobs-94377.bond	Avira URL Cloud: Label: malware
Source: http://www.uoysbuddy.online/sm05/www.irewood-2025-at.cfd	Avira URL Cloud: Label: malware
Source: http://www.hsg.xyz/sm05/www.mericanadtrader.online	Avira URL Cloud: Label: malware
Source: http://www.grexvc.online	Avira URL Cloud: Label: malware
Source: http://www.abynameshub.shop	Avira URL Cloud: Label: malware
Source: http://www.hefrenchzone.online/sm05/	Avira URL Cloud: Label: malware
Source: http://www.irewood-2025-at.cfd/sm05/www.oduodesign.net	Avira URL Cloud: Label: malware
Source: http://www.hsg.xyz	Avira URL Cloud: Label: malware
Source: http://www.mericanadtrader.online	Avira URL Cloud: Label: malware
Source: http://www.leaning-jobs-94377.bond/sm05/www.uoysbuddy.online	Avira URL Cloud: Label: malware
Source: http://www.ropelatacadao.online/sm05/www.arrefitnessassociation.xyz	Avira URL Cloud: Label: malware
Source: http://www.ropelatacadao.online	Avira URL Cloud: Label: malware
Source: http://www.ental-health-test-95794.bond/sm05/www.abynameshub.shop	Avira URL Cloud: Label: malware
Source: http://www.hefrenchzone.online	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000007.00000002.3520154106.00000000004B0000.00000040.80000000.00040000.00000000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.uittttttttt17.sbs/sm05/"], "decoy": ["oduodesign.net", "rofitfunnelgo.net", "grexvc.online", "royecto10k.online", "asminivorytancherry.top", "isard.online", "fbzhvub.xyz", "artners-smart.fun", "dventistbridgingcare.info", "jhwzcqf.xyz", "uoysbuddy.online", "ome-care-jobs-362514.today", "tp7-ditogel.xyz", "ssentialshub.shop", "etwinner-casinos-spins.buzz", "eikuang.lol", "howupii.online", "univon.homes", "irewood-2025-at.cfd", "ropelatacadao.online", "cctlink.net", "dealofferforyou.website", "hilduzzw.click", "30a.xyz", "lowingweddingsgrace.beauty", "indow-replacement-67522.bond", "mericanadtrader.online", "ovostniknearby.click", "nklere-norge.online", "atestmoviereview.xyz", "ewelscrwn.net", "awwaanntogell.net", "leaningtasks-met-sas.click", "ental-health-test-95794.bond", "ppseeks.net", "kzemuot.xyz", "etflix711.fun", "hefrenchzone.online", "anding.ninja", "atzhall.wine", "adiantweddingscharm.beauty", "ouqiu8.net", "tp-toto88.info", "abynameshub.shop", "inup-casino-rkw3.top", "indgoodfranchises.info", "hsg.xyz", "eetastrion.shop", "gx0301.online", "arrefitnessassociation.xyz", "nsightyogaboston.online", "bandoned-houses-83535.bond", "onghuan.lol", "judecomcarinho.fun", "w2ir.shop", "oshigaya-clinic-266665868.today", "sicroi.shop", "leaning-jobs-94377.bond", "hunpeng.lol", "sedolu.info", "ontent-mint.xyz", "stekklima.net", "uoding.lol", "emax.ltd"]}

Multi AV Scanner detection for submitted file

Source: 4lHZn6Ri2B.exe	Virustotal: Detection: 79%			Perma Link
Source: 4lHZn6Ri2B.exe	ReversingLabs: Detection: 73%

Yara detected FormBook

Source: Yara match	File source: 4.2.4lHZn6Ri2B.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.4lHZn6Ri2B.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3520154106.00000000004B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3521233716.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1066684814.00000000042C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1121066600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3521121426.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1066684814.0000000004B8E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: 4lHZn6Ri2B.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4lHZn6Ri2B.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: netstat.pdbGCTL source: 4lHZn6Ri2B.exe, 00000004.00000002.1123230922.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp, 4lHZn6Ri2B.exe, 00000004.00000002.1122612867.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, NETSTAT.EXE, 00000007.00000002.3520289281.00000000004F0000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: OiHH.pdbSHA256 source: 4lHZn6Ri2B.exe
Source:	Binary string: netstat.pdb source: 4lHZn6Ri2B.exe, 00000004.00000002.1123230922.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp, 4lHZn6Ri2B.exe, 00000004.00000002.1122612867.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, NETSTAT.EXE, NETSTAT.EXE, 00000007.00000002.3520289281.00000000004F0000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: OiHH.pdb source: 4lHZn6Ri2B.exe
Source:	Binary string: wntdll.pdbUGP source: 4lHZn6Ri2B.exe, 00000004.00000002.1124190785.00000000014F0000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000007.00000002.3522109574.000000000309E000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000007.00000002.3522109574.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000007.00000003.1122203307.0000000002B90000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000007.00000003.1124624064.0000000002D4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 4lHZn6Ri2B.exe, 4lHZn6Ri2B.exe, 00000004.00000002.1124190785.00000000014F0000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, NETSTAT.EXE, 00000007.00000002.3522109574.000000000309E000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000007.00000002.3522109574.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000007.00000003.1122203307.0000000002B90000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000007.00000003.1124624064.0000000002D4F000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4x nop then jmp 0F6C12C2h	0_2_0F6C08D0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4x nop then jmp 0F6C12C2h	0_2_0F6C0D83
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4x nop then jmp 0F6C12C2h	0_2_0F6C089F
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4x nop then pop edi	4_2_0040E482
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 4x nop then pop edi	7_2_004BE482

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.uittttttttt17.sbs/sm05/

Performs DNS queries to domains with low reputation

Source:

DNS query: www.hsg.xyz

Uses netstat to query active network connections and open ports

Source: C:\Windows\explorer.exe

Process created: C:\Windows\SysWOW64\NETSTAT.EXE "C:\Windows\SysWOW64\NETSTAT.EXE"

Source: Joe Sandbox View	IP Address: 204.79.197.203 204.79.197.203
Source: Joe Sandbox View	IP Address: 204.79.197.203 204.79.197.203

Source: global traffic

TCP traffic: 192.168.2.10:49672 -> 204.79.197.203:443

Source: unknown	DNS traffic detected: query: www.leaning-jobs-94377.bond replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.oduodesign.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.hsg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.uittttttttt17.sbs replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.uoysbuddy.online replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.uoding.lol replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.irewood-2025-at.cfd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.mericanadtrader.online replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.etflix711.fun replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.abynameshub.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.ental-health-test-95794.bond replaycode: Name error (3)

Source: unknown	DNS traffic detected: query: www.leaning-jobs-94377.bond replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.oduodesign.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.hsg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.uittttttttt17.sbs replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.uoysbuddy.online replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.uoding.lol replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.irewood-2025-at.cfd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.mericanadtrader.online replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.etflix711.fun replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.abynameshub.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.ental-health-test-95794.bond replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.uoding.lol
Source: global traffic	DNS traffic detected: DNS query: www.leaning-jobs-94377.bond
Source: global traffic	DNS traffic detected: DNS query: www.uoysbuddy.online
Source: global traffic	DNS traffic detected: DNS query: www.irewood-2025-at.cfd
Source: global traffic	DNS traffic detected: DNS query: www.oduodesign.net
Source: global traffic	DNS traffic detected: DNS query: www.etflix711.fun
Source: global traffic	DNS traffic detected: DNS query: www.uittttttttt17.sbs
Source: global traffic	DNS traffic detected: DNS query: www.hsg.xyz
Source: global traffic	DNS traffic detected: DNS query: www.mericanadtrader.online
Source: global traffic	DNS traffic detected: DNS query: www.ental-health-test-95794.bond
Source: global traffic	DNS traffic detected: DNS query: www.abynameshub.shop

Source: explorer.exe, 00000005.00000000.1065055721.0000000007293000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2839542567.0000000008B61000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3529032837.0000000008B61000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3526128767.0000000007293000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.0000000007293000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1070233476.0000000008B61000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: svchost.exe, 0000000A.00000002.2851570391.000001F5E0800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: explorer.exe, 00000005.00000000.1065055721.0000000007293000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2839542567.0000000008B61000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3529032837.0000000008B61000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3526128767.0000000007293000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.0000000007293000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1070233476.0000000008B61000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.10.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: explorer.exe, 00000005.00000000.1065055721.0000000007293000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2839542567.0000000008B61000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3529032837.0000000008B61000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3526128767.0000000007293000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.0000000007293000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1070233476.0000000008B61000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000005.00000003.2836119885.00000000072D2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3526128767.00000000072D2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000072D2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crl
Source: explorer.exe, 00000005.00000002.3526974196.0000000007810000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1066966517.0000000007950000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1066985444.0000000007970000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: 4lHZn6Ri2B.exe, 00000000.00000002.1065484810.00000000032C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 4lHZn6Ri2B.exe	String found in binary or memory: http://tempuri.org/DataTableUsers.xsd
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.abynameshub.shop
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.abynameshub.shop/sm05/
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.abynameshub.shop/sm05/www.onghuan.lol
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.abynameshub.shopReferer:
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.arrefitnessassociation.xyz
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.arrefitnessassociation.xyz/sm05/
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.arrefitnessassociation.xyz/sm05/www.hefrenchzone.online
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.arrefitnessassociation.xyzReferer:
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ental-health-test-95794.bond
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ental-health-test-95794.bond/sm05/
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ental-health-test-95794.bond/sm05/www.abynameshub.shop
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ental-health-test-95794.bondReferer:
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.etflix711.fun
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.etflix711.fun/sm05/
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.etflix711.fun/sm05/www.uittttttttt17.sbs
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.etflix711.funReferer:
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.grexvc.online
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.grexvc.online/sm05/
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.grexvc.online/sm05/www.leaning-jobs-94377.bond
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.grexvc.onlineReferer:
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hefrenchzone.online
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hefrenchzone.online/sm05/
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hefrenchzone.onlineReferer:
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hsg.xyz
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hsg.xyz/sm05/
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hsg.xyz/sm05/www.mericanadtrader.online
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hsg.xyzReferer:
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.irewood-2025-at.cfd
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.irewood-2025-at.cfd/sm05/
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.irewood-2025-at.cfd/sm05/www.oduodesign.net
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.irewood-2025-at.cfdReferer:
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.leaning-jobs-94377.bond
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.leaning-jobs-94377.bond/sm05/
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.leaning-jobs-94377.bond/sm05/www.uoysbuddy.online
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.leaning-jobs-94377.bondReferer:
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.mericanadtrader.online
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.mericanadtrader.online/sm05/
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.mericanadtrader.online/sm05/www.ental-health-test-95794.bond
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.mericanadtrader.onlineReferer:
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.oduodesign.net
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.oduodesign.net/sm05/
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.oduodesign.net/sm05/www.etflix711.fun
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.oduodesign.netReferer:
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.onghuan.lol
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.onghuan.lol/sm05/
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.onghuan.lol/sm05/www.ropelatacadao.online
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.onghuan.lolReferer:
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ropelatacadao.online
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ropelatacadao.online/sm05/
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ropelatacadao.online/sm05/www.arrefitnessassociation.xyz
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ropelatacadao.onlineReferer:
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.uittttttttt17.sbs
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.uittttttttt17.sbs/sm05/
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.uittttttttt17.sbs/sm05/www.hsg.xyz
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.uittttttttt17.sbsReferer:
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.uoding.lol
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.uoding.lol/sm05/
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.uoding.lol/sm05/www.grexvc.online
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.uoding.lolReferer:
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.uoysbuddy.online
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.uoysbuddy.online/sm05/
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.uoysbuddy.online/sm05/www.irewood-2025-at.cfd
Source: explorer.exe, 00000005.00000002.3533055672.000000000C572000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.uoysbuddy.onlineReferer:
Source: explorer.exe, 00000005.00000003.2837050529.000000000C3A6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3532687833.000000000C3A9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1074664532.000000000C33E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppe$BtUG
Source: explorer.exe, 00000005.00000003.2837050529.000000000C3A6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3532687833.000000000C3A9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1074664532.000000000C33E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000005.00000003.2837050529.000000000C3A6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3532687833.000000000C3A9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1074664532.000000000C33E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSS
Source: explorer.exe, 00000005.00000002.3522948842.0000000003020000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1059868006.0000000003020000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=C2BB6DDCE8D847D6B779FE8AEC27D161&timeOut=5000&oc
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000005.00000000.1065055721.0000000007255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.0000000007255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3526128767.0000000007255000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
Source: explorer.exe, 00000005.00000000.1069029871.0000000008AF4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: explorer.exe, 00000005.00000002.3532625132.000000000C36B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2838294856.000000000C36A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2837949345.000000000C33E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1074664532.000000000C33E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: svchost.exe, 0000000A.00000003.1203725709.000001F5E0A7A000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 0000000A.00000003.1203725709.000001F5E0A00000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15G9PH.img
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hJkDs.img
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
Source: explorer.exe, 00000005.00000002.3532625132.000000000C36B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2838294856.000000000C36A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2837949345.000000000C33E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1074664532.000000000C33E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.comndo
Source: explorer.exe, 00000005.00000002.3532562798.000000000C33E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2837949345.000000000C33E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1074664532.000000000C33E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2839345188.000000000C33E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comeere
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000005.00000000.1070233476.0000000008B61000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/FB
Source: explorer.exe, 00000005.00000002.3532625132.000000000C36B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2838294856.000000000C36A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2837949345.000000000C33E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1074664532.000000000C33E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com#
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/health/wellness/7-secrets-to-a-happy-old-age-backed-by-science/ss-AA1hwpvW
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/companies/legacy-park-auction-canceled-liquidation-proposed-here-s-w
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/realestate/my-husband-and-i-paid-off-our-mortgage-more-than-15-years
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/crime/bar-fight-leaves-man-in-critical-condition-suspect-arrested-in-
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/crime/one-dead-several-wounded-after-drive-by-shootings-in-south-la/a
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/opinion/decline-of-decorum-21-essential-manners-today-s-parents-fail-
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/california-workers-will-get-five-sick-days-instead-of-three-
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/pastor-of-atlanta-based-megachurch-faces-backlash-after-controv
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/ukraine-live-briefing-biden-does-worry-house-drama-will-impact-
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve
Source: explorer.exe, 00000005.00000002.3526128767.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2836119885.00000000071DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1065055721.00000000071DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed

Source: unknown

Network traffic detected: HTTP traffic on port 49672 -> 443

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 4.2.4lHZn6Ri2B.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.4lHZn6Ri2B.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3520154106.00000000004B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3521233716.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1066684814.00000000042C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1121066600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3521121426.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1066684814.0000000004B8E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.4lHZn6Ri2B.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 4.2.4lHZn6Ri2B.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.4lHZn6Ri2B.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.4lHZn6Ri2B.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 4.2.4lHZn6Ri2B.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.4lHZn6Ri2B.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.3520154106.00000000004B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.3520154106.00000000004B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.3520154106.00000000004B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.3521233716.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.3521233716.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.3521233716.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.1066684814.00000000042C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.1066684814.00000000042C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.1066684814.00000000042C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.1121066600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.1121066600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.1121066600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.3521121426.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.3521121426.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.3521121426.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.1066684814.0000000004B8E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.1066684814.0000000004B8E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.1066684814.0000000004B8E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: 4lHZn6Ri2B.exe PID: 7136, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: 4lHZn6Ri2B.exe PID: 5152, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: NETSTAT.EXE PID: 6024, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

.NET source code contains very large strings

Source: 4lHZn6Ri2B.exe, Form4.cs	Long String: Length: 169248
Source: 5.2.explorer.exe.10b1f840.0.raw.unpack, Form4.cs	Long String: Length: 169248
Source: 7.2.NETSTAT.EXE.344f840.3.raw.unpack, Form4.cs	Long String: Length: 169248

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0041A330 NtCreateFile,	4_2_0041A330
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0041A3E0 NtReadFile,	4_2_0041A3E0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0041A460 NtClose,	4_2_0041A460
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0041A510 NtAllocateVirtualMemory,	4_2_0041A510
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0041A32A NtCreateFile,	4_2_0041A32A
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0041A45A NtReadFile,	4_2_0041A45A
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0041A45E NtReadFile,	4_2_0041A45E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0041A50A NtAllocateVirtualMemory,	4_2_0041A50A
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562B60 NtClose,LdrInitializeThunk,	4_2_01562B60
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	4_2_01562BF0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562AD0 NtReadFile,LdrInitializeThunk,	4_2_01562AD0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562D10 NtMapViewOfSection,LdrInitializeThunk,	4_2_01562D10
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562D30 NtUnmapViewOfSection,LdrInitializeThunk,	4_2_01562D30
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562DD0 NtDelayExecution,LdrInitializeThunk,	4_2_01562DD0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_01562DF0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562C70 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_01562C70
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562CA0 NtQueryInformationToken,LdrInitializeThunk,	4_2_01562CA0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562F30 NtCreateSection,LdrInitializeThunk,	4_2_01562F30
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562FE0 NtCreateFile,LdrInitializeThunk,	4_2_01562FE0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562F90 NtProtectVirtualMemory,LdrInitializeThunk,	4_2_01562F90
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562FB0 NtResumeThread,LdrInitializeThunk,	4_2_01562FB0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562E80 NtReadVirtualMemory,LdrInitializeThunk,	4_2_01562E80
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,	4_2_01562EA0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01564340 NtSetContextThread,	4_2_01564340
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01564650 NtSuspendThread,	4_2_01564650
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562BE0 NtQueryValueKey,	4_2_01562BE0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562B80 NtQueryInformationFile,	4_2_01562B80
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562BA0 NtEnumerateValueKey,	4_2_01562BA0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562AF0 NtWriteFile,	4_2_01562AF0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562AB0 NtWaitForSingleObject,	4_2_01562AB0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562D00 NtSetInformationFile,	4_2_01562D00
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562DB0 NtEnumerateKey,	4_2_01562DB0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562C60 NtCreateKey,	4_2_01562C60
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562C00 NtQueryInformationProcess,	4_2_01562C00
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562CC0 NtQueryVirtualMemory,	4_2_01562CC0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562CF0 NtOpenProcess,	4_2_01562CF0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562F60 NtCreateProcessEx,	4_2_01562F60
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562FA0 NtQuerySection,	4_2_01562FA0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562E30 NtWriteVirtualMemory,	4_2_01562E30
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562EE0 NtQueueApcThread,	4_2_01562EE0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01563010 NtOpenDirectoryObject,	4_2_01563010
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01563090 NtSetValueKey,	4_2_01563090
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015635C0 NtCreateMutant,	4_2_015635C0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015639B0 NtGetContextThread,	4_2_015639B0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01563D70 NtOpenThread,	4_2_01563D70
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01563D10 NtOpenProcessToken,	4_2_01563D10
Source: C:\Windows\explorer.exe	Code function: 5_2_0E47AE12 NtProtectVirtualMemory,	5_2_0E47AE12
Source: C:\Windows\explorer.exe	Code function: 5_2_0E479232 NtCreateFile,	5_2_0E479232
Source: C:\Windows\explorer.exe	Code function: 5_2_0E47AE0A NtProtectVirtualMemory,	5_2_0E47AE0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72AD0 NtReadFile,LdrInitializeThunk,	7_2_02F72AD0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	7_2_02F72BF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72BE0 NtQueryValueKey,LdrInitializeThunk,	7_2_02F72BE0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72B60 NtClose,LdrInitializeThunk,	7_2_02F72B60
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,	7_2_02F72EA0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72FE0 NtCreateFile,LdrInitializeThunk,	7_2_02F72FE0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72F30 NtCreateSection,LdrInitializeThunk,	7_2_02F72F30
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72CA0 NtQueryInformationToken,LdrInitializeThunk,	7_2_02F72CA0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72C70 NtFreeVirtualMemory,LdrInitializeThunk,	7_2_02F72C70
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72C60 NtCreateKey,LdrInitializeThunk,	7_2_02F72C60
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72DF0 NtQuerySystemInformation,LdrInitializeThunk,	7_2_02F72DF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72DD0 NtDelayExecution,LdrInitializeThunk,	7_2_02F72DD0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72D10 NtMapViewOfSection,LdrInitializeThunk,	7_2_02F72D10
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F735C0 NtCreateMutant,LdrInitializeThunk,	7_2_02F735C0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F74340 NtSetContextThread,	7_2_02F74340
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F74650 NtSuspendThread,	7_2_02F74650
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72AF0 NtWriteFile,	7_2_02F72AF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72AB0 NtWaitForSingleObject,	7_2_02F72AB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72BA0 NtEnumerateValueKey,	7_2_02F72BA0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72B80 NtQueryInformationFile,	7_2_02F72B80
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72EE0 NtQueueApcThread,	7_2_02F72EE0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72E80 NtReadVirtualMemory,	7_2_02F72E80
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72E30 NtWriteVirtualMemory,	7_2_02F72E30
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72FB0 NtResumeThread,	7_2_02F72FB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72FA0 NtQuerySection,	7_2_02F72FA0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72F90 NtProtectVirtualMemory,	7_2_02F72F90
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72F60 NtCreateProcessEx,	7_2_02F72F60
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72CF0 NtOpenProcess,	7_2_02F72CF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72CC0 NtQueryVirtualMemory,	7_2_02F72CC0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72C00 NtQueryInformationProcess,	7_2_02F72C00
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72DB0 NtEnumerateKey,	7_2_02F72DB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72D30 NtUnmapViewOfSection,	7_2_02F72D30
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F72D00 NtSetInformationFile,	7_2_02F72D00
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F73090 NtSetValueKey,	7_2_02F73090
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F73010 NtOpenDirectoryObject,	7_2_02F73010
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F739B0 NtGetContextThread,	7_2_02F739B0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F73D70 NtOpenThread,	7_2_02F73D70
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F73D10 NtOpenProcessToken,	7_2_02F73D10
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004CA330 NtCreateFile,	7_2_004CA330
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004CA3E0 NtReadFile,	7_2_004CA3E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004CA460 NtClose,	7_2_004CA460
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004CA510 NtAllocateVirtualMemory,	7_2_004CA510
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004CA32A NtCreateFile,	7_2_004CA32A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004CA45E NtReadFile,	7_2_004CA45E
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004CA45A NtReadFile,	7_2_004CA45A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004CA50A NtAllocateVirtualMemory,	7_2_004CA50A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02D39BAF NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose,	7_2_02D39BAF
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02D3A036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread,	7_2_02D3A036
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02D39BB2 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_02D39BB2
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02D3A042 NtQueryInformationProcess,	7_2_02D3A042

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_0311E044	0_2_0311E044
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_07B95170	0_2_07B95170
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_07B90A20	0_2_07B90A20
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_07B9E628	0_2_07B9E628
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_07B95460	0_2_07B95460
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_07B95451	0_2_07B95451
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_07B9C3D8	0_2_07B9C3D8
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_07B941F0	0_2_07B941F0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_07B941E3	0_2_07B941E3
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_07B9E118	0_2_07B9E118
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_07B9E108	0_2_07B9E108
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_07B95160	0_2_07B95160
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_07B9BFA0	0_2_07B9BFA0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_07B92BF8	0_2_07B92BF8
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_07B90A10	0_2_07B90A10
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_07B9D840	0_2_07B9D840
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_096D0A80	0_2_096D0A80
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_096DF0A9	0_2_096DF0A9
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_096D0A70	0_2_096D0A70
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_00401030	4_2_00401030
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_00402D87	4_2_00402D87
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_00402D8F	4_2_00402D8F
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_00402D90	4_2_00402D90
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_00409E5D	4_2_00409E5D
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_00409E60	4_2_00409E60
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0041E639	4_2_0041E639
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_00402FB0	4_2_00402FB0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B8158	4_2_015B8158
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CA118	4_2_015CA118
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01520100	4_2_01520100
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015E81CC	4_2_015E81CC
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015F01AA	4_2_015F01AA
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C2000	4_2_015C2000
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015EA352	4_2_015EA352
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0153E3F0	4_2_0153E3F0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015F03E6	4_2_015F03E6
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D0274	4_2_015D0274
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B02C0	4_2_015B02C0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530535	4_2_01530535
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015F0591	4_2_015F0591
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015E2446	4_2_015E2446
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D4420	4_2_015D4420
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015DE4F6	4_2_015DE4F6
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01554750	4_2_01554750
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530770	4_2_01530770
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152C7C0	4_2_0152C7C0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154C6E0	4_2_0154C6E0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01546962	4_2_01546962
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015329A0	4_2_015329A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015FA9A6	4_2_015FA9A6
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0153A840	4_2_0153A840
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01532840	4_2_01532840
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155E8F0	4_2_0155E8F0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015168B8	4_2_015168B8
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015EAB40	4_2_015EAB40
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015E6BD7	4_2_015E6BD7
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152EA80	4_2_0152EA80
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CCD1F	4_2_015CCD1F
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0153AD00	4_2_0153AD00
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152ADE0	4_2_0152ADE0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01548DBF	4_2_01548DBF
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530C00	4_2_01530C00
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01520CF2	4_2_01520CF2
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D0CB5	4_2_015D0CB5
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A4F40	4_2_015A4F40
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01550F30	4_2_01550F30
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D2F30	4_2_015D2F30
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01572F28	4_2_01572F28
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01522FC8	4_2_01522FC8
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0153CFE0	4_2_0153CFE0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015AEFA0	4_2_015AEFA0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530E59	4_2_01530E59
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015EEE26	4_2_015EEE26
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015EEEDB	4_2_015EEEDB
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01542E90	4_2_01542E90
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015ECE93	4_2_015ECE93
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151F172	4_2_0151F172
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015FB16B	4_2_015FB16B
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0156516C	4_2_0156516C
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0153B1B0	4_2_0153B1B0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015DF0CC	4_2_015DF0CC
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015370C0	4_2_015370C0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015E70E9	4_2_015E70E9
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015EF0E0	4_2_015EF0E0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151D34C	4_2_0151D34C
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015E132D	4_2_015E132D
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0157739A	4_2_0157739A
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154B2C0	4_2_0154B2C0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D12ED	4_2_015D12ED
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015352A0	4_2_015352A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015E7571	4_2_015E7571
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CD5B0	4_2_015CD5B0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01521460	4_2_01521460
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015EF43F	4_2_015EF43F
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015EF7B0	4_2_015EF7B0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015E16CC	4_2_015E16CC
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01539950	4_2_01539950
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154B950	4_2_0154B950
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C5910	4_2_015C5910
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159D800	4_2_0159D800
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015338E0	4_2_015338E0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015EFB76	4_2_015EFB76
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A5BF0	4_2_015A5BF0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0156DBF9	4_2_0156DBF9
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154FB80	4_2_0154FB80
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015EFA49	4_2_015EFA49
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015E7A46	4_2_015E7A46
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A3A6C	4_2_015A3A6C
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015DDAC6	4_2_015DDAC6
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CDAAC	4_2_015CDAAC
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01575AA0	4_2_01575AA0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D1AA3	4_2_015D1AA3
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015E1D5A	4_2_015E1D5A
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01533D40	4_2_01533D40
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015E7D73	4_2_015E7D73
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154FDC0	4_2_0154FDC0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A9C32	4_2_015A9C32
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015EFCF2	4_2_015EFCF2
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015EFF09	4_2_015EFF09
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_014F3FD5	4_2_014F3FD5
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_014F3FD2	4_2_014F3FD2
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01531F92	4_2_01531F92
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015EFFB1	4_2_015EFFB1
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01539EB0	4_2_01539EB0
Source: C:\Windows\explorer.exe	Code function: 5_2_0E36E232	5_2_0E36E232
Source: C:\Windows\explorer.exe	Code function: 5_2_0E368B32	5_2_0E368B32
Source: C:\Windows\explorer.exe	Code function: 5_2_0E368B30	5_2_0E368B30
Source: C:\Windows\explorer.exe	Code function: 5_2_0E36D036	5_2_0E36D036
Source: C:\Windows\explorer.exe	Code function: 5_2_0E364082	5_2_0E364082
Source: C:\Windows\explorer.exe	Code function: 5_2_0E36B912	5_2_0E36B912
Source: C:\Windows\explorer.exe	Code function: 5_2_0E365D02	5_2_0E365D02
Source: C:\Windows\explorer.exe	Code function: 5_2_0E3715CD	5_2_0E3715CD
Source: C:\Windows\explorer.exe	Code function: 5_2_0E479232	5_2_0E479232
Source: C:\Windows\explorer.exe	Code function: 5_2_0E478036	5_2_0E478036
Source: C:\Windows\explorer.exe	Code function: 5_2_0E46F082	5_2_0E46F082
Source: C:\Windows\explorer.exe	Code function: 5_2_0E470D02	5_2_0E470D02
Source: C:\Windows\explorer.exe	Code function: 5_2_0E476912	5_2_0E476912
Source: C:\Windows\explorer.exe	Code function: 5_2_0E473B32	5_2_0E473B32
Source: C:\Windows\explorer.exe	Code function: 5_2_0E473B30	5_2_0E473B30
Source: C:\Windows\explorer.exe	Code function: 5_2_0E47C5CD	5_2_0E47C5CD
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004F2167	7_2_004F2167
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004F1715	7_2_004F1715
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FC02C0	7_2_02FC02C0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FE0274	7_2_02FE0274
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_030003E6	7_2_030003E6
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F4E3F0	7_2_02F4E3F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FFA352	7_2_02FFA352
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_030001AA	7_2_030001AA
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FD2000	7_2_02FD2000
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FF81CC	7_2_02FF81CC
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FF41A2	7_2_02FF41A2
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FC8158	7_2_02FC8158
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FDA118	7_2_02FDA118
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F30100	7_2_02F30100
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F5C6E0	7_2_02F5C6E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F3C7C0	7_2_02F3C7C0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F40770	7_2_02F40770
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F64750	7_2_02F64750
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FEE4F6	7_2_02FEE4F6
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_03000591	7_2_03000591
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FF2446	7_2_02FF2446
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FE4420	7_2_02FE4420
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F40535	7_2_02F40535
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F3EA80	7_2_02F3EA80
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FF6BD7	7_2_02FF6BD7
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FFAB40	7_2_02FFAB40
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F6E8F0	7_2_02F6E8F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F268B8	7_2_02F268B8
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_0300A9A6	7_2_0300A9A6
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F4A840	7_2_02F4A840
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F42840	7_2_02F42840
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F429A0	7_2_02F429A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F56962	7_2_02F56962
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FFEEDB	7_2_02FFEEDB
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F52E90	7_2_02F52E90
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FFCE93	7_2_02FFCE93
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F40E59	7_2_02F40E59
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FFEE26	7_2_02FFEE26
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F4CFE0	7_2_02F4CFE0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F32FC8	7_2_02F32FC8
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FBEFA0	7_2_02FBEFA0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FB4F40	7_2_02FB4F40
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F60F30	7_2_02F60F30
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FE2F30	7_2_02FE2F30
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F82F28	7_2_02F82F28
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F30CF2	7_2_02F30CF2
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FE0CB5	7_2_02FE0CB5
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F40C00	7_2_02F40C00
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F3ADE0	7_2_02F3ADE0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F58DBF	7_2_02F58DBF
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FDCD1F	7_2_02FDCD1F
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F4AD00	7_2_02F4AD00
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FE12ED	7_2_02FE12ED
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F5B2C0	7_2_02F5B2C0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F452A0	7_2_02F452A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F8739A	7_2_02F8739A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F2D34C	7_2_02F2D34C
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FF132D	7_2_02FF132D
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FF70E9	7_2_02FF70E9
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FFF0E0	7_2_02FFF0E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FEF0CC	7_2_02FEF0CC
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F470C0	7_2_02F470C0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_0300B16B	7_2_0300B16B
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F4B1B0	7_2_02F4B1B0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F2F172	7_2_02F2F172
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F7516C	7_2_02F7516C
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FF16CC	7_2_02FF16CC
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F85630	7_2_02F85630
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FFF7B0	7_2_02FFF7B0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F31460	7_2_02F31460
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FFF43F	7_2_02FFF43F
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_030095C3	7_2_030095C3
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FDD5B0	7_2_02FDD5B0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FF7571	7_2_02FF7571
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FEDAC6	7_2_02FEDAC6
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FDDAAC	7_2_02FDDAAC
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F85AA0	7_2_02F85AA0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FE1AA3	7_2_02FE1AA3
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FB3A6C	7_2_02FB3A6C
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FFFA49	7_2_02FFFA49
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FF7A46	7_2_02FF7A46
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FB5BF0	7_2_02FB5BF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F7DBF9	7_2_02F7DBF9
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F5FB80	7_2_02F5FB80
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FFFB76	7_2_02FFFB76
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F438E0	7_2_02F438E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FAD800	7_2_02FAD800
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F49950	7_2_02F49950
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F5B950	7_2_02F5B950
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FD5910	7_2_02FD5910
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F49EB0	7_2_02F49EB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FFFFB1	7_2_02FFFFB1
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F41F92	7_2_02F41F92
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FFFF09	7_2_02FFFF09
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FFFCF2	7_2_02FFFCF2
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FB9C32	7_2_02FB9C32
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F5FDC0	7_2_02F5FDC0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FF7D73	7_2_02FF7D73
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02FF1D5A	7_2_02FF1D5A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F43D40	7_2_02F43D40
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004CE639	7_2_004CE639
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004B2D8F	7_2_004B2D8F
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004B2D87	7_2_004B2D87
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004B2D90	7_2_004B2D90
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004B9E5D	7_2_004B9E5D
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004B9E60	7_2_004B9E60
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004B2FB0	7_2_004B2FB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02D3A036	7_2_02D3A036
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02D3B232	7_2_02D3B232
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02D35B32	7_2_02D35B32
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02D35B30	7_2_02D35B30
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02D31082	7_2_02D31082
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02D38912	7_2_02D38912
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02D3E5CD	7_2_02D3E5CD
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02D32D02	7_2_02D32D02

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: String function: 01577E54 appears 102 times
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: String function: 0159EA12 appears 86 times
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: String function: 01565130 appears 58 times
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: String function: 0151B970 appears 280 times
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: String function: 015AF290 appears 105 times
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: String function: 02FAEA12 appears 86 times
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: String function: 02FBF290 appears 105 times
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: String function: 02F75130 appears 58 times
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: String function: 02F87E54 appears 111 times
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: String function: 02F2B970 appears 280 times

Source: 4lHZn6Ri2B.exe, 00000000.00000002.1074938747.000000000BF90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 4lHZn6Ri2B.exe
Source: 4lHZn6Ri2B.exe, 00000000.00000002.1055223625.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 4lHZn6Ri2B.exe
Source: 4lHZn6Ri2B.exe, 00000000.00000002.1066684814.00000000042C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs 4lHZn6Ri2B.exe
Source: 4lHZn6Ri2B.exe, 00000000.00000000.1041801299.0000000000EE2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOiHH.exeF vs 4lHZn6Ri2B.exe
Source: 4lHZn6Ri2B.exe, 00000000.00000002.1072823352.0000000007E00000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs 4lHZn6Ri2B.exe
Source: 4lHZn6Ri2B.exe, 00000000.00000002.1066684814.0000000004B8E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 4lHZn6Ri2B.exe
Source: 4lHZn6Ri2B.exe, 00000004.00000002.1124190785.000000000161D000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 4lHZn6Ri2B.exe
Source: 4lHZn6Ri2B.exe, 00000004.00000002.1123230922.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamenetstat.exej% vs 4lHZn6Ri2B.exe
Source: 4lHZn6Ri2B.exe, 00000004.00000002.1122612867.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamenetstat.exej% vs 4lHZn6Ri2B.exe
Source: 4lHZn6Ri2B.exe	Binary or memory string: OriginalFilenameOiHH.exeF vs 4lHZn6Ri2B.exe

Source: 4lHZn6Ri2B.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.2.4lHZn6Ri2B.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 4.2.4lHZn6Ri2B.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.4lHZn6Ri2B.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.4lHZn6Ri2B.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 4.2.4lHZn6Ri2B.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.4lHZn6Ri2B.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.3520154106.00000000004B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.3520154106.00000000004B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.3520154106.00000000004B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.3521233716.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.3521233716.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.3521233716.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.1066684814.00000000042C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.1066684814.00000000042C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.1066684814.00000000042C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.1121066600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.1121066600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.1121066600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.3521121426.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.3521121426.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.3521121426.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.1066684814.0000000004B8E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.1066684814.0000000004B8E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.1066684814.0000000004B8E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: 4lHZn6Ri2B.exe PID: 7136, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: 4lHZn6Ri2B.exe PID: 5152, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: NETSTAT.EXE PID: 6024, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, W4QaUEOOtkcYUbSKsl.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, W4QaUEOOtkcYUbSKsl.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, W4QaUEOOtkcYUbSKsl.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, fJS805xvOwLTE1auMB.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, fJS805xvOwLTE1auMB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, fJS805xvOwLTE1auMB.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, fJS805xvOwLTE1auMB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, W4QaUEOOtkcYUbSKsl.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, W4QaUEOOtkcYUbSKsl.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, W4QaUEOOtkcYUbSKsl.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, W4QaUEOOtkcYUbSKsl.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, W4QaUEOOtkcYUbSKsl.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, W4QaUEOOtkcYUbSKsl.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, fJS805xvOwLTE1auMB.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, fJS805xvOwLTE1auMB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@13/7@11/2

Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004F1CFC GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,		7_2_004F1CFC
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004F1C89 GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,		7_2_004F1C89

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7132:120:WilError_03
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net data provider for sqlserver

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xqug4rmr.w1f.ps1

Jump to behavior

Source: 4lHZn6Ri2B.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 4lHZn6Ri2B.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 4lHZn6Ri2B.exe	Virustotal: Detection: 79%
Source: 4lHZn6Ri2B.exe	ReversingLabs: Detection: 73%

Source: unknown	Process created: C:\Users\user\Desktop\4lHZn6Ri2B.exe "C:\Users\user\Desktop\4lHZn6Ri2B.exe"
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\4lHZn6Ri2B.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process created: C:\Users\user\Desktop\4lHZn6Ri2B.exe "C:\Users\user\Desktop\4lHZn6Ri2B.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE "C:\Windows\SysWOW64\NETSTAT.EXE"
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\4lHZn6Ri2B.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\4lHZn6Ri2B.exe"	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process created: C:\Users\user\Desktop\4lHZn6Ri2B.exe "C:\Users\user\Desktop\4lHZn6Ri2B.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE "C:\Windows\SysWOW64\NETSTAT.EXE"	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\4lHZn6Ri2B.exe"	Jump to behavior

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wscinterop.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wscapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: werconcpl.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: hcproviders.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: snmpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 4lHZn6Ri2B.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 4lHZn6Ri2B.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 4lHZn6Ri2B.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: netstat.pdbGCTL source: 4lHZn6Ri2B.exe, 00000004.00000002.1123230922.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp, 4lHZn6Ri2B.exe, 00000004.00000002.1122612867.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, NETSTAT.EXE, 00000007.00000002.3520289281.00000000004F0000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: OiHH.pdbSHA256 source: 4lHZn6Ri2B.exe
Source:	Binary string: netstat.pdb source: 4lHZn6Ri2B.exe, 00000004.00000002.1123230922.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp, 4lHZn6Ri2B.exe, 00000004.00000002.1122612867.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, NETSTAT.EXE, NETSTAT.EXE, 00000007.00000002.3520289281.00000000004F0000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: OiHH.pdb source: 4lHZn6Ri2B.exe
Source:	Binary string: wntdll.pdbUGP source: 4lHZn6Ri2B.exe, 00000004.00000002.1124190785.00000000014F0000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000007.00000002.3522109574.000000000309E000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000007.00000002.3522109574.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000007.00000003.1122203307.0000000002B90000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000007.00000003.1124624064.0000000002D4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 4lHZn6Ri2B.exe, 4lHZn6Ri2B.exe, 00000004.00000002.1124190785.00000000014F0000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, NETSTAT.EXE, 00000007.00000002.3522109574.000000000309E000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000007.00000002.3522109574.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 00000007.00000003.1122203307.0000000002B90000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 00000007.00000003.1124624064.0000000002D4F000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 4lHZn6Ri2B.exe, Form4.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.4lHZn6Ri2B.exe.7e00000.2.raw.unpack, RK.cs	.Net Code: _206F_200B_206F_206E_200F_206F_200F_202A_200D_200F_200F_202B_206F_200B_200B_200C_200B_200B_200E_206C_200F_206E_200E_206A_200F_200B_206B_206F_200F_206E_200F_200F_206D_206C_202C_202D_206F_202D_200B_202C_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, W4QaUEOOtkcYUbSKsl.cs	.Net Code: H38ZjaTlWv System.Reflection.Assembly.Load(byte[])
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, W4QaUEOOtkcYUbSKsl.cs	.Net Code: H38ZjaTlWv System.Reflection.Assembly.Load(byte[])
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, W4QaUEOOtkcYUbSKsl.cs	.Net Code: H38ZjaTlWv System.Reflection.Assembly.Load(byte[])
Source: 5.2.explorer.exe.10b1f840.0.raw.unpack, Form4.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 7.2.NETSTAT.EXE.344f840.3.raw.unpack, Form4.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])

Source: 4lHZn6Ri2B.exe

Static PE information: 0xEB28D466 [Sat Jan 8 10:39:34 2095 UTC]

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_07B9758F push cs; retf 0007h	0_2_07B9759A
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_07B9757F push cs; retf 0007h	0_2_07B9758A
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 0_2_07B9756F push cs; retf 0007h	0_2_07B9757A
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_00417AC3 push ecx; iretd	4_2_00417AB9
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_00417A82 push ecx; iretd	4_2_00417AB9
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_00417C16 pushad ; retf	4_2_00417C18
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0041D4D2 push eax; ret	4_2_0041D4D8
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0041D4DB push eax; ret	4_2_0041D542
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0041D485 push eax; ret	4_2_0041D4D8
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_00417CA8 push esp; iretd	4_2_00417CB5
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0041D53C push eax; ret	4_2_0041D542
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_014F225F pushad ; ret	4_2_014F27F9
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_014F27FA pushad ; ret	4_2_014F27F9
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015209AD push ecx; mov dword ptr [esp], ecx	4_2_015209B6
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_014F283D push eax; iretd	4_2_014F2858
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_014F135E push eax; iretd	4_2_014F1369
Source: C:\Windows\explorer.exe	Code function: 5_2_0E371B1E push esp; retn 0000h	5_2_0E371B1F
Source: C:\Windows\explorer.exe	Code function: 5_2_0E371B02 push esp; retn 0000h	5_2_0E371B03
Source: C:\Windows\explorer.exe	Code function: 5_2_0E3719B5 push esp; retn 0000h	5_2_0E371AE7
Source: C:\Windows\explorer.exe	Code function: 5_2_0E47CB02 push esp; retn 0000h	5_2_0E47CB03
Source: C:\Windows\explorer.exe	Code function: 5_2_0E47CB1E push esp; retn 0000h	5_2_0E47CB1F
Source: C:\Windows\explorer.exe	Code function: 5_2_0E47C9B5 push esp; retn 0000h	5_2_0E47CAE7
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004F60DD push ecx; ret	7_2_004F60F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_02F309AD push ecx; mov dword ptr [esp], ecx	7_2_02F309B6
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004CE2E8 push ebx; retf	7_2_004CE2EB
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004CE330 push cs; retf	7_2_004CE331
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004CD4DB push eax; ret	7_2_004CD542
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004CD4D2 push eax; ret	7_2_004CD4D8
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004CD485 push eax; ret	7_2_004CD4D8
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004CD53C push eax; ret	7_2_004CD542
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004C7AC3 push ecx; iretd	7_2_004C7AB9

Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, zLPlQjBdCtXQOe92Ru.cs	High entropy of concatenated method names: 'r0j4232whM', 'dV045Tipkr', 'FPN1D3vLB6', 'D5g1FNaMYt', 'mxp4NooZ1O', 'Lge4kxaJxE', 'XMP4mf5eKX', 'nn94YLYmxx', 'GyF47rod3q', 'w2V4lPMuyt'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, H2OcOyLimVyutdumq4.cs	High entropy of concatenated method names: 'CG1vu0F3qj', 'h9uvA9XRLY', 'lT3vyNWgHx', 'Foby5mawNn', 'JMoyzwYSrl', 'TqQvDhIL4d', 'wb5vF6qwLx', 'GrOvR0twMT', 'kdovn3Trt7', 'lMIvZjeEbs'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, OLhwLeFZgTuJrNMP5Rg.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zUl9EUZn9y', 'yIc9cgJrik', 'JQZ9t6xsqh', 'eO699P0RBq', 'e5n96tMRZA', 'pxj9Juyupm', 'feh9GxOaFu'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, ufcWCFdppTO514tLGJ.cs	High entropy of concatenated method names: 'mt1yf434Gv', 'KY0yCgFwhe', 'xmAyemot3y', 'uAxyvyUtyg', 'cXIyOanfZf', 'lXieauWjFW', 'E5EeBGWgpl', 'jv2e3qv05e', 'VBZe2lg7re', 'LydeHG7H5D'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, oyRsPWFRSE11XEAXNH8.cs	High entropy of concatenated method names: 'ToString', 'lUStxe38qk', 'dmrtMSElU7', 'GFVtPub2ma', 'DQ6tdO68Vg', 'HjrthFNBPd', 'N6BtqIi7YU', 'KaItWNWZwg', 'n3iRvQezncNNXu30dbs', 'wBLfNbGiU4TdNB05bYa'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, W4QaUEOOtkcYUbSKsl.cs	High entropy of concatenated method names: 'X1GnfZU2P2', 'cRfnufIDEr', 'RVgnC0eEoN', 'gJenAdKnmN', 'YqKneJ0TgW', 'XaenyJ1mYN', 'E6VnvvV4jL', 'ogEnOCnSk7', 'uuGnQIiEUM', 'qpdnpSJCtx'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, pEE0YC8n4TvRCT96dk.cs	High entropy of concatenated method names: 'gu0vgdLbIT', 'zGwvUNQpBR', 'G27vj1fegi', 'eZDvXkZuot', 'mxhvsHU6or', 'QucvVE3s4Z', 'D7ivwRIVvj', 'CBNvxBHRI1', 'JnavMQV3mV', 'gAevPG07V8'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, ec6jVB5WnaVUcce7eP.cs	High entropy of concatenated method names: 'goFcAUUSM4', 'MRXceYKUnT', 'aYCcy2UfYE', 'rrvcvkUhDM', 'bWNcEDaImP', 'KvycOiS4D0', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, Fh2nSCSUyJqZhnkNBm.cs	High entropy of concatenated method names: 'p6WylAxLsK', 'vWPy0Dk3D2', 'nGLyaebAvS', 'ToString', 'KmGyBNk6fe', 'Bf4y3HL0Qx', 'oAj4lQwVssc4djGGoiv', 'LnPUVAwlZ5tad21S08q', 'H7FV1Ew8w7vFGPuIYQh'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, NkTJkZC81RntmPAd7m.cs	High entropy of concatenated method names: 'Dispose', 'dFpFHMTvjY', 'AOlRh9Gcrb', 'zIMKpOCAoU', 'CKZF56KSpR', 'FNuFzoFDvM', 'ProcessDialogKey', 'QxARDRaHVW', 'RHgRFI270h', 'zsmRRfc6jV'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, ab0rvHRF35uE3Vpnqe.cs	High entropy of concatenated method names: 'b5xjJ1ZnL', 'ks7Xb2CZK', 'tMyVgBS2q', 'G4LwEvWGO', 'zqrMSQtyW', 'I8qPh0GU3', 'GN4PQZp2TQd0f84vgF', 'K5fpUkhdCC0jfoH7DK', 'KKj1L3ZnT', 'KrvcJhHxZ'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, deaQKNzVFnecVP8bup.cs	High entropy of concatenated method names: 'ITHcVQNX04', 'iKRcxiF7Ic', 'teKcMEDYdE', 'GeDcdCEDNZ', 'tH7chAUFYj', 'aZlcWvh4QT', 'aQDcIbfle8', 'VLTcGgRAtR', 'eeTcgr3cDY', 'O9ScUJtQwL'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, uvKEC7FFaxD0ftYN5aT.cs	High entropy of concatenated method names: 'Xybc5AOh0r', 'ptsczCprqq', 'JIltDkj1qj', 'voQtFgOFxB', 'idptRX9nbv', 'UkBtniFcWC', 'QkStZjBOYB', 'yNVtfMkcex', 'kuxtuglVti', 'IhStCyUtnT'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, QNvMKpYpEaxUxmCc4i.cs	High entropy of concatenated method names: 'u6qKo5xJnw', 'rSNKkyJLdu', 'UY0KYLwOdi', 'otnK7sdN2j', 'loFKhvM4JQ', 'TyFKq3Y769', 'vv5KW7u6Bs', 'Vt1KIIvMQB', 'WpRKSIQ5IW', 'E8kKLxu8mP'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, fJS805xvOwLTE1auMB.cs	High entropy of concatenated method names: 'jPQCY9Di9a', 'jSwC7DLNJV', 'GD3ClEu8Zo', 'ctuC0aOood', 'DNxCaqR83r', 'dAYCBR94uU', 'UxKC3M8Bhy', 'w9MC2owTxC', 'lYTCHjXoEU', 'Hr0C5cT3Jm'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, dx3fJGFDbvSJHZgEfIB.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QmBcNTuxX1', 'r7Ock0oXPD', 'GNWcmeLM7J', 'lA9cYCidCn', 'zZdc714q7t', 'TYFcl3IbuW', 'uj2c0BU3V6'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, hRaHVWH7HgI270hjsm.cs	High entropy of concatenated method names: 'CMDEdESXqX', 'l0aEhSm46t', 'MyOEq3M45y', 'AUBEWRusDc', 'HLiEIWrKcp', 'IKBESyJ0Fx', 'EOHELFdlK1', 'SNCEbwfIGd', 'CvbE8s1pId', 'Yc0Eo1QqSR'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, hwWHSx3IjZFpMTvjYw.cs	High entropy of concatenated method names: 'sl1EKpXB6X', 'oHRE4fSS1R', 'Cv7EElfFfE', 'sR7EtYhuYA', 'TyuE6NGvPt', 'X4qEGjwtGb', 'Dispose', 'TGt1udwAvL', 'Kcl1CvBD7i', 'PkH1Aq5ZLr'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, fgoCirPAkYrUx34L6W.cs	High entropy of concatenated method names: 'WmVes8s6d0', 'v68ewkmIV3', 'LBDAqwgknb', 'aQsAWH2Qgq', 'ONqAInHnsw', 'ehAASVQOjP', 'z07ALPSqmy', 'qpBAbAfY2m', 'emCA8rqgkE', 'sbWAotPcTO'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, xuPy34ZrVwlQWCS8Hq.cs	High entropy of concatenated method names: 'JsuFvJS805', 'jOwFOLTE1a', 'v2sFparJKl', 'DqBFipugoC', 'W4LFK6W9fc', 'ICFFTppTO5', 'R3h7IZUOr86Fjb3Eyc', 'cwcKj9bxLsY411JIgb', 'P96FF58pI8', 'PNTFncE4F3'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, auQNSjlsC2wc6UUNIw.cs	High entropy of concatenated method names: 'ToString', 'JbYTNPPpt8', 'vylThqKGFT', 'xNRTqSUJWr', 'tlETWTZF2r', 'zupTIkiXjC', 'qD6TSmDrmB', 'BxwTLVa7CG', 'tPmTb48XVB', 'wdeT8tmleW'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, AnXZ9imeCSfGdKyMyN.cs	High entropy of concatenated method names: 'qNqrx6c3pR', 'NHgrMTOtnD', 'I2srdB9NNk', 'EmDrhCuK6g', 'QCUrWc4P1C', 'lK7rIfotaX', 'liArL1I8pP', 'w1krbLlH7s', 'a9WroBbluW', 'FVirNkj7Pc'
Source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, bvY7S6M2sarJKlwqBp.cs	High entropy of concatenated method names: 'LniAXhwQkk', 'JpkAV2OMHu', 'RmHAxeWLrv', 'fJeAMCUPfV', 'cgAAKSELKT', 'LqJATV4tlQ', 'Et6A4IA49P', 'a5WA1FkfPN', 'jvtAEQq3QW', 'sVkAcrp9Or'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, zLPlQjBdCtXQOe92Ru.cs	High entropy of concatenated method names: 'r0j4232whM', 'dV045Tipkr', 'FPN1D3vLB6', 'D5g1FNaMYt', 'mxp4NooZ1O', 'Lge4kxaJxE', 'XMP4mf5eKX', 'nn94YLYmxx', 'GyF47rod3q', 'w2V4lPMuyt'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, H2OcOyLimVyutdumq4.cs	High entropy of concatenated method names: 'CG1vu0F3qj', 'h9uvA9XRLY', 'lT3vyNWgHx', 'Foby5mawNn', 'JMoyzwYSrl', 'TqQvDhIL4d', 'wb5vF6qwLx', 'GrOvR0twMT', 'kdovn3Trt7', 'lMIvZjeEbs'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, OLhwLeFZgTuJrNMP5Rg.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zUl9EUZn9y', 'yIc9cgJrik', 'JQZ9t6xsqh', 'eO699P0RBq', 'e5n96tMRZA', 'pxj9Juyupm', 'feh9GxOaFu'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, ufcWCFdppTO514tLGJ.cs	High entropy of concatenated method names: 'mt1yf434Gv', 'KY0yCgFwhe', 'xmAyemot3y', 'uAxyvyUtyg', 'cXIyOanfZf', 'lXieauWjFW', 'E5EeBGWgpl', 'jv2e3qv05e', 'VBZe2lg7re', 'LydeHG7H5D'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, oyRsPWFRSE11XEAXNH8.cs	High entropy of concatenated method names: 'ToString', 'lUStxe38qk', 'dmrtMSElU7', 'GFVtPub2ma', 'DQ6tdO68Vg', 'HjrthFNBPd', 'N6BtqIi7YU', 'KaItWNWZwg', 'n3iRvQezncNNXu30dbs', 'wBLfNbGiU4TdNB05bYa'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, W4QaUEOOtkcYUbSKsl.cs	High entropy of concatenated method names: 'X1GnfZU2P2', 'cRfnufIDEr', 'RVgnC0eEoN', 'gJenAdKnmN', 'YqKneJ0TgW', 'XaenyJ1mYN', 'E6VnvvV4jL', 'ogEnOCnSk7', 'uuGnQIiEUM', 'qpdnpSJCtx'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, pEE0YC8n4TvRCT96dk.cs	High entropy of concatenated method names: 'gu0vgdLbIT', 'zGwvUNQpBR', 'G27vj1fegi', 'eZDvXkZuot', 'mxhvsHU6or', 'QucvVE3s4Z', 'D7ivwRIVvj', 'CBNvxBHRI1', 'JnavMQV3mV', 'gAevPG07V8'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, ec6jVB5WnaVUcce7eP.cs	High entropy of concatenated method names: 'goFcAUUSM4', 'MRXceYKUnT', 'aYCcy2UfYE', 'rrvcvkUhDM', 'bWNcEDaImP', 'KvycOiS4D0', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, Fh2nSCSUyJqZhnkNBm.cs	High entropy of concatenated method names: 'p6WylAxLsK', 'vWPy0Dk3D2', 'nGLyaebAvS', 'ToString', 'KmGyBNk6fe', 'Bf4y3HL0Qx', 'oAj4lQwVssc4djGGoiv', 'LnPUVAwlZ5tad21S08q', 'H7FV1Ew8w7vFGPuIYQh'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, NkTJkZC81RntmPAd7m.cs	High entropy of concatenated method names: 'Dispose', 'dFpFHMTvjY', 'AOlRh9Gcrb', 'zIMKpOCAoU', 'CKZF56KSpR', 'FNuFzoFDvM', 'ProcessDialogKey', 'QxARDRaHVW', 'RHgRFI270h', 'zsmRRfc6jV'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, ab0rvHRF35uE3Vpnqe.cs	High entropy of concatenated method names: 'b5xjJ1ZnL', 'ks7Xb2CZK', 'tMyVgBS2q', 'G4LwEvWGO', 'zqrMSQtyW', 'I8qPh0GU3', 'GN4PQZp2TQd0f84vgF', 'K5fpUkhdCC0jfoH7DK', 'KKj1L3ZnT', 'KrvcJhHxZ'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, deaQKNzVFnecVP8bup.cs	High entropy of concatenated method names: 'ITHcVQNX04', 'iKRcxiF7Ic', 'teKcMEDYdE', 'GeDcdCEDNZ', 'tH7chAUFYj', 'aZlcWvh4QT', 'aQDcIbfle8', 'VLTcGgRAtR', 'eeTcgr3cDY', 'O9ScUJtQwL'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, uvKEC7FFaxD0ftYN5aT.cs	High entropy of concatenated method names: 'Xybc5AOh0r', 'ptsczCprqq', 'JIltDkj1qj', 'voQtFgOFxB', 'idptRX9nbv', 'UkBtniFcWC', 'QkStZjBOYB', 'yNVtfMkcex', 'kuxtuglVti', 'IhStCyUtnT'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, QNvMKpYpEaxUxmCc4i.cs	High entropy of concatenated method names: 'u6qKo5xJnw', 'rSNKkyJLdu', 'UY0KYLwOdi', 'otnK7sdN2j', 'loFKhvM4JQ', 'TyFKq3Y769', 'vv5KW7u6Bs', 'Vt1KIIvMQB', 'WpRKSIQ5IW', 'E8kKLxu8mP'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, fJS805xvOwLTE1auMB.cs	High entropy of concatenated method names: 'jPQCY9Di9a', 'jSwC7DLNJV', 'GD3ClEu8Zo', 'ctuC0aOood', 'DNxCaqR83r', 'dAYCBR94uU', 'UxKC3M8Bhy', 'w9MC2owTxC', 'lYTCHjXoEU', 'Hr0C5cT3Jm'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, dx3fJGFDbvSJHZgEfIB.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QmBcNTuxX1', 'r7Ock0oXPD', 'GNWcmeLM7J', 'lA9cYCidCn', 'zZdc714q7t', 'TYFcl3IbuW', 'uj2c0BU3V6'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, hRaHVWH7HgI270hjsm.cs	High entropy of concatenated method names: 'CMDEdESXqX', 'l0aEhSm46t', 'MyOEq3M45y', 'AUBEWRusDc', 'HLiEIWrKcp', 'IKBESyJ0Fx', 'EOHELFdlK1', 'SNCEbwfIGd', 'CvbE8s1pId', 'Yc0Eo1QqSR'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, hwWHSx3IjZFpMTvjYw.cs	High entropy of concatenated method names: 'sl1EKpXB6X', 'oHRE4fSS1R', 'Cv7EElfFfE', 'sR7EtYhuYA', 'TyuE6NGvPt', 'X4qEGjwtGb', 'Dispose', 'TGt1udwAvL', 'Kcl1CvBD7i', 'PkH1Aq5ZLr'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, fgoCirPAkYrUx34L6W.cs	High entropy of concatenated method names: 'WmVes8s6d0', 'v68ewkmIV3', 'LBDAqwgknb', 'aQsAWH2Qgq', 'ONqAInHnsw', 'ehAASVQOjP', 'z07ALPSqmy', 'qpBAbAfY2m', 'emCA8rqgkE', 'sbWAotPcTO'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, xuPy34ZrVwlQWCS8Hq.cs	High entropy of concatenated method names: 'JsuFvJS805', 'jOwFOLTE1a', 'v2sFparJKl', 'DqBFipugoC', 'W4LFK6W9fc', 'ICFFTppTO5', 'R3h7IZUOr86Fjb3Eyc', 'cwcKj9bxLsY411JIgb', 'P96FF58pI8', 'PNTFncE4F3'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, auQNSjlsC2wc6UUNIw.cs	High entropy of concatenated method names: 'ToString', 'JbYTNPPpt8', 'vylThqKGFT', 'xNRTqSUJWr', 'tlETWTZF2r', 'zupTIkiXjC', 'qD6TSmDrmB', 'BxwTLVa7CG', 'tPmTb48XVB', 'wdeT8tmleW'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, AnXZ9imeCSfGdKyMyN.cs	High entropy of concatenated method names: 'qNqrx6c3pR', 'NHgrMTOtnD', 'I2srdB9NNk', 'EmDrhCuK6g', 'QCUrWc4P1C', 'lK7rIfotaX', 'liArL1I8pP', 'w1krbLlH7s', 'a9WroBbluW', 'FVirNkj7Pc'
Source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, bvY7S6M2sarJKlwqBp.cs	High entropy of concatenated method names: 'LniAXhwQkk', 'JpkAV2OMHu', 'RmHAxeWLrv', 'fJeAMCUPfV', 'cgAAKSELKT', 'LqJATV4tlQ', 'Et6A4IA49P', 'a5WA1FkfPN', 'jvtAEQq3QW', 'sVkAcrp9Or'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, zLPlQjBdCtXQOe92Ru.cs	High entropy of concatenated method names: 'r0j4232whM', 'dV045Tipkr', 'FPN1D3vLB6', 'D5g1FNaMYt', 'mxp4NooZ1O', 'Lge4kxaJxE', 'XMP4mf5eKX', 'nn94YLYmxx', 'GyF47rod3q', 'w2V4lPMuyt'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, H2OcOyLimVyutdumq4.cs	High entropy of concatenated method names: 'CG1vu0F3qj', 'h9uvA9XRLY', 'lT3vyNWgHx', 'Foby5mawNn', 'JMoyzwYSrl', 'TqQvDhIL4d', 'wb5vF6qwLx', 'GrOvR0twMT', 'kdovn3Trt7', 'lMIvZjeEbs'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, OLhwLeFZgTuJrNMP5Rg.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zUl9EUZn9y', 'yIc9cgJrik', 'JQZ9t6xsqh', 'eO699P0RBq', 'e5n96tMRZA', 'pxj9Juyupm', 'feh9GxOaFu'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, ufcWCFdppTO514tLGJ.cs	High entropy of concatenated method names: 'mt1yf434Gv', 'KY0yCgFwhe', 'xmAyemot3y', 'uAxyvyUtyg', 'cXIyOanfZf', 'lXieauWjFW', 'E5EeBGWgpl', 'jv2e3qv05e', 'VBZe2lg7re', 'LydeHG7H5D'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, oyRsPWFRSE11XEAXNH8.cs	High entropy of concatenated method names: 'ToString', 'lUStxe38qk', 'dmrtMSElU7', 'GFVtPub2ma', 'DQ6tdO68Vg', 'HjrthFNBPd', 'N6BtqIi7YU', 'KaItWNWZwg', 'n3iRvQezncNNXu30dbs', 'wBLfNbGiU4TdNB05bYa'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, W4QaUEOOtkcYUbSKsl.cs	High entropy of concatenated method names: 'X1GnfZU2P2', 'cRfnufIDEr', 'RVgnC0eEoN', 'gJenAdKnmN', 'YqKneJ0TgW', 'XaenyJ1mYN', 'E6VnvvV4jL', 'ogEnOCnSk7', 'uuGnQIiEUM', 'qpdnpSJCtx'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, pEE0YC8n4TvRCT96dk.cs	High entropy of concatenated method names: 'gu0vgdLbIT', 'zGwvUNQpBR', 'G27vj1fegi', 'eZDvXkZuot', 'mxhvsHU6or', 'QucvVE3s4Z', 'D7ivwRIVvj', 'CBNvxBHRI1', 'JnavMQV3mV', 'gAevPG07V8'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, ec6jVB5WnaVUcce7eP.cs	High entropy of concatenated method names: 'goFcAUUSM4', 'MRXceYKUnT', 'aYCcy2UfYE', 'rrvcvkUhDM', 'bWNcEDaImP', 'KvycOiS4D0', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, Fh2nSCSUyJqZhnkNBm.cs	High entropy of concatenated method names: 'p6WylAxLsK', 'vWPy0Dk3D2', 'nGLyaebAvS', 'ToString', 'KmGyBNk6fe', 'Bf4y3HL0Qx', 'oAj4lQwVssc4djGGoiv', 'LnPUVAwlZ5tad21S08q', 'H7FV1Ew8w7vFGPuIYQh'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, NkTJkZC81RntmPAd7m.cs	High entropy of concatenated method names: 'Dispose', 'dFpFHMTvjY', 'AOlRh9Gcrb', 'zIMKpOCAoU', 'CKZF56KSpR', 'FNuFzoFDvM', 'ProcessDialogKey', 'QxARDRaHVW', 'RHgRFI270h', 'zsmRRfc6jV'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, ab0rvHRF35uE3Vpnqe.cs	High entropy of concatenated method names: 'b5xjJ1ZnL', 'ks7Xb2CZK', 'tMyVgBS2q', 'G4LwEvWGO', 'zqrMSQtyW', 'I8qPh0GU3', 'GN4PQZp2TQd0f84vgF', 'K5fpUkhdCC0jfoH7DK', 'KKj1L3ZnT', 'KrvcJhHxZ'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, deaQKNzVFnecVP8bup.cs	High entropy of concatenated method names: 'ITHcVQNX04', 'iKRcxiF7Ic', 'teKcMEDYdE', 'GeDcdCEDNZ', 'tH7chAUFYj', 'aZlcWvh4QT', 'aQDcIbfle8', 'VLTcGgRAtR', 'eeTcgr3cDY', 'O9ScUJtQwL'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, uvKEC7FFaxD0ftYN5aT.cs	High entropy of concatenated method names: 'Xybc5AOh0r', 'ptsczCprqq', 'JIltDkj1qj', 'voQtFgOFxB', 'idptRX9nbv', 'UkBtniFcWC', 'QkStZjBOYB', 'yNVtfMkcex', 'kuxtuglVti', 'IhStCyUtnT'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, QNvMKpYpEaxUxmCc4i.cs	High entropy of concatenated method names: 'u6qKo5xJnw', 'rSNKkyJLdu', 'UY0KYLwOdi', 'otnK7sdN2j', 'loFKhvM4JQ', 'TyFKq3Y769', 'vv5KW7u6Bs', 'Vt1KIIvMQB', 'WpRKSIQ5IW', 'E8kKLxu8mP'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, fJS805xvOwLTE1auMB.cs	High entropy of concatenated method names: 'jPQCY9Di9a', 'jSwC7DLNJV', 'GD3ClEu8Zo', 'ctuC0aOood', 'DNxCaqR83r', 'dAYCBR94uU', 'UxKC3M8Bhy', 'w9MC2owTxC', 'lYTCHjXoEU', 'Hr0C5cT3Jm'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, dx3fJGFDbvSJHZgEfIB.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QmBcNTuxX1', 'r7Ock0oXPD', 'GNWcmeLM7J', 'lA9cYCidCn', 'zZdc714q7t', 'TYFcl3IbuW', 'uj2c0BU3V6'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, hRaHVWH7HgI270hjsm.cs	High entropy of concatenated method names: 'CMDEdESXqX', 'l0aEhSm46t', 'MyOEq3M45y', 'AUBEWRusDc', 'HLiEIWrKcp', 'IKBESyJ0Fx', 'EOHELFdlK1', 'SNCEbwfIGd', 'CvbE8s1pId', 'Yc0Eo1QqSR'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, hwWHSx3IjZFpMTvjYw.cs	High entropy of concatenated method names: 'sl1EKpXB6X', 'oHRE4fSS1R', 'Cv7EElfFfE', 'sR7EtYhuYA', 'TyuE6NGvPt', 'X4qEGjwtGb', 'Dispose', 'TGt1udwAvL', 'Kcl1CvBD7i', 'PkH1Aq5ZLr'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, fgoCirPAkYrUx34L6W.cs	High entropy of concatenated method names: 'WmVes8s6d0', 'v68ewkmIV3', 'LBDAqwgknb', 'aQsAWH2Qgq', 'ONqAInHnsw', 'ehAASVQOjP', 'z07ALPSqmy', 'qpBAbAfY2m', 'emCA8rqgkE', 'sbWAotPcTO'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, xuPy34ZrVwlQWCS8Hq.cs	High entropy of concatenated method names: 'JsuFvJS805', 'jOwFOLTE1a', 'v2sFparJKl', 'DqBFipugoC', 'W4LFK6W9fc', 'ICFFTppTO5', 'R3h7IZUOr86Fjb3Eyc', 'cwcKj9bxLsY411JIgb', 'P96FF58pI8', 'PNTFncE4F3'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, auQNSjlsC2wc6UUNIw.cs	High entropy of concatenated method names: 'ToString', 'JbYTNPPpt8', 'vylThqKGFT', 'xNRTqSUJWr', 'tlETWTZF2r', 'zupTIkiXjC', 'qD6TSmDrmB', 'BxwTLVa7CG', 'tPmTb48XVB', 'wdeT8tmleW'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, AnXZ9imeCSfGdKyMyN.cs	High entropy of concatenated method names: 'qNqrx6c3pR', 'NHgrMTOtnD', 'I2srdB9NNk', 'EmDrhCuK6g', 'QCUrWc4P1C', 'lK7rIfotaX', 'liArL1I8pP', 'w1krbLlH7s', 'a9WroBbluW', 'FVirNkj7Pc'
Source: 0.2.4lHZn6Ri2B.exe.bf90000.3.raw.unpack, bvY7S6M2sarJKlwqBp.cs	High entropy of concatenated method names: 'LniAXhwQkk', 'JpkAV2OMHu', 'RmHAxeWLrv', 'fJeAMCUPfV', 'cgAAKSELKT', 'LqJATV4tlQ', 'Et6A4IA49P', 'a5WA1FkfPN', 'jvtAEQq3QW', 'sVkAcrp9Or'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 4lHZn6Ri2B.exe PID: 7136, type: MEMORYSTR

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	API/Special instruction interceptor: Address: 7FFD3122D324
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	API/Special instruction interceptor: Address: 7FFD31230774
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	API/Special instruction interceptor: Address: 7FFD31230154
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	API/Special instruction interceptor: Address: 7FFD3122D8A4
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	API/Special instruction interceptor: Address: 7FFD3122DA44
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	API/Special instruction interceptor: Address: 7FFD3122D1E4
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FFD3122D324
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FFD31230774
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FFD3122D944
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FFD3122D504
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FFD3122D544
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FFD3122D1E4
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FFD31230154
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FFD3122D8A4
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FFD3122DA44

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	RDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	RDTSC instruction interceptor: First address: 409B7E second address: 409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\NETSTAT.EXE	RDTSC instruction interceptor: First address: 4B9904 second address: 4B990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\NETSTAT.EXE	RDTSC instruction interceptor: First address: 4B9B7E second address: 4B9B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Memory allocated: 3110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Memory allocated: 32C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Memory allocated: 52C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Memory allocated: 96E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Memory allocated: A6E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Memory allocated: A8F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Memory allocated: B8F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Memory allocated: C010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Memory allocated: D010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Memory allocated: E010000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe

Code function: 4_2_00409AB0 rdtsc

4_2_00409AB0

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Thread delayed: delay time: 239890	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Thread delayed: delay time: 239781	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Thread delayed: delay time: 239616	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Thread delayed: delay time: 239500	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Thread delayed: delay time: 239351	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Thread delayed: delay time: 239234	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Thread delayed: delay time: 239125	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Thread delayed: delay time: 238996	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Window / User API: threadDelayed 763	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Window / User API: threadDelayed 616	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6678	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3008	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 9752	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 885	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Window / User API: threadDelayed 9830	Jump to behavior

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	API coverage: 1.7 %
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API coverage: 2.0 %

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe TID: 6432	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe TID: 6432	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe TID: 6432	Thread sleep time: -239890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe TID: 6432	Thread sleep time: -239781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe TID: 6432	Thread sleep time: -239616s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe TID: 6432	Thread sleep time: -239500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe TID: 6432	Thread sleep time: -239351s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe TID: 6432	Thread sleep time: -239234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe TID: 6432	Thread sleep time: -239125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe TID: 6432	Thread sleep time: -238996s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5940	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7136	Thread sleep count: 9752 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7136	Thread sleep time: -19504000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7136	Thread sleep count: 184 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7136	Thread sleep time: -368000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE TID: 5932	Thread sleep count: 140 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE TID: 5932	Thread sleep time: -280000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE TID: 5932	Thread sleep count: 9830 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE TID: 5932	Thread sleep time: -19660000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6576	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6576	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\SysWOW64\NETSTAT.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Last function: Thread delayed

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Thread delayed: delay time: 239890	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Thread delayed: delay time: 239781	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Thread delayed: delay time: 239616	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Thread delayed: delay time: 239500	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Thread delayed: delay time: 239351	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Thread delayed: delay time: 239234	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Thread delayed: delay time: 239125	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Thread delayed: delay time: 238996	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: explorer.exe, 00000005.00000002.3528137291.0000000008979000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2837116040.0000000008976000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2838856214.000000000897E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1069029871.0000000008975000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWD Loopback Controller
Source: explorer.exe, 00000005.00000000.1070233476.0000000008B61000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: _VMware_SATA_CD00#4&>
Source: explorer.exe, 00000005.00000000.1069029871.0000000008975000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000005.00000000.1058617487.0000000000C47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000k
Source: explorer.exe, 00000005.00000003.2837758655.0000000008BF1000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}?
Source: 4lHZn6Ri2B.exe, 00000000.00000002.1072190326.0000000007AA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}}
Source: 4lHZn6Ri2B.exe, 00000000.00000002.1072190326.0000000007AA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: explorer.exe, 00000005.00000002.3528137291.0000000008AA3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3528137291.0000000008AF4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2838337750.0000000008ADA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1069029871.0000000008AA3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2837116040.0000000008AF4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2837116040.0000000008AA3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1069029871.0000000008AF4000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2851920573.000001F5E0854000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000005.00000003.2835914008.0000000008CAB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000i\J
Source: explorer.exe, 00000005.00000002.3526128767.0000000007255000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTrpVMWare
Source: explorer.exe, 00000005.00000002.3529105767.0000000008C65000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: svchost.exe, 0000000A.00000002.2849436252.000001F5DB22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP}
Source: explorer.exe, 00000005.00000000.1058617487.0000000000C47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000005.00000003.2837758655.0000000008BF1000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.1059868006.0000000003020000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe

Code function: 4_2_00409AB0 rdtsc

4_2_00409AB0

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe

Code function: 4_2_0040ACF0 LdrLoadDll,

4_2_0040ACF0

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B8158 mov eax, dword ptr fs:[00000030h]	4_2_015B8158
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01526154 mov eax, dword ptr fs:[00000030h]	4_2_01526154
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01526154 mov eax, dword ptr fs:[00000030h]	4_2_01526154
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151C156 mov eax, dword ptr fs:[00000030h]	4_2_0151C156
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B4144 mov eax, dword ptr fs:[00000030h]	4_2_015B4144
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B4144 mov eax, dword ptr fs:[00000030h]	4_2_015B4144
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B4144 mov ecx, dword ptr fs:[00000030h]	4_2_015B4144
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B4144 mov eax, dword ptr fs:[00000030h]	4_2_015B4144
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B4144 mov eax, dword ptr fs:[00000030h]	4_2_015B4144
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CA118 mov ecx, dword ptr fs:[00000030h]	4_2_015CA118
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CA118 mov eax, dword ptr fs:[00000030h]	4_2_015CA118
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CA118 mov eax, dword ptr fs:[00000030h]	4_2_015CA118
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CA118 mov eax, dword ptr fs:[00000030h]	4_2_015CA118
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015E0115 mov eax, dword ptr fs:[00000030h]	4_2_015E0115
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CE10E mov eax, dword ptr fs:[00000030h]	4_2_015CE10E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CE10E mov ecx, dword ptr fs:[00000030h]	4_2_015CE10E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CE10E mov eax, dword ptr fs:[00000030h]	4_2_015CE10E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CE10E mov eax, dword ptr fs:[00000030h]	4_2_015CE10E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CE10E mov ecx, dword ptr fs:[00000030h]	4_2_015CE10E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CE10E mov eax, dword ptr fs:[00000030h]	4_2_015CE10E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CE10E mov eax, dword ptr fs:[00000030h]	4_2_015CE10E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CE10E mov ecx, dword ptr fs:[00000030h]	4_2_015CE10E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CE10E mov eax, dword ptr fs:[00000030h]	4_2_015CE10E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CE10E mov ecx, dword ptr fs:[00000030h]	4_2_015CE10E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01550124 mov eax, dword ptr fs:[00000030h]	4_2_01550124
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0159E1D0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0159E1D0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159E1D0 mov ecx, dword ptr fs:[00000030h]	4_2_0159E1D0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0159E1D0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0159E1D0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015E61C3 mov eax, dword ptr fs:[00000030h]	4_2_015E61C3
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015E61C3 mov eax, dword ptr fs:[00000030h]	4_2_015E61C3
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015501F8 mov eax, dword ptr fs:[00000030h]	4_2_015501F8
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015F61E5 mov eax, dword ptr fs:[00000030h]	4_2_015F61E5
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A019F mov eax, dword ptr fs:[00000030h]	4_2_015A019F
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A019F mov eax, dword ptr fs:[00000030h]	4_2_015A019F
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A019F mov eax, dword ptr fs:[00000030h]	4_2_015A019F
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A019F mov eax, dword ptr fs:[00000030h]	4_2_015A019F
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151A197 mov eax, dword ptr fs:[00000030h]	4_2_0151A197
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151A197 mov eax, dword ptr fs:[00000030h]	4_2_0151A197
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151A197 mov eax, dword ptr fs:[00000030h]	4_2_0151A197
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01560185 mov eax, dword ptr fs:[00000030h]	4_2_01560185
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015DC188 mov eax, dword ptr fs:[00000030h]	4_2_015DC188
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015DC188 mov eax, dword ptr fs:[00000030h]	4_2_015DC188
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C4180 mov eax, dword ptr fs:[00000030h]	4_2_015C4180
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C4180 mov eax, dword ptr fs:[00000030h]	4_2_015C4180
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01522050 mov eax, dword ptr fs:[00000030h]	4_2_01522050
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A6050 mov eax, dword ptr fs:[00000030h]	4_2_015A6050
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154C073 mov eax, dword ptr fs:[00000030h]	4_2_0154C073
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0153E016 mov eax, dword ptr fs:[00000030h]	4_2_0153E016
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0153E016 mov eax, dword ptr fs:[00000030h]	4_2_0153E016
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0153E016 mov eax, dword ptr fs:[00000030h]	4_2_0153E016
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0153E016 mov eax, dword ptr fs:[00000030h]	4_2_0153E016
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A4000 mov ecx, dword ptr fs:[00000030h]	4_2_015A4000
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C2000 mov eax, dword ptr fs:[00000030h]	4_2_015C2000
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C2000 mov eax, dword ptr fs:[00000030h]	4_2_015C2000
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C2000 mov eax, dword ptr fs:[00000030h]	4_2_015C2000
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C2000 mov eax, dword ptr fs:[00000030h]	4_2_015C2000
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C2000 mov eax, dword ptr fs:[00000030h]	4_2_015C2000
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C2000 mov eax, dword ptr fs:[00000030h]	4_2_015C2000
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C2000 mov eax, dword ptr fs:[00000030h]	4_2_015C2000
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C2000 mov eax, dword ptr fs:[00000030h]	4_2_015C2000
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B6030 mov eax, dword ptr fs:[00000030h]	4_2_015B6030
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151A020 mov eax, dword ptr fs:[00000030h]	4_2_0151A020
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151C020 mov eax, dword ptr fs:[00000030h]	4_2_0151C020
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A20DE mov eax, dword ptr fs:[00000030h]	4_2_015A20DE
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151C0F0 mov eax, dword ptr fs:[00000030h]	4_2_0151C0F0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015620F0 mov ecx, dword ptr fs:[00000030h]	4_2_015620F0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151A0E3 mov ecx, dword ptr fs:[00000030h]	4_2_0151A0E3
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A60E0 mov eax, dword ptr fs:[00000030h]	4_2_015A60E0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015280E9 mov eax, dword ptr fs:[00000030h]	4_2_015280E9
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152208A mov eax, dword ptr fs:[00000030h]	4_2_0152208A
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015E60B8 mov eax, dword ptr fs:[00000030h]	4_2_015E60B8
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015E60B8 mov ecx, dword ptr fs:[00000030h]	4_2_015E60B8
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B80A8 mov eax, dword ptr fs:[00000030h]	4_2_015B80A8
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A035C mov eax, dword ptr fs:[00000030h]	4_2_015A035C
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A035C mov eax, dword ptr fs:[00000030h]	4_2_015A035C
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A035C mov eax, dword ptr fs:[00000030h]	4_2_015A035C
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A035C mov ecx, dword ptr fs:[00000030h]	4_2_015A035C
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A035C mov eax, dword ptr fs:[00000030h]	4_2_015A035C
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A035C mov eax, dword ptr fs:[00000030h]	4_2_015A035C
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015EA352 mov eax, dword ptr fs:[00000030h]	4_2_015EA352
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C8350 mov ecx, dword ptr fs:[00000030h]	4_2_015C8350
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A2349 mov eax, dword ptr fs:[00000030h]	4_2_015A2349
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A2349 mov eax, dword ptr fs:[00000030h]	4_2_015A2349
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A2349 mov eax, dword ptr fs:[00000030h]	4_2_015A2349
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A2349 mov eax, dword ptr fs:[00000030h]	4_2_015A2349
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A2349 mov eax, dword ptr fs:[00000030h]	4_2_015A2349
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A2349 mov eax, dword ptr fs:[00000030h]	4_2_015A2349
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A2349 mov eax, dword ptr fs:[00000030h]	4_2_015A2349
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A2349 mov eax, dword ptr fs:[00000030h]	4_2_015A2349
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A2349 mov eax, dword ptr fs:[00000030h]	4_2_015A2349
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A2349 mov eax, dword ptr fs:[00000030h]	4_2_015A2349
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A2349 mov eax, dword ptr fs:[00000030h]	4_2_015A2349
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A2349 mov eax, dword ptr fs:[00000030h]	4_2_015A2349
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A2349 mov eax, dword ptr fs:[00000030h]	4_2_015A2349
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A2349 mov eax, dword ptr fs:[00000030h]	4_2_015A2349
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A2349 mov eax, dword ptr fs:[00000030h]	4_2_015A2349
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C437C mov eax, dword ptr fs:[00000030h]	4_2_015C437C
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151C310 mov ecx, dword ptr fs:[00000030h]	4_2_0151C310
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01540310 mov ecx, dword ptr fs:[00000030h]	4_2_01540310
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155A30B mov eax, dword ptr fs:[00000030h]	4_2_0155A30B
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155A30B mov eax, dword ptr fs:[00000030h]	4_2_0155A30B
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155A30B mov eax, dword ptr fs:[00000030h]	4_2_0155A30B
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CE3DB mov eax, dword ptr fs:[00000030h]	4_2_015CE3DB
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CE3DB mov eax, dword ptr fs:[00000030h]	4_2_015CE3DB
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CE3DB mov ecx, dword ptr fs:[00000030h]	4_2_015CE3DB
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CE3DB mov eax, dword ptr fs:[00000030h]	4_2_015CE3DB
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C43D4 mov eax, dword ptr fs:[00000030h]	4_2_015C43D4
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C43D4 mov eax, dword ptr fs:[00000030h]	4_2_015C43D4
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015DC3CD mov eax, dword ptr fs:[00000030h]	4_2_015DC3CD
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0152A3C0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0152A3C0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0152A3C0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0152A3C0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0152A3C0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0152A3C0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015283C0 mov eax, dword ptr fs:[00000030h]	4_2_015283C0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015283C0 mov eax, dword ptr fs:[00000030h]	4_2_015283C0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015283C0 mov eax, dword ptr fs:[00000030h]	4_2_015283C0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015283C0 mov eax, dword ptr fs:[00000030h]	4_2_015283C0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A63C0 mov eax, dword ptr fs:[00000030h]	4_2_015A63C0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0153E3F0 mov eax, dword ptr fs:[00000030h]	4_2_0153E3F0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0153E3F0 mov eax, dword ptr fs:[00000030h]	4_2_0153E3F0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0153E3F0 mov eax, dword ptr fs:[00000030h]	4_2_0153E3F0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015563FF mov eax, dword ptr fs:[00000030h]	4_2_015563FF
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015303E9 mov eax, dword ptr fs:[00000030h]	4_2_015303E9
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015303E9 mov eax, dword ptr fs:[00000030h]	4_2_015303E9
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015303E9 mov eax, dword ptr fs:[00000030h]	4_2_015303E9
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015303E9 mov eax, dword ptr fs:[00000030h]	4_2_015303E9
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015303E9 mov eax, dword ptr fs:[00000030h]	4_2_015303E9
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015303E9 mov eax, dword ptr fs:[00000030h]	4_2_015303E9
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015303E9 mov eax, dword ptr fs:[00000030h]	4_2_015303E9
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015303E9 mov eax, dword ptr fs:[00000030h]	4_2_015303E9
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01518397 mov eax, dword ptr fs:[00000030h]	4_2_01518397
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01518397 mov eax, dword ptr fs:[00000030h]	4_2_01518397
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01518397 mov eax, dword ptr fs:[00000030h]	4_2_01518397
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151E388 mov eax, dword ptr fs:[00000030h]	4_2_0151E388
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151E388 mov eax, dword ptr fs:[00000030h]	4_2_0151E388
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151E388 mov eax, dword ptr fs:[00000030h]	4_2_0151E388
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154438F mov eax, dword ptr fs:[00000030h]	4_2_0154438F
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154438F mov eax, dword ptr fs:[00000030h]	4_2_0154438F
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151A250 mov eax, dword ptr fs:[00000030h]	4_2_0151A250
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01526259 mov eax, dword ptr fs:[00000030h]	4_2_01526259
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015DA250 mov eax, dword ptr fs:[00000030h]	4_2_015DA250
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015DA250 mov eax, dword ptr fs:[00000030h]	4_2_015DA250
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A8243 mov eax, dword ptr fs:[00000030h]	4_2_015A8243
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A8243 mov ecx, dword ptr fs:[00000030h]	4_2_015A8243
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D0274 mov eax, dword ptr fs:[00000030h]	4_2_015D0274
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D0274 mov eax, dword ptr fs:[00000030h]	4_2_015D0274
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D0274 mov eax, dword ptr fs:[00000030h]	4_2_015D0274
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D0274 mov eax, dword ptr fs:[00000030h]	4_2_015D0274
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D0274 mov eax, dword ptr fs:[00000030h]	4_2_015D0274
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D0274 mov eax, dword ptr fs:[00000030h]	4_2_015D0274
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D0274 mov eax, dword ptr fs:[00000030h]	4_2_015D0274
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D0274 mov eax, dword ptr fs:[00000030h]	4_2_015D0274
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D0274 mov eax, dword ptr fs:[00000030h]	4_2_015D0274
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D0274 mov eax, dword ptr fs:[00000030h]	4_2_015D0274
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D0274 mov eax, dword ptr fs:[00000030h]	4_2_015D0274
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D0274 mov eax, dword ptr fs:[00000030h]	4_2_015D0274
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01524260 mov eax, dword ptr fs:[00000030h]	4_2_01524260
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01524260 mov eax, dword ptr fs:[00000030h]	4_2_01524260
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01524260 mov eax, dword ptr fs:[00000030h]	4_2_01524260
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151826B mov eax, dword ptr fs:[00000030h]	4_2_0151826B
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151823B mov eax, dword ptr fs:[00000030h]	4_2_0151823B
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0152A2C3
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0152A2C3
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0152A2C3
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0152A2C3
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0152A2C3
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015302E1 mov eax, dword ptr fs:[00000030h]	4_2_015302E1
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015302E1 mov eax, dword ptr fs:[00000030h]	4_2_015302E1
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015302E1 mov eax, dword ptr fs:[00000030h]	4_2_015302E1
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155E284 mov eax, dword ptr fs:[00000030h]	4_2_0155E284
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155E284 mov eax, dword ptr fs:[00000030h]	4_2_0155E284
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A0283 mov eax, dword ptr fs:[00000030h]	4_2_015A0283
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A0283 mov eax, dword ptr fs:[00000030h]	4_2_015A0283
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A0283 mov eax, dword ptr fs:[00000030h]	4_2_015A0283
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015302A0 mov eax, dword ptr fs:[00000030h]	4_2_015302A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015302A0 mov eax, dword ptr fs:[00000030h]	4_2_015302A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B62A0 mov eax, dword ptr fs:[00000030h]	4_2_015B62A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B62A0 mov ecx, dword ptr fs:[00000030h]	4_2_015B62A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B62A0 mov eax, dword ptr fs:[00000030h]	4_2_015B62A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B62A0 mov eax, dword ptr fs:[00000030h]	4_2_015B62A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B62A0 mov eax, dword ptr fs:[00000030h]	4_2_015B62A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B62A0 mov eax, dword ptr fs:[00000030h]	4_2_015B62A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01528550 mov eax, dword ptr fs:[00000030h]	4_2_01528550
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01528550 mov eax, dword ptr fs:[00000030h]	4_2_01528550
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155656A mov eax, dword ptr fs:[00000030h]	4_2_0155656A
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155656A mov eax, dword ptr fs:[00000030h]	4_2_0155656A
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155656A mov eax, dword ptr fs:[00000030h]	4_2_0155656A
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B6500 mov eax, dword ptr fs:[00000030h]	4_2_015B6500
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015F4500 mov eax, dword ptr fs:[00000030h]	4_2_015F4500
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015F4500 mov eax, dword ptr fs:[00000030h]	4_2_015F4500
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015F4500 mov eax, dword ptr fs:[00000030h]	4_2_015F4500
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015F4500 mov eax, dword ptr fs:[00000030h]	4_2_015F4500
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015F4500 mov eax, dword ptr fs:[00000030h]	4_2_015F4500
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015F4500 mov eax, dword ptr fs:[00000030h]	4_2_015F4500
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015F4500 mov eax, dword ptr fs:[00000030h]	4_2_015F4500
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530535 mov eax, dword ptr fs:[00000030h]	4_2_01530535
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530535 mov eax, dword ptr fs:[00000030h]	4_2_01530535
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530535 mov eax, dword ptr fs:[00000030h]	4_2_01530535
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530535 mov eax, dword ptr fs:[00000030h]	4_2_01530535
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530535 mov eax, dword ptr fs:[00000030h]	4_2_01530535
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530535 mov eax, dword ptr fs:[00000030h]	4_2_01530535
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154E53E mov eax, dword ptr fs:[00000030h]	4_2_0154E53E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154E53E mov eax, dword ptr fs:[00000030h]	4_2_0154E53E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154E53E mov eax, dword ptr fs:[00000030h]	4_2_0154E53E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154E53E mov eax, dword ptr fs:[00000030h]	4_2_0154E53E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154E53E mov eax, dword ptr fs:[00000030h]	4_2_0154E53E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015265D0 mov eax, dword ptr fs:[00000030h]	4_2_015265D0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155A5D0 mov eax, dword ptr fs:[00000030h]	4_2_0155A5D0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155A5D0 mov eax, dword ptr fs:[00000030h]	4_2_0155A5D0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155E5CF mov eax, dword ptr fs:[00000030h]	4_2_0155E5CF
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155E5CF mov eax, dword ptr fs:[00000030h]	4_2_0155E5CF
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015225E0 mov eax, dword ptr fs:[00000030h]	4_2_015225E0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0154E5E7
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0154E5E7
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0154E5E7
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0154E5E7
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0154E5E7
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0154E5E7
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0154E5E7
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0154E5E7
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155C5ED mov eax, dword ptr fs:[00000030h]	4_2_0155C5ED
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155C5ED mov eax, dword ptr fs:[00000030h]	4_2_0155C5ED
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155E59C mov eax, dword ptr fs:[00000030h]	4_2_0155E59C
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01522582 mov eax, dword ptr fs:[00000030h]	4_2_01522582
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01522582 mov ecx, dword ptr fs:[00000030h]	4_2_01522582
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01554588 mov eax, dword ptr fs:[00000030h]	4_2_01554588
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015445B1 mov eax, dword ptr fs:[00000030h]	4_2_015445B1
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015445B1 mov eax, dword ptr fs:[00000030h]	4_2_015445B1
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A05A7 mov eax, dword ptr fs:[00000030h]	4_2_015A05A7
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A05A7 mov eax, dword ptr fs:[00000030h]	4_2_015A05A7
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A05A7 mov eax, dword ptr fs:[00000030h]	4_2_015A05A7
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015DA456 mov eax, dword ptr fs:[00000030h]	4_2_015DA456
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151645D mov eax, dword ptr fs:[00000030h]	4_2_0151645D
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154245A mov eax, dword ptr fs:[00000030h]	4_2_0154245A
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155E443 mov eax, dword ptr fs:[00000030h]	4_2_0155E443
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155E443 mov eax, dword ptr fs:[00000030h]	4_2_0155E443
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155E443 mov eax, dword ptr fs:[00000030h]	4_2_0155E443
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155E443 mov eax, dword ptr fs:[00000030h]	4_2_0155E443
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155E443 mov eax, dword ptr fs:[00000030h]	4_2_0155E443
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155E443 mov eax, dword ptr fs:[00000030h]	4_2_0155E443
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155E443 mov eax, dword ptr fs:[00000030h]	4_2_0155E443
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155E443 mov eax, dword ptr fs:[00000030h]	4_2_0155E443
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154A470 mov eax, dword ptr fs:[00000030h]	4_2_0154A470
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154A470 mov eax, dword ptr fs:[00000030h]	4_2_0154A470
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154A470 mov eax, dword ptr fs:[00000030h]	4_2_0154A470
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015AC460 mov ecx, dword ptr fs:[00000030h]	4_2_015AC460
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01558402 mov eax, dword ptr fs:[00000030h]	4_2_01558402
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01558402 mov eax, dword ptr fs:[00000030h]	4_2_01558402
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01558402 mov eax, dword ptr fs:[00000030h]	4_2_01558402
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155A430 mov eax, dword ptr fs:[00000030h]	4_2_0155A430
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151E420 mov eax, dword ptr fs:[00000030h]	4_2_0151E420
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151E420 mov eax, dword ptr fs:[00000030h]	4_2_0151E420
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151E420 mov eax, dword ptr fs:[00000030h]	4_2_0151E420
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151C427 mov eax, dword ptr fs:[00000030h]	4_2_0151C427
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A6420 mov eax, dword ptr fs:[00000030h]	4_2_015A6420
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A6420 mov eax, dword ptr fs:[00000030h]	4_2_015A6420
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A6420 mov eax, dword ptr fs:[00000030h]	4_2_015A6420
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A6420 mov eax, dword ptr fs:[00000030h]	4_2_015A6420
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A6420 mov eax, dword ptr fs:[00000030h]	4_2_015A6420
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A6420 mov eax, dword ptr fs:[00000030h]	4_2_015A6420
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A6420 mov eax, dword ptr fs:[00000030h]	4_2_015A6420
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015204E5 mov ecx, dword ptr fs:[00000030h]	4_2_015204E5
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015DA49A mov eax, dword ptr fs:[00000030h]	4_2_015DA49A
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015544B0 mov ecx, dword ptr fs:[00000030h]	4_2_015544B0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015AA4B0 mov eax, dword ptr fs:[00000030h]	4_2_015AA4B0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015264AB mov eax, dword ptr fs:[00000030h]	4_2_015264AB
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01520750 mov eax, dword ptr fs:[00000030h]	4_2_01520750
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562750 mov eax, dword ptr fs:[00000030h]	4_2_01562750
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562750 mov eax, dword ptr fs:[00000030h]	4_2_01562750
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015AE75D mov eax, dword ptr fs:[00000030h]	4_2_015AE75D
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A4755 mov eax, dword ptr fs:[00000030h]	4_2_015A4755
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155674D mov esi, dword ptr fs:[00000030h]	4_2_0155674D
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155674D mov eax, dword ptr fs:[00000030h]	4_2_0155674D
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155674D mov eax, dword ptr fs:[00000030h]	4_2_0155674D
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01528770 mov eax, dword ptr fs:[00000030h]	4_2_01528770
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530770 mov eax, dword ptr fs:[00000030h]	4_2_01530770
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530770 mov eax, dword ptr fs:[00000030h]	4_2_01530770
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530770 mov eax, dword ptr fs:[00000030h]	4_2_01530770
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530770 mov eax, dword ptr fs:[00000030h]	4_2_01530770
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530770 mov eax, dword ptr fs:[00000030h]	4_2_01530770
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530770 mov eax, dword ptr fs:[00000030h]	4_2_01530770
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530770 mov eax, dword ptr fs:[00000030h]	4_2_01530770
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530770 mov eax, dword ptr fs:[00000030h]	4_2_01530770
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530770 mov eax, dword ptr fs:[00000030h]	4_2_01530770
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530770 mov eax, dword ptr fs:[00000030h]	4_2_01530770
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530770 mov eax, dword ptr fs:[00000030h]	4_2_01530770
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530770 mov eax, dword ptr fs:[00000030h]	4_2_01530770
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01520710 mov eax, dword ptr fs:[00000030h]	4_2_01520710
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01550710 mov eax, dword ptr fs:[00000030h]	4_2_01550710
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155C700 mov eax, dword ptr fs:[00000030h]	4_2_0155C700
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155273C mov eax, dword ptr fs:[00000030h]	4_2_0155273C
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155273C mov ecx, dword ptr fs:[00000030h]	4_2_0155273C
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155273C mov eax, dword ptr fs:[00000030h]	4_2_0155273C
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159C730 mov eax, dword ptr fs:[00000030h]	4_2_0159C730
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155C720 mov eax, dword ptr fs:[00000030h]	4_2_0155C720
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155C720 mov eax, dword ptr fs:[00000030h]	4_2_0155C720
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152C7C0 mov eax, dword ptr fs:[00000030h]	4_2_0152C7C0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A07C3 mov eax, dword ptr fs:[00000030h]	4_2_015A07C3
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015247FB mov eax, dword ptr fs:[00000030h]	4_2_015247FB
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015247FB mov eax, dword ptr fs:[00000030h]	4_2_015247FB
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015427ED mov eax, dword ptr fs:[00000030h]	4_2_015427ED
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015427ED mov eax, dword ptr fs:[00000030h]	4_2_015427ED
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015427ED mov eax, dword ptr fs:[00000030h]	4_2_015427ED
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015AE7E1 mov eax, dword ptr fs:[00000030h]	4_2_015AE7E1
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C678E mov eax, dword ptr fs:[00000030h]	4_2_015C678E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015207AF mov eax, dword ptr fs:[00000030h]	4_2_015207AF
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D47A0 mov eax, dword ptr fs:[00000030h]	4_2_015D47A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0153C640 mov eax, dword ptr fs:[00000030h]	4_2_0153C640
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01552674 mov eax, dword ptr fs:[00000030h]	4_2_01552674
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015E866E mov eax, dword ptr fs:[00000030h]	4_2_015E866E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015E866E mov eax, dword ptr fs:[00000030h]	4_2_015E866E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155A660 mov eax, dword ptr fs:[00000030h]	4_2_0155A660
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155A660 mov eax, dword ptr fs:[00000030h]	4_2_0155A660
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01562619 mov eax, dword ptr fs:[00000030h]	4_2_01562619
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159E609 mov eax, dword ptr fs:[00000030h]	4_2_0159E609
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0153260B mov eax, dword ptr fs:[00000030h]	4_2_0153260B
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0153260B mov eax, dword ptr fs:[00000030h]	4_2_0153260B
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0153260B mov eax, dword ptr fs:[00000030h]	4_2_0153260B
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0153260B mov eax, dword ptr fs:[00000030h]	4_2_0153260B
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0153260B mov eax, dword ptr fs:[00000030h]	4_2_0153260B
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0153260B mov eax, dword ptr fs:[00000030h]	4_2_0153260B
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0153260B mov eax, dword ptr fs:[00000030h]	4_2_0153260B
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0153E627 mov eax, dword ptr fs:[00000030h]	4_2_0153E627
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01556620 mov eax, dword ptr fs:[00000030h]	4_2_01556620
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01558620 mov eax, dword ptr fs:[00000030h]	4_2_01558620
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152262C mov eax, dword ptr fs:[00000030h]	4_2_0152262C
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155A6C7 mov ebx, dword ptr fs:[00000030h]	4_2_0155A6C7
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155A6C7 mov eax, dword ptr fs:[00000030h]	4_2_0155A6C7
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0159E6F2
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0159E6F2
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0159E6F2
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0159E6F2
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A06F1 mov eax, dword ptr fs:[00000030h]	4_2_015A06F1
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A06F1 mov eax, dword ptr fs:[00000030h]	4_2_015A06F1
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01524690 mov eax, dword ptr fs:[00000030h]	4_2_01524690
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01524690 mov eax, dword ptr fs:[00000030h]	4_2_01524690
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015566B0 mov eax, dword ptr fs:[00000030h]	4_2_015566B0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155C6A6 mov eax, dword ptr fs:[00000030h]	4_2_0155C6A6
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A0946 mov eax, dword ptr fs:[00000030h]	4_2_015A0946
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C4978 mov eax, dword ptr fs:[00000030h]	4_2_015C4978
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C4978 mov eax, dword ptr fs:[00000030h]	4_2_015C4978
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015AC97C mov eax, dword ptr fs:[00000030h]	4_2_015AC97C
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01546962 mov eax, dword ptr fs:[00000030h]	4_2_01546962
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01546962 mov eax, dword ptr fs:[00000030h]	4_2_01546962
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01546962 mov eax, dword ptr fs:[00000030h]	4_2_01546962
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0156096E mov eax, dword ptr fs:[00000030h]	4_2_0156096E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0156096E mov edx, dword ptr fs:[00000030h]	4_2_0156096E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0156096E mov eax, dword ptr fs:[00000030h]	4_2_0156096E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015AC912 mov eax, dword ptr fs:[00000030h]	4_2_015AC912
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01518918 mov eax, dword ptr fs:[00000030h]	4_2_01518918
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01518918 mov eax, dword ptr fs:[00000030h]	4_2_01518918
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159E908 mov eax, dword ptr fs:[00000030h]	4_2_0159E908
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159E908 mov eax, dword ptr fs:[00000030h]	4_2_0159E908
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A892A mov eax, dword ptr fs:[00000030h]	4_2_015A892A
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B892B mov eax, dword ptr fs:[00000030h]	4_2_015B892B
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0152A9D0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0152A9D0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0152A9D0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0152A9D0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0152A9D0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0152A9D0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015549D0 mov eax, dword ptr fs:[00000030h]	4_2_015549D0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015EA9D3 mov eax, dword ptr fs:[00000030h]	4_2_015EA9D3
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B69C0 mov eax, dword ptr fs:[00000030h]	4_2_015B69C0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015529F9 mov eax, dword ptr fs:[00000030h]	4_2_015529F9
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015529F9 mov eax, dword ptr fs:[00000030h]	4_2_015529F9
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015AE9E0 mov eax, dword ptr fs:[00000030h]	4_2_015AE9E0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A89B3 mov esi, dword ptr fs:[00000030h]	4_2_015A89B3
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A89B3 mov eax, dword ptr fs:[00000030h]	4_2_015A89B3
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015A89B3 mov eax, dword ptr fs:[00000030h]	4_2_015A89B3
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015329A0 mov eax, dword ptr fs:[00000030h]	4_2_015329A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015329A0 mov eax, dword ptr fs:[00000030h]	4_2_015329A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015329A0 mov eax, dword ptr fs:[00000030h]	4_2_015329A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015329A0 mov eax, dword ptr fs:[00000030h]	4_2_015329A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015329A0 mov eax, dword ptr fs:[00000030h]	4_2_015329A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015329A0 mov eax, dword ptr fs:[00000030h]	4_2_015329A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015329A0 mov eax, dword ptr fs:[00000030h]	4_2_015329A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015329A0 mov eax, dword ptr fs:[00000030h]	4_2_015329A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015329A0 mov eax, dword ptr fs:[00000030h]	4_2_015329A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015329A0 mov eax, dword ptr fs:[00000030h]	4_2_015329A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015329A0 mov eax, dword ptr fs:[00000030h]	4_2_015329A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015329A0 mov eax, dword ptr fs:[00000030h]	4_2_015329A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015329A0 mov eax, dword ptr fs:[00000030h]	4_2_015329A0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015209AD mov eax, dword ptr fs:[00000030h]	4_2_015209AD
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015209AD mov eax, dword ptr fs:[00000030h]	4_2_015209AD
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01550854 mov eax, dword ptr fs:[00000030h]	4_2_01550854
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01524859 mov eax, dword ptr fs:[00000030h]	4_2_01524859
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01524859 mov eax, dword ptr fs:[00000030h]	4_2_01524859
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01532840 mov ecx, dword ptr fs:[00000030h]	4_2_01532840
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015AE872 mov eax, dword ptr fs:[00000030h]	4_2_015AE872
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015AE872 mov eax, dword ptr fs:[00000030h]	4_2_015AE872
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B6870 mov eax, dword ptr fs:[00000030h]	4_2_015B6870
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B6870 mov eax, dword ptr fs:[00000030h]	4_2_015B6870
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015AC810 mov eax, dword ptr fs:[00000030h]	4_2_015AC810
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01542835 mov eax, dword ptr fs:[00000030h]	4_2_01542835
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01542835 mov eax, dword ptr fs:[00000030h]	4_2_01542835
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01542835 mov eax, dword ptr fs:[00000030h]	4_2_01542835
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01542835 mov ecx, dword ptr fs:[00000030h]	4_2_01542835
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01542835 mov eax, dword ptr fs:[00000030h]	4_2_01542835
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01542835 mov eax, dword ptr fs:[00000030h]	4_2_01542835
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155A830 mov eax, dword ptr fs:[00000030h]	4_2_0155A830
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C483A mov eax, dword ptr fs:[00000030h]	4_2_015C483A
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C483A mov eax, dword ptr fs:[00000030h]	4_2_015C483A
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154E8C0 mov eax, dword ptr fs:[00000030h]	4_2_0154E8C0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155C8F9 mov eax, dword ptr fs:[00000030h]	4_2_0155C8F9
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155C8F9 mov eax, dword ptr fs:[00000030h]	4_2_0155C8F9
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015EA8E4 mov eax, dword ptr fs:[00000030h]	4_2_015EA8E4
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015AC89D mov eax, dword ptr fs:[00000030h]	4_2_015AC89D
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01520887 mov eax, dword ptr fs:[00000030h]	4_2_01520887
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CEB50 mov eax, dword ptr fs:[00000030h]	4_2_015CEB50
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D4B4B mov eax, dword ptr fs:[00000030h]	4_2_015D4B4B
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D4B4B mov eax, dword ptr fs:[00000030h]	4_2_015D4B4B
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B6B40 mov eax, dword ptr fs:[00000030h]	4_2_015B6B40
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015B6B40 mov eax, dword ptr fs:[00000030h]	4_2_015B6B40
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015EAB40 mov eax, dword ptr fs:[00000030h]	4_2_015EAB40
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015C8B42 mov eax, dword ptr fs:[00000030h]	4_2_015C8B42
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0151CB7E mov eax, dword ptr fs:[00000030h]	4_2_0151CB7E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159EB1D mov eax, dword ptr fs:[00000030h]	4_2_0159EB1D
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159EB1D mov eax, dword ptr fs:[00000030h]	4_2_0159EB1D
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159EB1D mov eax, dword ptr fs:[00000030h]	4_2_0159EB1D
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159EB1D mov eax, dword ptr fs:[00000030h]	4_2_0159EB1D
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159EB1D mov eax, dword ptr fs:[00000030h]	4_2_0159EB1D
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159EB1D mov eax, dword ptr fs:[00000030h]	4_2_0159EB1D
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159EB1D mov eax, dword ptr fs:[00000030h]	4_2_0159EB1D
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159EB1D mov eax, dword ptr fs:[00000030h]	4_2_0159EB1D
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159EB1D mov eax, dword ptr fs:[00000030h]	4_2_0159EB1D
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154EB20 mov eax, dword ptr fs:[00000030h]	4_2_0154EB20
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154EB20 mov eax, dword ptr fs:[00000030h]	4_2_0154EB20
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015E8B28 mov eax, dword ptr fs:[00000030h]	4_2_015E8B28
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015E8B28 mov eax, dword ptr fs:[00000030h]	4_2_015E8B28
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CEBD0 mov eax, dword ptr fs:[00000030h]	4_2_015CEBD0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01540BCB mov eax, dword ptr fs:[00000030h]	4_2_01540BCB
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01540BCB mov eax, dword ptr fs:[00000030h]	4_2_01540BCB
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01540BCB mov eax, dword ptr fs:[00000030h]	4_2_01540BCB
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01520BCD mov eax, dword ptr fs:[00000030h]	4_2_01520BCD
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01520BCD mov eax, dword ptr fs:[00000030h]	4_2_01520BCD
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01520BCD mov eax, dword ptr fs:[00000030h]	4_2_01520BCD
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01528BF0 mov eax, dword ptr fs:[00000030h]	4_2_01528BF0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01528BF0 mov eax, dword ptr fs:[00000030h]	4_2_01528BF0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01528BF0 mov eax, dword ptr fs:[00000030h]	4_2_01528BF0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154EBFC mov eax, dword ptr fs:[00000030h]	4_2_0154EBFC
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015ACBF0 mov eax, dword ptr fs:[00000030h]	4_2_015ACBF0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530BBE mov eax, dword ptr fs:[00000030h]	4_2_01530BBE
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530BBE mov eax, dword ptr fs:[00000030h]	4_2_01530BBE
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D4BB0 mov eax, dword ptr fs:[00000030h]	4_2_015D4BB0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015D4BB0 mov eax, dword ptr fs:[00000030h]	4_2_015D4BB0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01526A50 mov eax, dword ptr fs:[00000030h]	4_2_01526A50
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01526A50 mov eax, dword ptr fs:[00000030h]	4_2_01526A50
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01526A50 mov eax, dword ptr fs:[00000030h]	4_2_01526A50
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01526A50 mov eax, dword ptr fs:[00000030h]	4_2_01526A50
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01526A50 mov eax, dword ptr fs:[00000030h]	4_2_01526A50
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01526A50 mov eax, dword ptr fs:[00000030h]	4_2_01526A50
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01526A50 mov eax, dword ptr fs:[00000030h]	4_2_01526A50
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530A5B mov eax, dword ptr fs:[00000030h]	4_2_01530A5B
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01530A5B mov eax, dword ptr fs:[00000030h]	4_2_01530A5B
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159CA72 mov eax, dword ptr fs:[00000030h]	4_2_0159CA72
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0159CA72 mov eax, dword ptr fs:[00000030h]	4_2_0159CA72
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155CA6F mov eax, dword ptr fs:[00000030h]	4_2_0155CA6F
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155CA6F mov eax, dword ptr fs:[00000030h]	4_2_0155CA6F
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155CA6F mov eax, dword ptr fs:[00000030h]	4_2_0155CA6F
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015CEA60 mov eax, dword ptr fs:[00000030h]	4_2_015CEA60
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015ACA11 mov eax, dword ptr fs:[00000030h]	4_2_015ACA11
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01544A35 mov eax, dword ptr fs:[00000030h]	4_2_01544A35
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01544A35 mov eax, dword ptr fs:[00000030h]	4_2_01544A35
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155CA38 mov eax, dword ptr fs:[00000030h]	4_2_0155CA38
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155CA24 mov eax, dword ptr fs:[00000030h]	4_2_0155CA24
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0154EA2E mov eax, dword ptr fs:[00000030h]	4_2_0154EA2E
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01520AD0 mov eax, dword ptr fs:[00000030h]	4_2_01520AD0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01554AD0 mov eax, dword ptr fs:[00000030h]	4_2_01554AD0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01554AD0 mov eax, dword ptr fs:[00000030h]	4_2_01554AD0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01576ACC mov eax, dword ptr fs:[00000030h]	4_2_01576ACC
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01576ACC mov eax, dword ptr fs:[00000030h]	4_2_01576ACC
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01576ACC mov eax, dword ptr fs:[00000030h]	4_2_01576ACC
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155AAEE mov eax, dword ptr fs:[00000030h]	4_2_0155AAEE
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0155AAEE mov eax, dword ptr fs:[00000030h]	4_2_0155AAEE
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01558A90 mov edx, dword ptr fs:[00000030h]	4_2_01558A90
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152EA80 mov eax, dword ptr fs:[00000030h]	4_2_0152EA80
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152EA80 mov eax, dword ptr fs:[00000030h]	4_2_0152EA80
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152EA80 mov eax, dword ptr fs:[00000030h]	4_2_0152EA80
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152EA80 mov eax, dword ptr fs:[00000030h]	4_2_0152EA80
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152EA80 mov eax, dword ptr fs:[00000030h]	4_2_0152EA80
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152EA80 mov eax, dword ptr fs:[00000030h]	4_2_0152EA80
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152EA80 mov eax, dword ptr fs:[00000030h]	4_2_0152EA80
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152EA80 mov eax, dword ptr fs:[00000030h]	4_2_0152EA80
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_0152EA80 mov eax, dword ptr fs:[00000030h]	4_2_0152EA80
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_015F4A80 mov eax, dword ptr fs:[00000030h]	4_2_015F4A80
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01528AA0 mov eax, dword ptr fs:[00000030h]	4_2_01528AA0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01528AA0 mov eax, dword ptr fs:[00000030h]	4_2_01528AA0
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01576AA4 mov eax, dword ptr fs:[00000030h]	4_2_01576AA4
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01520D59 mov eax, dword ptr fs:[00000030h]	4_2_01520D59
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01520D59 mov eax, dword ptr fs:[00000030h]	4_2_01520D59
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01520D59 mov eax, dword ptr fs:[00000030h]	4_2_01520D59
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01528D59 mov eax, dword ptr fs:[00000030h]	4_2_01528D59
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01528D59 mov eax, dword ptr fs:[00000030h]	4_2_01528D59
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01528D59 mov eax, dword ptr fs:[00000030h]	4_2_01528D59
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Code function: 4_2_01528D59 mov eax, dword ptr fs:[00000030h]	4_2_01528D59

Source: C:\Windows\SysWOW64\NETSTAT.EXE

Code function: 7_2_004F2167 GetProcessHeap,htons,htons,InternalGetTcpTableWithOwnerModule,htons,htons,InternalGetTcpTable2,htons,htons,HeapFree,InternalGetBoundTcpEndpointTable,htons,htons,HeapFree,htons,htons,InternalGetTcp6TableWithOwnerModule,htons,htons,InternalGetTcp6Table2,htons,htons,HeapFree,InternalGetBoundTcp6EndpointTable,htons,htons,HeapFree,InternalGetUdpTableWithOwnerModule,htons,HeapFree,InternalGetUdp6TableWithOwnerModule,htons,HeapFree,

7_2_004F2167

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004F5DC0 SetUnhandledExceptionFilter,		7_2_004F5DC0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 7_2_004F5C30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		7_2_004F5C30

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\4lHZn6Ri2B.exe"
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\4lHZn6Ri2B.exe"			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	NtClose: Indirect: 0x14BA56C
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	NtQueueApcThread: Indirect: 0x14BA4F2			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe

Memory written: C:\Users\user\Desktop\4lHZn6Ri2B.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: NULL target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Section loaded: NULL target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Thread register set: target process: 2528			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Thread register set: target process: 2528			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe

Section unmapped: C:\Windows\SysWOW64\NETSTAT.EXE base address: 4F0000

Jump to behavior

Source: C:\Windows\SysWOW64\NETSTAT.EXE

Code function: memset,OpenProcess,K32GetModuleBaseNameW,CompareStringW,CompareStringW,GetSystemDirectoryW,LoadLibraryExW,GetProcAddress,K32GetModuleBaseNameW,CloseHandle,LocalFree,FreeLibrary, svchost.exe

7_2_004F38D2

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\4lHZn6Ri2B.exe"	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Process created: C:\Users\user\Desktop\4lHZn6Ri2B.exe "C:\Users\user\Desktop\4lHZn6Ri2B.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\4lHZn6Ri2B.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\NETSTAT.EXE

Code function: 7_2_004F58B6 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

7_2_004F58B6

Source: explorer.exe, 00000005.00000000.1062521266.00000000045E0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3521645519.00000000011B0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1058975280.00000000011B1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000002.3521645519.00000000011B0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1058975280.00000000011B1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000002.3521645519.00000000011B0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1058975280.00000000011B1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: ?Program Manager
Source: explorer.exe, 00000005.00000000.1058617487.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3520878054.0000000000C20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman
Source: explorer.exe, 00000005.00000002.3521645519.00000000011B0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1058975280.00000000011B1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000000.1070233476.0000000008CAB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3529105767.0000000008CAB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2835914008.0000000008CAB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndQE

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Queries volume information: C:\Users\user\Desktop\4lHZn6Ri2B.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: unknown VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\NETSTAT.EXE

Code function: 7_2_004F5FE5 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

7_2_004F5FE5

Source: C:\Users\user\Desktop\4lHZn6Ri2B.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 4.2.4lHZn6Ri2B.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.4lHZn6Ri2B.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3520154106.00000000004B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3521233716.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1066684814.00000000042C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1121066600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3521121426.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1066684814.0000000004B8E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 4.2.4lHZn6Ri2B.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.4lHZn6Ri2B.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4lHZn6Ri2B.exe.4ddec10.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4lHZn6Ri2B.exe.4d6bff0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3520154106.00000000004B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3521233716.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1066684814.00000000042C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1121066600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3521121426.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1066684814.0000000004B8E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\NETSTAT.EXE

Code function: 7_2_004F4B96 fprintf,GetUdpStatisticsEx,GetIpStatisticsEx,SnmpUtilMemAlloc,fprintf,fprintf,SnmpUtilMemFree,fprintf,fprintf,SnmpUtilMemAlloc,SnmpUtilOidCpy,SnmpUtilVarBindFree,SnmpUtilVarBindFree,SnmpUtilVarBindFree,SnmpUtilVarBindFree,GetIcmpStatisticsEx,GetTcpStatisticsEx,

7_2_004F4B96

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Shared Modules	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	522 Process Injection	11 Disable or Modify Tools	LSASS Memory	241 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Abuse Elevation Control Mechanism	51 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Access Token Manipulation	NTDS	51 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	522 Process Injection	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Abuse Elevation Control Mechanism	DCSync	1 System Network Connections Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	3 Obfuscated Files or Information	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Software Packing	/etc/passwd and /etc/shadow	223 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Timestomp	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 DLL Side-Loading	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4lHZn6Ri2B.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: FormBook

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
4lHZn6Ri2B.exe