Analysis Report Novi poredak.exe

AV Detection:

Multi AV Scanner detection for submitted file

Source: Novi poredak.exe	Virustotal: Detection: 55%			Perma Link
Source: Novi poredak.exe	ReversingLabs: Detection: 60%

Yara detected FormBook

Source: Yara match	File source: 0000000B.00000002.359869128.0000000004CA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.481396669.0000000000670000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.484546978.0000000002D80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.360930357.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.359837993.0000000004C70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 11.2.ieinstal.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.ieinstal.exe.10410000.3.unpack, type: UNPACKEDPE

Antivirus or Machine Learning detection for unpacked file

Source: 11.2.ieinstal.exe.10410000.3.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 4x nop then pop ebx		11_2_10417AD0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 4x nop then pop edi		11_2_1041E58F
Source: C:\Windows\SysWOW64\control.exe	Code function: 4x nop then pop ebx		16_2_02D87AD0
Source: C:\Windows\SysWOW64\control.exe	Code function: 4x nop then pop edi		16_2_02D8E58F
Source: C:\Windows\SysWOW64\control.exe	Code function: 4x nop then pop edi		16_2_02D96D61

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 162.159.137.232 162.159.137.232
Source: Joe Sandbox View	IP Address: 162.159.135.233 162.159.135.233

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: ce5f3254611a8c095a3d821d44539877

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: discord.com

Urls found in memory or binary data

Source: Novi poredak.exe	String found in binary or memory: Http://gorohov.narod.ru
Source: explorer.exe, 0000000C.00000000.343740110.000000000F640000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: control.exe, 00000010.00000002.482857570.00000000007CA000.00000004.00000001.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: control.exe, 00000010.00000002.482857570.00000000007CA000.00000004.00000001.sdmp	String found in binary or memory: http://www.msn.com/?ocid=iehp
Source: control.exe, 00000010.00000002.482857570.00000000007CA000.00000004.00000001.sdmp	String found in binary or memory: http://www.msn.com/?ocid=iehp3n
Source: control.exe, 00000010.00000002.482857570.00000000007CA000.00000004.00000001.sdmp	String found in binary or memory: http://www.msn.com/de-ch/?ocid=iehp
Source: control.exe, 00000010.00000002.482857570.00000000007CA000.00000004.00000001.sdmp	String found in binary or memory: http://www.msn.com/de-ch/?ocid=iehpLMEMh
Source: control.exe, 00000010.00000002.482857570.00000000007CA000.00000004.00000001.sdmp	String found in binary or memory: http://www.msn.com/de-ch/ocid=iehp
Source: control.exe, 00000010.00000002.482857570.00000000007CA000.00000004.00000001.sdmp	String found in binary or memory: http://www.msn.com/ocid=iehp
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 0000000C.00000000.338826970.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: control.exe, 00000010.00000002.482857570.00000000007CA000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/chrome/
Source: control.exe, 00000010.00000002.482857570.00000000007CA000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/chrome/:n
Source: control.exe, 00000010.00000002.482857570.00000000007CA000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.png
Source: control.exe, 00000010.00000002.482857570.00000000007CA000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.pngdIdg
Source: control.exe, 00000010.00000002.482857570.00000000007CA000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/chrome/thank-you.htmlstatcb=0&installdataindex=empty&defaultbrowser=0s

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 0000000B.00000002.359869128.0000000004CA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.481396669.0000000000670000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.484546978.0000000002D80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.360930357.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.359837993.0000000004C70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 11.2.ieinstal.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.ieinstal.exe.10410000.3.unpack, type: UNPACKEDPE

System Summary:

Detected FormBook malware

Source: C:\Windows\SysWOW64\control.exe	Dropped file: C:\Users\user\AppData\Roaming\8LO8PUBW\8LOlogri.ini			Jump to dropped file
Source: C:\Windows\SysWOW64\control.exe	Dropped file: C:\Users\user\AppData\Roaming\8LO8PUBW\8LOlogrv.ini			Jump to dropped file

Malicious sample detected (through community Yara rule)

Source: 0000000B.00000002.359869128.0000000004CA0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.359869128.0000000004CA0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.481396669.0000000000670000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.481396669.0000000000670000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.484546978.0000000002D80000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.484546978.0000000002D80000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.360930357.0000000010410000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.360930357.0000000010410000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.359837993.0000000004C70000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.359837993.0000000004C70000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 11.2.ieinstal.exe.10410000.3.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 11.2.ieinstal.exe.10410000.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 11.2.ieinstal.exe.10410000.3.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 11.2.ieinstal.exe.10410000.3.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Contains functionality to call native functions

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F195D0 NtClose,LdrInitializeThunk,		11_2_04F195D0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19540 NtReadFile,LdrInitializeThunk,		11_2_04F19540
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F196E0 NtFreeVirtualMemory,LdrInitializeThunk,		11_2_04F196E0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19660 NtAllocateVirtualMemory,LdrInitializeThunk,		11_2_04F19660
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F197A0 NtUnmapViewOfSection,LdrInitializeThunk,		11_2_04F197A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19780 NtMapViewOfSection,LdrInitializeThunk,		11_2_04F19780
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19710 NtQueryInformationToken,LdrInitializeThunk,		11_2_04F19710
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F198F0 NtReadVirtualMemory,LdrInitializeThunk,		11_2_04F198F0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19860 NtQuerySystemInformation,LdrInitializeThunk,		11_2_04F19860
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19840 NtDelayExecution,LdrInitializeThunk,		11_2_04F19840
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F199A0 NtCreateSection,LdrInitializeThunk,		11_2_04F199A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19910 NtAdjustPrivilegesToken,LdrInitializeThunk,		11_2_04F19910
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19A50 NtCreateFile,LdrInitializeThunk,		11_2_04F19A50
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19A20 NtResumeThread,LdrInitializeThunk,		11_2_04F19A20
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19A00 NtProtectVirtualMemory,LdrInitializeThunk,		11_2_04F19A00
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F195F0 NtQueryInformationFile,		11_2_04F195F0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19560 NtWriteFile,		11_2_04F19560
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F1AD30 NtSetContextThread,		11_2_04F1AD30
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19520 NtWaitForSingleObject,		11_2_04F19520
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F196D0 NtCreateKey,		11_2_04F196D0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19670 NtQueryInformationProcess,		11_2_04F19670
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19650 NtQueryValueKey,		11_2_04F19650
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19610 NtEnumerateValueKey,		11_2_04F19610
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19FE0 NtCreateMutant,		11_2_04F19FE0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F1A770 NtOpenThread,		11_2_04F1A770
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19770 NtSetInformationFile,		11_2_04F19770
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19760 NtOpenProcess,		11_2_04F19760
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19730 NtQueryVirtualMemory,		11_2_04F19730
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F1A710 NtOpenProcessToken,		11_2_04F1A710
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F198A0 NtWriteVirtualMemory,		11_2_04F198A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F1B040 NtSuspendThread,		11_2_04F1B040
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19820 NtEnumerateKey,		11_2_04F19820
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F199D0 NtCreateProcessEx,		11_2_04F199D0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19950 NtQueueApcThread,		11_2_04F19950
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19A80 NtOpenDirectoryObject,		11_2_04F19A80
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19A10 NtQuerySection,		11_2_04F19A10
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F1A3B0 NtGetContextThread,		11_2_04F1A3B0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F19B00 NtSetValueKey,		11_2_04F19B00
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_10429850 NtCreateFile,		11_2_10429850
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_10429900 NtReadFile,		11_2_10429900
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_10429980 NtClose,		11_2_10429980
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_10429A30 NtAllocateVirtualMemory,		11_2_10429A30
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_1042984A NtCreateFile,		11_2_1042984A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_104298FB NtReadFile,		11_2_104298FB
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_1042997A NtClose,		11_2_1042997A
Source: C:\Windows\explorer.exe	Code function: 12_2_071CF852 NtCreateFile,NtReadFile,NtClose,		12_2_071CF852
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9840 NtDelayExecution,LdrInitializeThunk,		16_2_048E9840
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9860 NtQuerySystemInformation,LdrInitializeThunk,		16_2_048E9860
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E99A0 NtCreateSection,LdrInitializeThunk,		16_2_048E99A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E95D0 NtClose,LdrInitializeThunk,		16_2_048E95D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9910 NtAdjustPrivilegesToken,LdrInitializeThunk,		16_2_048E9910
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9540 NtReadFile,LdrInitializeThunk,		16_2_048E9540
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9560 NtWriteFile,LdrInitializeThunk,		16_2_048E9560
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E96D0 NtCreateKey,LdrInitializeThunk,		16_2_048E96D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E96E0 NtFreeVirtualMemory,LdrInitializeThunk,		16_2_048E96E0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9610 NtEnumerateValueKey,LdrInitializeThunk,		16_2_048E9610
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9650 NtQueryValueKey,LdrInitializeThunk,		16_2_048E9650
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9A50 NtCreateFile,LdrInitializeThunk,		16_2_048E9A50
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9660 NtAllocateVirtualMemory,LdrInitializeThunk,		16_2_048E9660
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9780 NtMapViewOfSection,LdrInitializeThunk,		16_2_048E9780
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9FE0 NtCreateMutant,LdrInitializeThunk,		16_2_048E9FE0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9B00 NtSetValueKey,LdrInitializeThunk,		16_2_048E9B00
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9710 NtQueryInformationToken,LdrInitializeThunk,		16_2_048E9710
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9770 NtSetInformationFile,LdrInitializeThunk,		16_2_048E9770
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E98A0 NtWriteVirtualMemory,		16_2_048E98A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E98F0 NtReadVirtualMemory,		16_2_048E98F0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9820 NtEnumerateKey,		16_2_048E9820
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048EB040 NtSuspendThread,		16_2_048EB040
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E99D0 NtCreateProcessEx,		16_2_048E99D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E95F0 NtQueryInformationFile,		16_2_048E95F0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9520 NtWaitForSingleObject,		16_2_048E9520
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048EAD30 NtSetContextThread,		16_2_048EAD30
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9950 NtQueueApcThread,		16_2_048E9950
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9A80 NtOpenDirectoryObject,		16_2_048E9A80
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9A00 NtProtectVirtualMemory,		16_2_048E9A00
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9A10 NtQuerySection,		16_2_048E9A10
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9A20 NtResumeThread,		16_2_048E9A20
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9670 NtQueryInformationProcess,		16_2_048E9670
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E97A0 NtUnmapViewOfSection,		16_2_048E97A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048EA3B0 NtGetContextThread,		16_2_048EA3B0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048EA710 NtOpenProcessToken,		16_2_048EA710
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9730 NtQueryVirtualMemory,		16_2_048E9730
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E9760 NtOpenProcess,		16_2_048E9760
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048EA770 NtOpenThread,		16_2_048EA770
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_02D99A30 NtAllocateVirtualMemory,		16_2_02D99A30
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_02D99850 NtCreateFile,		16_2_02D99850
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_02D99980 NtClose,		16_2_02D99980
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_02D99900 NtReadFile,		16_2_02D99900
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_02D998FB NtReadFile,		16_2_02D998FB
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_02D9984A NtCreateFile,		16_2_02D9984A
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_02D9997A NtClose,		16_2_02D9997A

Detected potential crypto function

Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_04C0AD7C		1_3_04C0AD7C
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94496		11_2_04F94496
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F9D466		11_2_04F9D466
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE841F		11_2_04EE841F
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EED5E0		11_2_04EED5E0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA25DD		11_2_04FA25DD
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F02581		11_2_04F02581
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F92D82		11_2_04F92D82
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA1D55		11_2_04FA1D55
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED0D20		11_2_04ED0D20
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA2D07		11_2_04FA2D07
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA2EF7		11_2_04FA2EF7
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF6E30		11_2_04EF6E30
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F9D616		11_2_04F9D616
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA1FF1		11_2_04FA1FF1
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FADFCE		11_2_04FADFCE
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA28EC		11_2_04FA28EC
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F020A0		11_2_04F020A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA20A8		11_2_04FA20A8
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EEB090		11_2_04EEB090
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FAE824		11_2_04FAE824
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA830		11_2_04EFA830
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F91002		11_2_04F91002
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF99BF		11_2_04EF99BF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF4120		11_2_04EF4120
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EDF900		11_2_04EDF900
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94AEF		11_2_04F94AEF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA22AE		11_2_04FA22AE
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F8FA2B		11_2_04F8FA2B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F823E3		11_2_04F823E3
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F903DA		11_2_04F903DA
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0ABD8		11_2_04F0ABD8
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F9DBD2		11_2_04F9DBD2
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0EBB0		11_2_04F0EBB0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFAB40		11_2_04EFAB40
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA2B28		11_2_04FA2B28
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309		11_2_04EFA309
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_10411030		11_2_10411030
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_1042CA46		11_2_1042CA46
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_1042DA5E		11_2_1042DA5E
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_1042D29D		11_2_1042D29D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_1042CB3E		11_2_1042CB3E
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_1042D4B3		11_2_1042D4B3
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_10412D90		11_2_10412D90
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_1042DFE6		11_2_1042DFE6
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_1042D7F9		11_2_1042D7F9
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_10419F80		11_2_10419F80
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_10412FB0		11_2_10412FB0
Source: C:\Windows\explorer.exe	Code function: 12_2_071CF852		12_2_071CF852
Source: C:\Windows\explorer.exe	Code function: 12_2_071CCF52		12_2_071CCF52
Source: C:\Windows\explorer.exe	Code function: 12_2_071CE679		12_2_071CE679
Source: C:\Windows\explorer.exe	Code function: 12_2_071D2AAC		12_2_071D2AAC
Source: C:\Windows\explorer.exe	Code function: 12_2_071CAAF2		12_2_071CAAF2
Source: C:\Windows\explorer.exe	Code function: 12_2_071CAAEF		12_2_071CAAEF
Source: C:\Windows\explorer.exe	Code function: 12_2_071C6072		12_2_071C6072
Source: C:\Windows\explorer.exe	Code function: 12_2_071C6069		12_2_071C6069
Source: C:\Windows\explorer.exe	Code function: 12_2_071C7CF2		12_2_071C7CF2
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048BB090		16_2_048BB090
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04961002		16_2_04961002
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048B841F		16_2_048B841F
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048AF900		16_2_048AF900
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048A0D20		16_2_048A0D20
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048C4120		16_2_048C4120
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04971D55		16_2_04971D55
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048C6E30		16_2_048C6E30
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048DEBB0		16_2_048DEBB0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_02D9DA5E		16_2_02D9DA5E
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_02D9CA46		16_2_02D9CA46
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_02D9D7F9		16_2_02D9D7F9
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_02D9DFE6		16_2_02D9DFE6
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_02D89F80		16_2_02D89F80
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_02D82FB0		16_2_02D82FB0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_02D9D4B3		16_2_02D9D4B3
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_02D82D90		16_2_02D82D90

Found potential string decryption / allocating functions

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Code function: String function: 04EDB150 appears 133 times

PE / OLE file has an invalid certificate

Source: Novi poredak.exe

Static PE information: invalid certificate

PE file contains strange resources

Source: Novi poredak.exe

Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: Novi poredak.exe	Binary or memory string: OriginalFilename vs Novi poredak.exe
Source: Novi poredak.exe, 00000001.00000003.214140717.00000000021E4000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameCOMCTL32.DLL.MUIj% vs Novi poredak.exe
Source: Novi poredak.exe, 00000001.00000000.213874206.00000000004BE000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameProcexp.exeB vs Novi poredak.exe
Source: Novi poredak.exe	Binary or memory string: OriginalFilenameProcexp.exeB vs Novi poredak.exe

Yara signature match

Source: 0000000B.00000002.359869128.0000000004CA0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.359869128.0000000004CA0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.481396669.0000000000670000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.481396669.0000000000670000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.484546978.0000000002D80000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.484546978.0000000002D80000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.360930357.0000000010410000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.360930357.0000000010410000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.359837993.0000000004C70000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.359837993.0000000004C70000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 11.2.ieinstal.exe.10410000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 11.2.ieinstal.exe.10410000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 11.2.ieinstal.exe.10410000.3.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 11.2.ieinstal.exe.10410000.3.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Classification label

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@11/5@8/2

Creates files inside the user directory

Source: C:\Windows\SysWOW64\control.exe

File created: C:\Users\user\AppData\Roaming\8LO8PUBW

Jump to behavior

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4276:120:WilError_01

Creates temporary files

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\DB1

Jump to behavior

Parts of this applications are using Borland Delphi (Probably coded in Delphi)

Source: C:\Users\user\Desktop\Novi poredak.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\Novi poredak.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\Novi poredak.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Reads ini files

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\Novi poredak.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Users\user\Desktop\Novi poredak.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\Novi poredak.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\Novi poredak.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: Novi poredak.exe	Virustotal: Detection: 55%
Source: Novi poredak.exe	ReversingLabs: Detection: 60%

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\Novi poredak.exe 'C:\Users\user\Desktop\Novi poredak.exe'
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: unknown	Process created: C:\Windows\SysWOW64\control.exe C:\Windows\SysWOW64\control.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe /c copy 'C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data' 'C:\Users\user\AppData\Local\Temp\DB1' /V
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Program Files (x86)\internet explorer\ieinstal.exe'
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Program Files (x86)\internet explorer\ieinstal.exe'
Source: C:\Users\user\Desktop\Novi poredak.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Program Files (x86)\internet explorer\ieinstal.exe'			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Program Files (x86)\internet explorer\ieinstal.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c copy 'C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data' 'C:\Users\user\AppData\Local\Temp\DB1' /V			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InProcServer32

Jump to behavior

Writes ini files

Source: C:\Windows\SysWOW64\control.exe

File written: C:\Users\user\AppData\Roaming\8LO8PUBW\8LOlogri.ini

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Checks if Microsoft Office is installed

Source: C:\Windows\SysWOW64\control.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Submission file is bigger than most known malware samples

Source: Novi poredak.exe

Static file information: File size 2250352 > 1048576

Binary contains paths to debug symbols

Source:	Binary string: ieinstal.pdbGCTL source: control.exe, 00000010.00000002.481933703.000000000074B000.00000004.00000020.sdmp
Source:	Binary string: wscui.pdbUGP source: explorer.exe, 0000000C.00000000.342809291.000000000E1C0000.00000002.00000001.sdmp
Source:	Binary string: ieinstal.pdb source: control.exe, 00000010.00000002.481933703.000000000074B000.00000004.00000020.sdmp
Source:	Binary string: control.pdb source: ieinstal.exe, 0000000B.00000002.360031587.0000000004E50000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: ieinstal.exe, 0000000B.00000002.360073133.0000000004EB0000.00000040.00000001.sdmp, control.exe, 00000010.00000002.485782152.000000000499F000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: ieinstal.exe, control.exe
Source:	Binary string: control.pdbUGP source: ieinstal.exe, 0000000B.00000002.360031587.0000000004E50000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 0000000C.00000000.342809291.000000000E1C0000.00000002.00000001.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_0421F328 push esi; retf		1_3_0421F358
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_0421DB2C push ebx; ret		1_3_0421DB37
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_0421F437 push esi; retf		1_3_0421F438
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_0421F794 push esi; retf		1_3_0421F795
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_0421E099 push ebx; ret		1_3_0421E09B
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_0421D41C push esi; retf		1_3_0421D422
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_0421DC1C push esi; retf		1_3_0421DC20
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_0421E960 push esi; retf		1_3_0421E988
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_0421F263 push esi; retf		1_3_0421F31C
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_0421F4E8 push esi; retf		1_3_0421F4EC
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_0421D5EF push edi; ret		1_3_0421D5FC
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_0421E542 push edi; iretd		1_3_0421E543
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_0421DFC4 push ebx; ret		1_3_0421DFC6
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_0421D64D push ebx; ret		1_3_0421D64F
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_0421DDD3 push ebx; ret		1_3_0421DDE9
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_04393C1C push 0042A174h; ret		1_3_04393C40
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_0437DCA4 push 00414246h; ret		1_3_0437DD12
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_04388CA4 push 0041F1FCh; ret		1_3_04388CC8
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_0438049C push ecx; mov dword ptr [esp], edx		1_3_043804A1
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_04370CE0 push ecx; mov dword ptr [esp], eax		1_3_04370CE1
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_0437DD1C push 004142F0h; ret		1_3_0437DDBC
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_04391D78 push 004282D0h; ret		1_3_04391D9C
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_043805B8 push ecx; mov dword ptr [esp], edx		1_3_043805BD
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_043945A0 push 0042AB1Bh; ret		1_3_043945E7
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_0439F5F8 push ecx; mov dword ptr [esp], ecx		1_3_0439F5FC
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_043805FC push ecx; mov dword ptr [esp], edx		1_3_04380601
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_0437DEB8 push 00414410h; ret		1_3_0437DEDC
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_043926A4 push 00428BFCh; ret		1_3_043926C8
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_0437E6F0 push 00414C69h; ret		1_3_0437E735
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_04370EFC push 00407454h; ret		1_3_04370F20
Source: C:\Users\user\Desktop\Novi poredak.exe	Code function: 1_3_043926E4 push 00428C3Ch; ret		1_3_04392708

Boot Survival:

Creates an autostart registry key

Source: C:\Windows\SysWOW64\control.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 5JAP_RGXCN			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 5JAP_RGXCN			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8B 0xB3 0x38

Disables application error messsages (SetErrorMode)

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	RDTSC instruction interceptor: First address: 00000000104198B4 second address: 00000000104198BA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	RDTSC instruction interceptor: First address: 0000000010419B2E second address: 0000000010419B34 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\control.exe	RDTSC instruction interceptor: First address: 0000000002D898B4 second address: 0000000002D898BA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\control.exe	RDTSC instruction interceptor: First address: 0000000002D89B2E second address: 0000000002D89B34 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Code function: 11_2_04F16DE6 rdtsc

11_2_04F16DE6

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: explorer.exe, 0000000C.00000000.337250848.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 0000000C.00000000.337250848.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000:
Source: explorer.exe, 0000000C.00000000.336381200.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 0000000C.00000000.336944637.0000000008640000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000C.00000000.328424561.00000000055D0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}V*(E
Source: explorer.exe, 0000000C.00000000.337250848.000000000871F000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~
Source: explorer.exe, 0000000C.00000000.337250848.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 0000000C.00000002.495467589.0000000005603000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: explorer.exe, 0000000C.00000000.336381200.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 0000000C.00000000.336381200.0000000008220000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 0000000C.00000000.336381200.0000000008220000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Queries a list of all running processes

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process queried: DebugPort			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Code function: 11_2_04F16DE6 rdtsc

11_2_04F16DE6

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Code function: 11_2_04F195D0 NtClose,LdrInitializeThunk,

11_2_04F195D0

Contains functionality to read the PEB

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F914FB mov eax, dword ptr fs:[00000030h]		11_2_04F914FB
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F56CF0 mov eax, dword ptr fs:[00000030h]		11_2_04F56CF0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F56CF0 mov eax, dword ptr fs:[00000030h]		11_2_04F56CF0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F56CF0 mov eax, dword ptr fs:[00000030h]		11_2_04F56CF0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA8CD6 mov eax, dword ptr fs:[00000030h]		11_2_04FA8CD6
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94496 mov eax, dword ptr fs:[00000030h]		11_2_04F94496
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94496 mov eax, dword ptr fs:[00000030h]		11_2_04F94496
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94496 mov eax, dword ptr fs:[00000030h]		11_2_04F94496
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94496 mov eax, dword ptr fs:[00000030h]		11_2_04F94496
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94496 mov eax, dword ptr fs:[00000030h]		11_2_04F94496
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94496 mov eax, dword ptr fs:[00000030h]		11_2_04F94496
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94496 mov eax, dword ptr fs:[00000030h]		11_2_04F94496
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94496 mov eax, dword ptr fs:[00000030h]		11_2_04F94496
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94496 mov eax, dword ptr fs:[00000030h]		11_2_04F94496
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94496 mov eax, dword ptr fs:[00000030h]		11_2_04F94496
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94496 mov eax, dword ptr fs:[00000030h]		11_2_04F94496
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94496 mov eax, dword ptr fs:[00000030h]		11_2_04F94496
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94496 mov eax, dword ptr fs:[00000030h]		11_2_04F94496
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE849B mov eax, dword ptr fs:[00000030h]		11_2_04EE849B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF746D mov eax, dword ptr fs:[00000030h]		11_2_04EF746D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0AC7B mov eax, dword ptr fs:[00000030h]		11_2_04F0AC7B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0AC7B mov eax, dword ptr fs:[00000030h]		11_2_04F0AC7B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0AC7B mov eax, dword ptr fs:[00000030h]		11_2_04F0AC7B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0AC7B mov eax, dword ptr fs:[00000030h]		11_2_04F0AC7B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0AC7B mov eax, dword ptr fs:[00000030h]		11_2_04F0AC7B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0AC7B mov eax, dword ptr fs:[00000030h]		11_2_04F0AC7B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0AC7B mov eax, dword ptr fs:[00000030h]		11_2_04F0AC7B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0AC7B mov eax, dword ptr fs:[00000030h]		11_2_04F0AC7B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0AC7B mov eax, dword ptr fs:[00000030h]		11_2_04F0AC7B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0AC7B mov eax, dword ptr fs:[00000030h]		11_2_04F0AC7B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0AC7B mov eax, dword ptr fs:[00000030h]		11_2_04F0AC7B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F6C450 mov eax, dword ptr fs:[00000030h]		11_2_04F6C450
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F6C450 mov eax, dword ptr fs:[00000030h]		11_2_04F6C450
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0A44B mov eax, dword ptr fs:[00000030h]		11_2_04F0A44B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0BC2C mov eax, dword ptr fs:[00000030h]		11_2_04F0BC2C
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA740D mov eax, dword ptr fs:[00000030h]		11_2_04FA740D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA740D mov eax, dword ptr fs:[00000030h]		11_2_04FA740D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA740D mov eax, dword ptr fs:[00000030h]		11_2_04FA740D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F91C06 mov eax, dword ptr fs:[00000030h]		11_2_04F91C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F91C06 mov eax, dword ptr fs:[00000030h]		11_2_04F91C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F91C06 mov eax, dword ptr fs:[00000030h]		11_2_04F91C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F91C06 mov eax, dword ptr fs:[00000030h]		11_2_04F91C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F91C06 mov eax, dword ptr fs:[00000030h]		11_2_04F91C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F91C06 mov eax, dword ptr fs:[00000030h]		11_2_04F91C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F91C06 mov eax, dword ptr fs:[00000030h]		11_2_04F91C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F91C06 mov eax, dword ptr fs:[00000030h]		11_2_04F91C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F91C06 mov eax, dword ptr fs:[00000030h]		11_2_04F91C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F91C06 mov eax, dword ptr fs:[00000030h]		11_2_04F91C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F91C06 mov eax, dword ptr fs:[00000030h]		11_2_04F91C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F91C06 mov eax, dword ptr fs:[00000030h]		11_2_04F91C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F91C06 mov eax, dword ptr fs:[00000030h]		11_2_04F91C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F91C06 mov eax, dword ptr fs:[00000030h]		11_2_04F91C06
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F56C0A mov eax, dword ptr fs:[00000030h]		11_2_04F56C0A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F56C0A mov eax, dword ptr fs:[00000030h]		11_2_04F56C0A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F56C0A mov eax, dword ptr fs:[00000030h]		11_2_04F56C0A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F56C0A mov eax, dword ptr fs:[00000030h]		11_2_04F56C0A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F88DF1 mov eax, dword ptr fs:[00000030h]		11_2_04F88DF1
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EED5E0 mov eax, dword ptr fs:[00000030h]		11_2_04EED5E0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EED5E0 mov eax, dword ptr fs:[00000030h]		11_2_04EED5E0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F9FDE2 mov eax, dword ptr fs:[00000030h]		11_2_04F9FDE2
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F9FDE2 mov eax, dword ptr fs:[00000030h]		11_2_04F9FDE2
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F9FDE2 mov eax, dword ptr fs:[00000030h]		11_2_04F9FDE2
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F9FDE2 mov eax, dword ptr fs:[00000030h]		11_2_04F9FDE2
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F56DC9 mov eax, dword ptr fs:[00000030h]		11_2_04F56DC9
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F56DC9 mov eax, dword ptr fs:[00000030h]		11_2_04F56DC9
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F56DC9 mov eax, dword ptr fs:[00000030h]		11_2_04F56DC9
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F56DC9 mov ecx, dword ptr fs:[00000030h]		11_2_04F56DC9
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F56DC9 mov eax, dword ptr fs:[00000030h]		11_2_04F56DC9
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F56DC9 mov eax, dword ptr fs:[00000030h]		11_2_04F56DC9
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F01DB5 mov eax, dword ptr fs:[00000030h]		11_2_04F01DB5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F01DB5 mov eax, dword ptr fs:[00000030h]		11_2_04F01DB5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F01DB5 mov eax, dword ptr fs:[00000030h]		11_2_04F01DB5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F035A1 mov eax, dword ptr fs:[00000030h]		11_2_04F035A1
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA05AC mov eax, dword ptr fs:[00000030h]		11_2_04FA05AC
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA05AC mov eax, dword ptr fs:[00000030h]		11_2_04FA05AC
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED2D8A mov eax, dword ptr fs:[00000030h]		11_2_04ED2D8A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED2D8A mov eax, dword ptr fs:[00000030h]		11_2_04ED2D8A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED2D8A mov eax, dword ptr fs:[00000030h]		11_2_04ED2D8A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED2D8A mov eax, dword ptr fs:[00000030h]		11_2_04ED2D8A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED2D8A mov eax, dword ptr fs:[00000030h]		11_2_04ED2D8A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0FD9B mov eax, dword ptr fs:[00000030h]		11_2_04F0FD9B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0FD9B mov eax, dword ptr fs:[00000030h]		11_2_04F0FD9B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F02581 mov eax, dword ptr fs:[00000030h]		11_2_04F02581
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F02581 mov eax, dword ptr fs:[00000030h]		11_2_04F02581
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F02581 mov eax, dword ptr fs:[00000030h]		11_2_04F02581
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F02581 mov eax, dword ptr fs:[00000030h]		11_2_04F02581
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F92D82 mov eax, dword ptr fs:[00000030h]		11_2_04F92D82
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F92D82 mov eax, dword ptr fs:[00000030h]		11_2_04F92D82
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F92D82 mov eax, dword ptr fs:[00000030h]		11_2_04F92D82
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F92D82 mov eax, dword ptr fs:[00000030h]		11_2_04F92D82
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F92D82 mov eax, dword ptr fs:[00000030h]		11_2_04F92D82
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F92D82 mov eax, dword ptr fs:[00000030h]		11_2_04F92D82
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F92D82 mov eax, dword ptr fs:[00000030h]		11_2_04F92D82
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFC577 mov eax, dword ptr fs:[00000030h]		11_2_04EFC577
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFC577 mov eax, dword ptr fs:[00000030h]		11_2_04EFC577
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F13D43 mov eax, dword ptr fs:[00000030h]		11_2_04F13D43
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F53540 mov eax, dword ptr fs:[00000030h]		11_2_04F53540
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F83D40 mov eax, dword ptr fs:[00000030h]		11_2_04F83D40
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF7D50 mov eax, dword ptr fs:[00000030h]		11_2_04EF7D50
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F9E539 mov eax, dword ptr fs:[00000030h]		11_2_04F9E539
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F5A537 mov eax, dword ptr fs:[00000030h]		11_2_04F5A537
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F04D3B mov eax, dword ptr fs:[00000030h]		11_2_04F04D3B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F04D3B mov eax, dword ptr fs:[00000030h]		11_2_04F04D3B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F04D3B mov eax, dword ptr fs:[00000030h]		11_2_04F04D3B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA8D34 mov eax, dword ptr fs:[00000030h]		11_2_04FA8D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE3D34 mov eax, dword ptr fs:[00000030h]		11_2_04EE3D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE3D34 mov eax, dword ptr fs:[00000030h]		11_2_04EE3D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE3D34 mov eax, dword ptr fs:[00000030h]		11_2_04EE3D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE3D34 mov eax, dword ptr fs:[00000030h]		11_2_04EE3D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE3D34 mov eax, dword ptr fs:[00000030h]		11_2_04EE3D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE3D34 mov eax, dword ptr fs:[00000030h]		11_2_04EE3D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE3D34 mov eax, dword ptr fs:[00000030h]		11_2_04EE3D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE3D34 mov eax, dword ptr fs:[00000030h]		11_2_04EE3D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE3D34 mov eax, dword ptr fs:[00000030h]		11_2_04EE3D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE3D34 mov eax, dword ptr fs:[00000030h]		11_2_04EE3D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE3D34 mov eax, dword ptr fs:[00000030h]		11_2_04EE3D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE3D34 mov eax, dword ptr fs:[00000030h]		11_2_04EE3D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE3D34 mov eax, dword ptr fs:[00000030h]		11_2_04EE3D34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EDAD30 mov eax, dword ptr fs:[00000030h]		11_2_04EDAD30
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE76E2 mov eax, dword ptr fs:[00000030h]		11_2_04EE76E2
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F016E0 mov ecx, dword ptr fs:[00000030h]		11_2_04F016E0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA8ED6 mov eax, dword ptr fs:[00000030h]		11_2_04FA8ED6
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F18EC7 mov eax, dword ptr fs:[00000030h]		11_2_04F18EC7
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F8FEC0 mov eax, dword ptr fs:[00000030h]		11_2_04F8FEC0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F036CC mov eax, dword ptr fs:[00000030h]		11_2_04F036CC
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F546A7 mov eax, dword ptr fs:[00000030h]		11_2_04F546A7
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA0EA5 mov eax, dword ptr fs:[00000030h]		11_2_04FA0EA5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA0EA5 mov eax, dword ptr fs:[00000030h]		11_2_04FA0EA5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA0EA5 mov eax, dword ptr fs:[00000030h]		11_2_04FA0EA5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F6FE87 mov eax, dword ptr fs:[00000030h]		11_2_04F6FE87
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE766D mov eax, dword ptr fs:[00000030h]		11_2_04EE766D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFAE73 mov eax, dword ptr fs:[00000030h]		11_2_04EFAE73
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFAE73 mov eax, dword ptr fs:[00000030h]		11_2_04EFAE73
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFAE73 mov eax, dword ptr fs:[00000030h]		11_2_04EFAE73
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFAE73 mov eax, dword ptr fs:[00000030h]		11_2_04EFAE73
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFAE73 mov eax, dword ptr fs:[00000030h]		11_2_04EFAE73
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE7E41 mov eax, dword ptr fs:[00000030h]		11_2_04EE7E41
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE7E41 mov eax, dword ptr fs:[00000030h]		11_2_04EE7E41
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE7E41 mov eax, dword ptr fs:[00000030h]		11_2_04EE7E41
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE7E41 mov eax, dword ptr fs:[00000030h]		11_2_04EE7E41
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE7E41 mov eax, dword ptr fs:[00000030h]		11_2_04EE7E41
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE7E41 mov eax, dword ptr fs:[00000030h]		11_2_04EE7E41
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F9AE44 mov eax, dword ptr fs:[00000030h]		11_2_04F9AE44
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F9AE44 mov eax, dword ptr fs:[00000030h]		11_2_04F9AE44
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F8FE3F mov eax, dword ptr fs:[00000030h]		11_2_04F8FE3F
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EDE620 mov eax, dword ptr fs:[00000030h]		11_2_04EDE620
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0A61C mov eax, dword ptr fs:[00000030h]		11_2_04F0A61C
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0A61C mov eax, dword ptr fs:[00000030h]		11_2_04F0A61C
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EDC600 mov eax, dword ptr fs:[00000030h]		11_2_04EDC600
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EDC600 mov eax, dword ptr fs:[00000030h]		11_2_04EDC600
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EDC600 mov eax, dword ptr fs:[00000030h]		11_2_04EDC600
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F08E00 mov eax, dword ptr fs:[00000030h]		11_2_04F08E00
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F91608 mov eax, dword ptr fs:[00000030h]		11_2_04F91608
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F137F5 mov eax, dword ptr fs:[00000030h]		11_2_04F137F5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F57794 mov eax, dword ptr fs:[00000030h]		11_2_04F57794
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F57794 mov eax, dword ptr fs:[00000030h]		11_2_04F57794
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F57794 mov eax, dword ptr fs:[00000030h]		11_2_04F57794
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE8794 mov eax, dword ptr fs:[00000030h]		11_2_04EE8794
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EEFF60 mov eax, dword ptr fs:[00000030h]		11_2_04EEFF60
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA8F6A mov eax, dword ptr fs:[00000030h]		11_2_04FA8F6A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EEEF40 mov eax, dword ptr fs:[00000030h]		11_2_04EEEF40
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0E730 mov eax, dword ptr fs:[00000030h]		11_2_04F0E730
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED4F2E mov eax, dword ptr fs:[00000030h]		11_2_04ED4F2E
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED4F2E mov eax, dword ptr fs:[00000030h]		11_2_04ED4F2E
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFB73D mov eax, dword ptr fs:[00000030h]		11_2_04EFB73D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFB73D mov eax, dword ptr fs:[00000030h]		11_2_04EFB73D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F6FF10 mov eax, dword ptr fs:[00000030h]		11_2_04F6FF10
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F6FF10 mov eax, dword ptr fs:[00000030h]		11_2_04F6FF10
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA070D mov eax, dword ptr fs:[00000030h]		11_2_04FA070D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA070D mov eax, dword ptr fs:[00000030h]		11_2_04FA070D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFF716 mov eax, dword ptr fs:[00000030h]		11_2_04EFF716
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0A70E mov eax, dword ptr fs:[00000030h]		11_2_04F0A70E
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0A70E mov eax, dword ptr fs:[00000030h]		11_2_04F0A70E
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED58EC mov eax, dword ptr fs:[00000030h]		11_2_04ED58EC
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFB8E4 mov eax, dword ptr fs:[00000030h]		11_2_04EFB8E4
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFB8E4 mov eax, dword ptr fs:[00000030h]		11_2_04EFB8E4
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED40E1 mov eax, dword ptr fs:[00000030h]		11_2_04ED40E1
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED40E1 mov eax, dword ptr fs:[00000030h]		11_2_04ED40E1
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED40E1 mov eax, dword ptr fs:[00000030h]		11_2_04ED40E1
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F6B8D0 mov eax, dword ptr fs:[00000030h]		11_2_04F6B8D0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F6B8D0 mov ecx, dword ptr fs:[00000030h]		11_2_04F6B8D0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F6B8D0 mov eax, dword ptr fs:[00000030h]		11_2_04F6B8D0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F6B8D0 mov eax, dword ptr fs:[00000030h]		11_2_04F6B8D0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F6B8D0 mov eax, dword ptr fs:[00000030h]		11_2_04F6B8D0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F6B8D0 mov eax, dword ptr fs:[00000030h]		11_2_04F6B8D0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0F0BF mov ecx, dword ptr fs:[00000030h]		11_2_04F0F0BF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0F0BF mov eax, dword ptr fs:[00000030h]		11_2_04F0F0BF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0F0BF mov eax, dword ptr fs:[00000030h]		11_2_04F0F0BF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F020A0 mov eax, dword ptr fs:[00000030h]		11_2_04F020A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F020A0 mov eax, dword ptr fs:[00000030h]		11_2_04F020A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F020A0 mov eax, dword ptr fs:[00000030h]		11_2_04F020A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F020A0 mov eax, dword ptr fs:[00000030h]		11_2_04F020A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F020A0 mov eax, dword ptr fs:[00000030h]		11_2_04F020A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F020A0 mov eax, dword ptr fs:[00000030h]		11_2_04F020A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F190AF mov eax, dword ptr fs:[00000030h]		11_2_04F190AF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED9080 mov eax, dword ptr fs:[00000030h]		11_2_04ED9080
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F53884 mov eax, dword ptr fs:[00000030h]		11_2_04F53884
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F53884 mov eax, dword ptr fs:[00000030h]		11_2_04F53884
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F92073 mov eax, dword ptr fs:[00000030h]		11_2_04F92073
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA1074 mov eax, dword ptr fs:[00000030h]		11_2_04FA1074
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF0050 mov eax, dword ptr fs:[00000030h]		11_2_04EF0050
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF0050 mov eax, dword ptr fs:[00000030h]		11_2_04EF0050
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EEB02A mov eax, dword ptr fs:[00000030h]		11_2_04EEB02A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EEB02A mov eax, dword ptr fs:[00000030h]		11_2_04EEB02A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EEB02A mov eax, dword ptr fs:[00000030h]		11_2_04EEB02A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EEB02A mov eax, dword ptr fs:[00000030h]		11_2_04EEB02A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0002D mov eax, dword ptr fs:[00000030h]		11_2_04F0002D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0002D mov eax, dword ptr fs:[00000030h]		11_2_04F0002D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0002D mov eax, dword ptr fs:[00000030h]		11_2_04F0002D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0002D mov eax, dword ptr fs:[00000030h]		11_2_04F0002D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0002D mov eax, dword ptr fs:[00000030h]		11_2_04F0002D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA830 mov eax, dword ptr fs:[00000030h]		11_2_04EFA830
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA830 mov eax, dword ptr fs:[00000030h]		11_2_04EFA830
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA830 mov eax, dword ptr fs:[00000030h]		11_2_04EFA830
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA830 mov eax, dword ptr fs:[00000030h]		11_2_04EFA830
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F57016 mov eax, dword ptr fs:[00000030h]		11_2_04F57016
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F57016 mov eax, dword ptr fs:[00000030h]		11_2_04F57016
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F57016 mov eax, dword ptr fs:[00000030h]		11_2_04F57016
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA4015 mov eax, dword ptr fs:[00000030h]		11_2_04FA4015
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA4015 mov eax, dword ptr fs:[00000030h]		11_2_04FA4015
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EDB1E1 mov eax, dword ptr fs:[00000030h]		11_2_04EDB1E1
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EDB1E1 mov eax, dword ptr fs:[00000030h]		11_2_04EDB1E1
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EDB1E1 mov eax, dword ptr fs:[00000030h]		11_2_04EDB1E1
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F641E8 mov eax, dword ptr fs:[00000030h]		11_2_04F641E8
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F551BE mov eax, dword ptr fs:[00000030h]		11_2_04F551BE
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F551BE mov eax, dword ptr fs:[00000030h]		11_2_04F551BE
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F551BE mov eax, dword ptr fs:[00000030h]		11_2_04F551BE
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F551BE mov eax, dword ptr fs:[00000030h]		11_2_04F551BE
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F061A0 mov eax, dword ptr fs:[00000030h]		11_2_04F061A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F061A0 mov eax, dword ptr fs:[00000030h]		11_2_04F061A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF99BF mov ecx, dword ptr fs:[00000030h]		11_2_04EF99BF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF99BF mov ecx, dword ptr fs:[00000030h]		11_2_04EF99BF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF99BF mov eax, dword ptr fs:[00000030h]		11_2_04EF99BF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF99BF mov ecx, dword ptr fs:[00000030h]		11_2_04EF99BF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF99BF mov ecx, dword ptr fs:[00000030h]		11_2_04EF99BF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF99BF mov eax, dword ptr fs:[00000030h]		11_2_04EF99BF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF99BF mov ecx, dword ptr fs:[00000030h]		11_2_04EF99BF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF99BF mov ecx, dword ptr fs:[00000030h]		11_2_04EF99BF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF99BF mov eax, dword ptr fs:[00000030h]		11_2_04EF99BF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF99BF mov ecx, dword ptr fs:[00000030h]		11_2_04EF99BF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF99BF mov ecx, dword ptr fs:[00000030h]		11_2_04EF99BF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF99BF mov eax, dword ptr fs:[00000030h]		11_2_04EF99BF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F569A6 mov eax, dword ptr fs:[00000030h]		11_2_04F569A6
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F949A4 mov eax, dword ptr fs:[00000030h]		11_2_04F949A4
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F949A4 mov eax, dword ptr fs:[00000030h]		11_2_04F949A4
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F949A4 mov eax, dword ptr fs:[00000030h]		11_2_04F949A4
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F949A4 mov eax, dword ptr fs:[00000030h]		11_2_04F949A4
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F02990 mov eax, dword ptr fs:[00000030h]		11_2_04F02990
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFC182 mov eax, dword ptr fs:[00000030h]		11_2_04EFC182
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0A185 mov eax, dword ptr fs:[00000030h]		11_2_04F0A185
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EDC962 mov eax, dword ptr fs:[00000030h]		11_2_04EDC962
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EDB171 mov eax, dword ptr fs:[00000030h]		11_2_04EDB171
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EDB171 mov eax, dword ptr fs:[00000030h]		11_2_04EDB171
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFB944 mov eax, dword ptr fs:[00000030h]		11_2_04EFB944
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFB944 mov eax, dword ptr fs:[00000030h]		11_2_04EFB944
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0513A mov eax, dword ptr fs:[00000030h]		11_2_04F0513A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0513A mov eax, dword ptr fs:[00000030h]		11_2_04F0513A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF4120 mov eax, dword ptr fs:[00000030h]		11_2_04EF4120
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF4120 mov eax, dword ptr fs:[00000030h]		11_2_04EF4120
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF4120 mov eax, dword ptr fs:[00000030h]		11_2_04EF4120
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF4120 mov eax, dword ptr fs:[00000030h]		11_2_04EF4120
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF4120 mov ecx, dword ptr fs:[00000030h]		11_2_04EF4120
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED9100 mov eax, dword ptr fs:[00000030h]		11_2_04ED9100
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED9100 mov eax, dword ptr fs:[00000030h]		11_2_04ED9100
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED9100 mov eax, dword ptr fs:[00000030h]		11_2_04ED9100
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F02AE4 mov eax, dword ptr fs:[00000030h]		11_2_04F02AE4
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94AEF mov eax, dword ptr fs:[00000030h]		11_2_04F94AEF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94AEF mov eax, dword ptr fs:[00000030h]		11_2_04F94AEF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94AEF mov eax, dword ptr fs:[00000030h]		11_2_04F94AEF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94AEF mov eax, dword ptr fs:[00000030h]		11_2_04F94AEF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94AEF mov eax, dword ptr fs:[00000030h]		11_2_04F94AEF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94AEF mov eax, dword ptr fs:[00000030h]		11_2_04F94AEF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94AEF mov eax, dword ptr fs:[00000030h]		11_2_04F94AEF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94AEF mov eax, dword ptr fs:[00000030h]		11_2_04F94AEF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94AEF mov eax, dword ptr fs:[00000030h]		11_2_04F94AEF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94AEF mov eax, dword ptr fs:[00000030h]		11_2_04F94AEF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94AEF mov eax, dword ptr fs:[00000030h]		11_2_04F94AEF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94AEF mov eax, dword ptr fs:[00000030h]		11_2_04F94AEF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94AEF mov eax, dword ptr fs:[00000030h]		11_2_04F94AEF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F94AEF mov eax, dword ptr fs:[00000030h]		11_2_04F94AEF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F02ACB mov eax, dword ptr fs:[00000030h]		11_2_04F02ACB
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0FAB0 mov eax, dword ptr fs:[00000030h]		11_2_04F0FAB0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED52A5 mov eax, dword ptr fs:[00000030h]		11_2_04ED52A5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED52A5 mov eax, dword ptr fs:[00000030h]		11_2_04ED52A5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED52A5 mov eax, dword ptr fs:[00000030h]		11_2_04ED52A5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED52A5 mov eax, dword ptr fs:[00000030h]		11_2_04ED52A5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED52A5 mov eax, dword ptr fs:[00000030h]		11_2_04ED52A5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EEAAB0 mov eax, dword ptr fs:[00000030h]		11_2_04EEAAB0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EEAAB0 mov eax, dword ptr fs:[00000030h]		11_2_04EEAAB0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0D294 mov eax, dword ptr fs:[00000030h]		11_2_04F0D294
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0D294 mov eax, dword ptr fs:[00000030h]		11_2_04F0D294
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F1927A mov eax, dword ptr fs:[00000030h]		11_2_04F1927A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F8B260 mov eax, dword ptr fs:[00000030h]		11_2_04F8B260
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F8B260 mov eax, dword ptr fs:[00000030h]		11_2_04F8B260
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA8A62 mov eax, dword ptr fs:[00000030h]		11_2_04FA8A62
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F64257 mov eax, dword ptr fs:[00000030h]		11_2_04F64257
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F9EA55 mov eax, dword ptr fs:[00000030h]		11_2_04F9EA55
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED9240 mov eax, dword ptr fs:[00000030h]		11_2_04ED9240
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED9240 mov eax, dword ptr fs:[00000030h]		11_2_04ED9240
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED9240 mov eax, dword ptr fs:[00000030h]		11_2_04ED9240
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED9240 mov eax, dword ptr fs:[00000030h]		11_2_04ED9240
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA229 mov eax, dword ptr fs:[00000030h]		11_2_04EFA229
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA229 mov eax, dword ptr fs:[00000030h]		11_2_04EFA229
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA229 mov eax, dword ptr fs:[00000030h]		11_2_04EFA229
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA229 mov eax, dword ptr fs:[00000030h]		11_2_04EFA229
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA229 mov eax, dword ptr fs:[00000030h]		11_2_04EFA229
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA229 mov eax, dword ptr fs:[00000030h]		11_2_04EFA229
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA229 mov eax, dword ptr fs:[00000030h]		11_2_04EFA229
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA229 mov eax, dword ptr fs:[00000030h]		11_2_04EFA229
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA229 mov eax, dword ptr fs:[00000030h]		11_2_04EFA229
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F14A2C mov eax, dword ptr fs:[00000030h]		11_2_04F14A2C
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F14A2C mov eax, dword ptr fs:[00000030h]		11_2_04F14A2C
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE8A0A mov eax, dword ptr fs:[00000030h]		11_2_04EE8A0A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F9AA16 mov eax, dword ptr fs:[00000030h]		11_2_04F9AA16
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F9AA16 mov eax, dword ptr fs:[00000030h]		11_2_04F9AA16
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EF3A1C mov eax, dword ptr fs:[00000030h]		11_2_04EF3A1C
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EDAA16 mov eax, dword ptr fs:[00000030h]		11_2_04EDAA16
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EDAA16 mov eax, dword ptr fs:[00000030h]		11_2_04EDAA16
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED5210 mov eax, dword ptr fs:[00000030h]		11_2_04ED5210
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED5210 mov ecx, dword ptr fs:[00000030h]		11_2_04ED5210
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED5210 mov eax, dword ptr fs:[00000030h]		11_2_04ED5210
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04ED5210 mov eax, dword ptr fs:[00000030h]		11_2_04ED5210
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFDBE9 mov eax, dword ptr fs:[00000030h]		11_2_04EFDBE9
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F003E2 mov eax, dword ptr fs:[00000030h]		11_2_04F003E2
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F003E2 mov eax, dword ptr fs:[00000030h]		11_2_04F003E2
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F003E2 mov eax, dword ptr fs:[00000030h]		11_2_04F003E2
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F003E2 mov eax, dword ptr fs:[00000030h]		11_2_04F003E2
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F003E2 mov eax, dword ptr fs:[00000030h]		11_2_04F003E2
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F003E2 mov eax, dword ptr fs:[00000030h]		11_2_04F003E2
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F823E3 mov ecx, dword ptr fs:[00000030h]		11_2_04F823E3
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F823E3 mov ecx, dword ptr fs:[00000030h]		11_2_04F823E3
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F823E3 mov eax, dword ptr fs:[00000030h]		11_2_04F823E3
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F553CA mov eax, dword ptr fs:[00000030h]		11_2_04F553CA
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F553CA mov eax, dword ptr fs:[00000030h]		11_2_04F553CA
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F04BAD mov eax, dword ptr fs:[00000030h]		11_2_04F04BAD
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F04BAD mov eax, dword ptr fs:[00000030h]		11_2_04F04BAD
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F04BAD mov eax, dword ptr fs:[00000030h]		11_2_04F04BAD
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA5BA5 mov eax, dword ptr fs:[00000030h]		11_2_04FA5BA5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F0B390 mov eax, dword ptr fs:[00000030h]		11_2_04F0B390
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE1B8F mov eax, dword ptr fs:[00000030h]		11_2_04EE1B8F
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EE1B8F mov eax, dword ptr fs:[00000030h]		11_2_04EE1B8F
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F02397 mov eax, dword ptr fs:[00000030h]		11_2_04F02397
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F9138A mov eax, dword ptr fs:[00000030h]		11_2_04F9138A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F8D380 mov ecx, dword ptr fs:[00000030h]		11_2_04F8D380
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F03B7A mov eax, dword ptr fs:[00000030h]		11_2_04F03B7A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F03B7A mov eax, dword ptr fs:[00000030h]		11_2_04F03B7A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EDDB60 mov ecx, dword ptr fs:[00000030h]		11_2_04EDDB60
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04FA8B58 mov eax, dword ptr fs:[00000030h]		11_2_04FA8B58
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EDDB40 mov eax, dword ptr fs:[00000030h]		11_2_04EDDB40
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EDF358 mov eax, dword ptr fs:[00000030h]		11_2_04EDF358
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04F9131B mov eax, dword ptr fs:[00000030h]		11_2_04F9131B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309 mov eax, dword ptr fs:[00000030h]		11_2_04EFA309
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309 mov eax, dword ptr fs:[00000030h]		11_2_04EFA309
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309 mov eax, dword ptr fs:[00000030h]		11_2_04EFA309
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309 mov eax, dword ptr fs:[00000030h]		11_2_04EFA309
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309 mov eax, dword ptr fs:[00000030h]		11_2_04EFA309
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309 mov eax, dword ptr fs:[00000030h]		11_2_04EFA309
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309 mov eax, dword ptr fs:[00000030h]		11_2_04EFA309
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309 mov eax, dword ptr fs:[00000030h]		11_2_04EFA309
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309 mov eax, dword ptr fs:[00000030h]		11_2_04EFA309
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309 mov eax, dword ptr fs:[00000030h]		11_2_04EFA309
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309 mov eax, dword ptr fs:[00000030h]		11_2_04EFA309
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309 mov eax, dword ptr fs:[00000030h]		11_2_04EFA309
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309 mov eax, dword ptr fs:[00000030h]		11_2_04EFA309
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309 mov eax, dword ptr fs:[00000030h]		11_2_04EFA309
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309 mov eax, dword ptr fs:[00000030h]		11_2_04EFA309
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309 mov eax, dword ptr fs:[00000030h]		11_2_04EFA309
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309 mov eax, dword ptr fs:[00000030h]		11_2_04EFA309
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309 mov eax, dword ptr fs:[00000030h]		11_2_04EFA309
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309 mov eax, dword ptr fs:[00000030h]		11_2_04EFA309
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309 mov eax, dword ptr fs:[00000030h]		11_2_04EFA309
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_04EFA309 mov eax, dword ptr fs:[00000030h]		11_2_04EFA309
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048A9080 mov eax, dword ptr fs:[00000030h]		16_2_048A9080
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04923884 mov eax, dword ptr fs:[00000030h]		16_2_04923884
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04923884 mov eax, dword ptr fs:[00000030h]		16_2_04923884
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E90AF mov eax, dword ptr fs:[00000030h]		16_2_048E90AF
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048DF0BF mov ecx, dword ptr fs:[00000030h]		16_2_048DF0BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048DF0BF mov eax, dword ptr fs:[00000030h]		16_2_048DF0BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048DF0BF mov eax, dword ptr fs:[00000030h]		16_2_048DF0BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04978CD6 mov eax, dword ptr fs:[00000030h]		16_2_04978CD6
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_0493B8D0 mov eax, dword ptr fs:[00000030h]		16_2_0493B8D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_0493B8D0 mov ecx, dword ptr fs:[00000030h]		16_2_0493B8D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_0493B8D0 mov eax, dword ptr fs:[00000030h]		16_2_0493B8D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_0493B8D0 mov eax, dword ptr fs:[00000030h]		16_2_0493B8D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_0493B8D0 mov eax, dword ptr fs:[00000030h]		16_2_0493B8D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_0493B8D0 mov eax, dword ptr fs:[00000030h]		16_2_0493B8D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04926CF0 mov eax, dword ptr fs:[00000030h]		16_2_04926CF0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04926CF0 mov eax, dword ptr fs:[00000030h]		16_2_04926CF0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04926CF0 mov eax, dword ptr fs:[00000030h]		16_2_04926CF0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_049614FB mov eax, dword ptr fs:[00000030h]		16_2_049614FB
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04974015 mov eax, dword ptr fs:[00000030h]		16_2_04974015
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04974015 mov eax, dword ptr fs:[00000030h]		16_2_04974015
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04927016 mov eax, dword ptr fs:[00000030h]		16_2_04927016
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04927016 mov eax, dword ptr fs:[00000030h]		16_2_04927016
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04927016 mov eax, dword ptr fs:[00000030h]		16_2_04927016
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04961C06 mov eax, dword ptr fs:[00000030h]		16_2_04961C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04961C06 mov eax, dword ptr fs:[00000030h]		16_2_04961C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04961C06 mov eax, dword ptr fs:[00000030h]		16_2_04961C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04961C06 mov eax, dword ptr fs:[00000030h]		16_2_04961C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04961C06 mov eax, dword ptr fs:[00000030h]		16_2_04961C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04961C06 mov eax, dword ptr fs:[00000030h]		16_2_04961C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04961C06 mov eax, dword ptr fs:[00000030h]		16_2_04961C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04961C06 mov eax, dword ptr fs:[00000030h]		16_2_04961C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04961C06 mov eax, dword ptr fs:[00000030h]		16_2_04961C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04961C06 mov eax, dword ptr fs:[00000030h]		16_2_04961C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04961C06 mov eax, dword ptr fs:[00000030h]		16_2_04961C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04961C06 mov eax, dword ptr fs:[00000030h]		16_2_04961C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04961C06 mov eax, dword ptr fs:[00000030h]		16_2_04961C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04961C06 mov eax, dword ptr fs:[00000030h]		16_2_04961C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04926C0A mov eax, dword ptr fs:[00000030h]		16_2_04926C0A
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04926C0A mov eax, dword ptr fs:[00000030h]		16_2_04926C0A
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04926C0A mov eax, dword ptr fs:[00000030h]		16_2_04926C0A
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04926C0A mov eax, dword ptr fs:[00000030h]		16_2_04926C0A
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_0497740D mov eax, dword ptr fs:[00000030h]		16_2_0497740D
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_0497740D mov eax, dword ptr fs:[00000030h]		16_2_0497740D
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_0497740D mov eax, dword ptr fs:[00000030h]		16_2_0497740D
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048BB02A mov eax, dword ptr fs:[00000030h]		16_2_048BB02A
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048BB02A mov eax, dword ptr fs:[00000030h]		16_2_048BB02A
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048BB02A mov eax, dword ptr fs:[00000030h]		16_2_048BB02A
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048BB02A mov eax, dword ptr fs:[00000030h]		16_2_048BB02A
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048DBC2C mov eax, dword ptr fs:[00000030h]		16_2_048DBC2C
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_0493C450 mov eax, dword ptr fs:[00000030h]		16_2_0493C450
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_0493C450 mov eax, dword ptr fs:[00000030h]		16_2_0493C450
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048C0050 mov eax, dword ptr fs:[00000030h]		16_2_048C0050
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048C0050 mov eax, dword ptr fs:[00000030h]		16_2_048C0050
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048C746D mov eax, dword ptr fs:[00000030h]		16_2_048C746D
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04971074 mov eax, dword ptr fs:[00000030h]		16_2_04971074
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04962073 mov eax, dword ptr fs:[00000030h]		16_2_04962073
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048A2D8A mov eax, dword ptr fs:[00000030h]		16_2_048A2D8A
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048A2D8A mov eax, dword ptr fs:[00000030h]		16_2_048A2D8A
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048A2D8A mov eax, dword ptr fs:[00000030h]		16_2_048A2D8A
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048A2D8A mov eax, dword ptr fs:[00000030h]		16_2_048A2D8A
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048A2D8A mov eax, dword ptr fs:[00000030h]		16_2_048A2D8A
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048DA185 mov eax, dword ptr fs:[00000030h]		16_2_048DA185
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048CC182 mov eax, dword ptr fs:[00000030h]		16_2_048CC182
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048DFD9B mov eax, dword ptr fs:[00000030h]		16_2_048DFD9B
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048DFD9B mov eax, dword ptr fs:[00000030h]		16_2_048DFD9B
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048D35A1 mov eax, dword ptr fs:[00000030h]		16_2_048D35A1
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04958DF1 mov eax, dword ptr fs:[00000030h]		16_2_04958DF1
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048AB1E1 mov eax, dword ptr fs:[00000030h]		16_2_048AB1E1
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048AB1E1 mov eax, dword ptr fs:[00000030h]		16_2_048AB1E1
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048AB1E1 mov eax, dword ptr fs:[00000030h]		16_2_048AB1E1
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048A9100 mov eax, dword ptr fs:[00000030h]		16_2_048A9100
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048A9100 mov eax, dword ptr fs:[00000030h]		16_2_048A9100
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048A9100 mov eax, dword ptr fs:[00000030h]		16_2_048A9100
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04978D34 mov eax, dword ptr fs:[00000030h]		16_2_04978D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_0492A537 mov eax, dword ptr fs:[00000030h]		16_2_0492A537
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048C4120 mov eax, dword ptr fs:[00000030h]		16_2_048C4120
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048C4120 mov eax, dword ptr fs:[00000030h]		16_2_048C4120
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048C4120 mov eax, dword ptr fs:[00000030h]		16_2_048C4120
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048C4120 mov eax, dword ptr fs:[00000030h]		16_2_048C4120
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048C4120 mov ecx, dword ptr fs:[00000030h]		16_2_048C4120
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048D4D3B mov eax, dword ptr fs:[00000030h]		16_2_048D4D3B
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048D4D3B mov eax, dword ptr fs:[00000030h]		16_2_048D4D3B
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048D4D3B mov eax, dword ptr fs:[00000030h]		16_2_048D4D3B
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048D513A mov eax, dword ptr fs:[00000030h]		16_2_048D513A
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048D513A mov eax, dword ptr fs:[00000030h]		16_2_048D513A
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048AAD30 mov eax, dword ptr fs:[00000030h]		16_2_048AAD30
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048B3D34 mov eax, dword ptr fs:[00000030h]		16_2_048B3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048B3D34 mov eax, dword ptr fs:[00000030h]		16_2_048B3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048B3D34 mov eax, dword ptr fs:[00000030h]		16_2_048B3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048B3D34 mov eax, dword ptr fs:[00000030h]		16_2_048B3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048B3D34 mov eax, dword ptr fs:[00000030h]		16_2_048B3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048B3D34 mov eax, dword ptr fs:[00000030h]		16_2_048B3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048B3D34 mov eax, dword ptr fs:[00000030h]		16_2_048B3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048B3D34 mov eax, dword ptr fs:[00000030h]		16_2_048B3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048B3D34 mov eax, dword ptr fs:[00000030h]		16_2_048B3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048B3D34 mov eax, dword ptr fs:[00000030h]		16_2_048B3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048B3D34 mov eax, dword ptr fs:[00000030h]		16_2_048B3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048B3D34 mov eax, dword ptr fs:[00000030h]		16_2_048B3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048B3D34 mov eax, dword ptr fs:[00000030h]		16_2_048B3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048CB944 mov eax, dword ptr fs:[00000030h]		16_2_048CB944
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048CB944 mov eax, dword ptr fs:[00000030h]		16_2_048CB944
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E3D43 mov eax, dword ptr fs:[00000030h]		16_2_048E3D43
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04923540 mov eax, dword ptr fs:[00000030h]		16_2_04923540
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048C7D50 mov eax, dword ptr fs:[00000030h]		16_2_048C7D50
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048AB171 mov eax, dword ptr fs:[00000030h]		16_2_048AB171
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048AB171 mov eax, dword ptr fs:[00000030h]		16_2_048AB171
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048CC577 mov eax, dword ptr fs:[00000030h]		16_2_048CC577
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048CC577 mov eax, dword ptr fs:[00000030h]		16_2_048CC577
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_0493FE87 mov eax, dword ptr fs:[00000030h]		16_2_0493FE87
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048DD294 mov eax, dword ptr fs:[00000030h]		16_2_048DD294
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048DD294 mov eax, dword ptr fs:[00000030h]		16_2_048DD294
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048A52A5 mov eax, dword ptr fs:[00000030h]		16_2_048A52A5
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048A52A5 mov eax, dword ptr fs:[00000030h]		16_2_048A52A5
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048A52A5 mov eax, dword ptr fs:[00000030h]		16_2_048A52A5
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048A52A5 mov eax, dword ptr fs:[00000030h]		16_2_048A52A5
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048A52A5 mov eax, dword ptr fs:[00000030h]		16_2_048A52A5
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04970EA5 mov eax, dword ptr fs:[00000030h]		16_2_04970EA5
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04970EA5 mov eax, dword ptr fs:[00000030h]		16_2_04970EA5
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04970EA5 mov eax, dword ptr fs:[00000030h]		16_2_04970EA5
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_049246A7 mov eax, dword ptr fs:[00000030h]		16_2_049246A7
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048BAAB0 mov eax, dword ptr fs:[00000030h]		16_2_048BAAB0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048BAAB0 mov eax, dword ptr fs:[00000030h]		16_2_048BAAB0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048DFAB0 mov eax, dword ptr fs:[00000030h]		16_2_048DFAB0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_04978ED6 mov eax, dword ptr fs:[00000030h]		16_2_04978ED6
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048D36CC mov eax, dword ptr fs:[00000030h]		16_2_048D36CC
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048E8EC7 mov eax, dword ptr fs:[00000030h]		16_2_048E8EC7
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_0495FEC0 mov eax, dword ptr fs:[00000030h]		16_2_0495FEC0
Source: C:\Windows\SysWOW64\control.exe	Code function: 16_2_048B76E2 mov eax, dword ptr fs:[00000030h]		16_2_048B76E2

Enables debug privileges

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Novi poredak.exe	Memory allocated: C:\Program Files (x86)\Internet Explorer\ieinstal.exe base: 10410000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\Novi poredak.exe	Memory allocated: C:\Program Files (x86)\Internet Explorer\ieinstal.exe base: 2DC0000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\Novi poredak.exe	Memory allocated: C:\Program Files (x86)\Internet Explorer\ieinstal.exe base: 2DD0000 protect: page execute and read and write			Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\Novi poredak.exe

Thread created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe EIP: 2DD0000

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Novi poredak.exe

Memory written: C:\Program Files (x86)\Internet Explorer\ieinstal.exe base: 10410000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Section loaded: unknown target: C:\Windows\SysWOW64\control.exe protection: execute and read and write			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Section loaded: unknown target: C:\Windows\SysWOW64\control.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Thread register set: target process: 3388			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Thread register set: target process: 3388			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Novi poredak.exe	Memory written: C:\Program Files (x86)\Internet Explorer\ieinstal.exe base: 10410000			Jump to behavior
Source: C:\Users\user\Desktop\Novi poredak.exe	Memory written: C:\Program Files (x86)\Internet Explorer\ieinstal.exe base: 2DC0000			Jump to behavior
Source: C:\Users\user\Desktop\Novi poredak.exe	Memory written: C:\Program Files (x86)\Internet Explorer\ieinstal.exe base: 2DD0000			Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\Novi poredak.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c copy 'C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data' 'C:\Users\user\AppData\Local\Temp\DB1' /V			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: explorer.exe, 0000000C.00000000.309312066.0000000001398000.00000004.00000020.sdmp	Binary or memory string: ProgmanamF
Source: explorer.exe, 0000000C.00000000.310079080.0000000001980000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 0000000C.00000000.337250848.000000000871F000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000C.00000000.310079080.0000000001980000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000000C.00000000.310079080.0000000001980000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Stealing of Sensitive Information:

Yara detected FormBook

Source: Yara match	File source: 0000000B.00000002.359869128.0000000004CA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.481396669.0000000000670000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.484546978.0000000002D80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.360930357.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.359837993.0000000004C70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 11.2.ieinstal.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.ieinstal.exe.10410000.3.unpack, type: UNPACKEDPE

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\control.exe	File opened: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file access)

Source: C:\Windows\SysWOW64\control.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Remote Access Functionality:

Yara detected FormBook

Source: Yara match	File source: 0000000B.00000002.359869128.0000000004CA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.481396669.0000000000670000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.484546978.0000000002D80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.360930357.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.359837993.0000000004C70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 11.2.ieinstal.exe.10410000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.ieinstal.exe.10410000.3.unpack, type: UNPACKEDPE