Analysis Report 211094.exe

AV Detection:

Multi AV Scanner detection for submitted file

Source: 211094.exe

ReversingLabs: Detection: 22%

Yara detected FormBook

Source: Yara match	File source: 00000009.00000002.587412850.00000000006F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.587981327.0000000000B30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.587932425.0000000000B00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.404736024.000000001E290000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.399177906.0000000000080000.00000040.00000001.sdmp, type: MEMORY

Antivirus or Machine Learning detection for unpacked file

Source: 9.2.explorer.exe.983ea0.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 9.2.explorer.exe.4fc7960.5.unpack	Avira: Label: TR/Dropper.Gen

Compliance:

Uses 32bit PE files

Source: 211094.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 142.250.184.65:443 -> 192.168.2.6:49727 version: TLS 1.2

Binary contains paths to debug symbols

Source:	Binary string: explorer.pdbUGP source: 211094.exe, 00000004.00000002.407424749.000000001E7F0000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000006.00000000.384686029.000000000DC20000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: 211094.exe, 00000004.00000002.404809631.000000001E4C0000.00000040.00000001.sdmp, explorer.exe, 00000009.00000002.591474852.0000000004BAF000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: 211094.exe, explorer.exe
Source:	Binary string: explorer.pdb source: 211094.exe, 00000004.00000002.407424749.000000001E7F0000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000006.00000000.384686029.000000000DC20000.00000002.00000001.sdmp

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49743 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49743 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49743 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49751 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49751 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49751 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49752 -> 34.98.99.30:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49752 -> 34.98.99.30:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49752 -> 34.98.99.30:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49753 -> 198.54.117.211:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49753 -> 198.54.117.211:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49753 -> 198.54.117.211:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49759 -> 18.189.205.91:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49759 -> 18.189.205.91:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49759 -> 18.189.205.91:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49760 -> 199.79.62.169:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49760 -> 199.79.62.169:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49760 -> 199.79.62.169:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49763 -> 185.230.60.102:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49763 -> 185.230.60.102:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49763 -> 185.230.60.102:80

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=Rufvx1jOsytop1bvq44D8J5BrA1Sf94ZUOtMBwRkz2TXMocihNedTu7uPJah09VVn9/XRzeeTw==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.guidedcommercialloan.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=e6cahffjztzcamJ4O+DKrhaQB5hRPzkwIvwlBHpDvSFa4AI+euUXko8WJypl60YQUdNY72tcfQ==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.discbrakepart.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=0/NeuyozxGBDMX4HAZN4yfkirUgQuZO/PqS7luZp/cW8TZEJ+m/Qgd9wiqPWKwH99MCiE7v8pw==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.truckrev.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=y5UfgZt3axNXxKUKNxQBC2DBWQuEwdDoKwpextWmXL4AH1jfcUOFtuVQVuhxYhhogQppfaQ4MQ==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.quartiercreole.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=zuFquqmMcvMIVTA8KC8hAytFTzaQhDtWEj5Y6a4mHxGfCyQF/Xb/aYQpFx1LlkGMT0GVZlYKNw==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.wissinkadams.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=0E3C5mUHlRauL0/Y7Bp5k7qydJv7c0I2M1waktstgn1SsRqH7XaUeeB0rPzY/gY6TfHCuVFaFw==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.shopping-container.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=VoDnAKif46zuoDGUOYPF8CFht3P91IwI50ppSsuc6FjbQwYrNosv2kcASbfxHajA03pQPAi11g==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.azhello.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=M0uFvISRXYRHVkOb0AJBAd7B/InOE9ksckU2zFobX8RttE5IKM9SRPMAdsze42ip49A2WvKiMw==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.africabiocity.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=tlIjdtxg+6ss6GeFkxkNX/Gta+EnXEkPHxZQNKO5opTQPj/ZdNFPdnHw1EJZhrtLdJv1ORZ2Rg==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.nhadat9chu.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=2Mu6jGWgIoofF63Ti3l/Zo55WQUYmkW4MO9hv8QsoUu7nlZl5gregCIikYrtIUhyBUOiCNofoA==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.kfs.ltdConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=AbpHtwwPcjqVDvg4bYXWsG8P5KsLAA+yhQvslNw16RaUmuaJNxrIVWhvxUk5BU5rJ318S0XyEg==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.lvlyourlife.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 160.153.136.3 160.153.136.3

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=Rufvx1jOsytop1bvq44D8J5BrA1Sf94ZUOtMBwRkz2TXMocihNedTu7uPJah09VVn9/XRzeeTw==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.guidedcommercialloan.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=e6cahffjztzcamJ4O+DKrhaQB5hRPzkwIvwlBHpDvSFa4AI+euUXko8WJypl60YQUdNY72tcfQ==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.discbrakepart.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=0/NeuyozxGBDMX4HAZN4yfkirUgQuZO/PqS7luZp/cW8TZEJ+m/Qgd9wiqPWKwH99MCiE7v8pw==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.truckrev.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=y5UfgZt3axNXxKUKNxQBC2DBWQuEwdDoKwpextWmXL4AH1jfcUOFtuVQVuhxYhhogQppfaQ4MQ==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.quartiercreole.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=zuFquqmMcvMIVTA8KC8hAytFTzaQhDtWEj5Y6a4mHxGfCyQF/Xb/aYQpFx1LlkGMT0GVZlYKNw==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.wissinkadams.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=0E3C5mUHlRauL0/Y7Bp5k7qydJv7c0I2M1waktstgn1SsRqH7XaUeeB0rPzY/gY6TfHCuVFaFw==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.shopping-container.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=VoDnAKif46zuoDGUOYPF8CFht3P91IwI50ppSsuc6FjbQwYrNosv2kcASbfxHajA03pQPAi11g==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.azhello.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=M0uFvISRXYRHVkOb0AJBAd7B/InOE9ksckU2zFobX8RttE5IKM9SRPMAdsze42ip49A2WvKiMw==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.africabiocity.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=tlIjdtxg+6ss6GeFkxkNX/Gta+EnXEkPHxZQNKO5opTQPj/ZdNFPdnHw1EJZhrtLdJv1ORZ2Rg==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.nhadat9chu.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=2Mu6jGWgIoofF63Ti3l/Zo55WQUYmkW4MO9hv8QsoUu7nlZl5gregCIikYrtIUhyBUOiCNofoA==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.kfs.ltdConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /iae2/?Cb=AbpHtwwPcjqVDvg4bYXWsG8P5KsLAA+yhQvslNw16RaUmuaJNxrIVWhvxUk5BU5rJ318S0XyEg==&uVjH=yVCTVb0XT254cnY HTTP/1.1Host: www.lvlyourlife.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: doc-0k-78-docs.googleusercontent.com

Tries to download or post to a non-existing http route (HTTP/1.1 404 Not Found / 503 Service Unavailable)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 25 Feb 2021 14:49:41 GMTContent-Type: text/htmlContent-Length: 153Connection: closeServer: nginx/1.16.1Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.16.1</center></body></html>

Urls found in memory or binary data

Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000006.00000002.588091491.000000000095C000.00000004.00000020.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000006.00000000.383924235.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: 211094.exe	String found in binary or memory: https://drive.google.com/uc?export=download&id=1wx8v1bksmyfmjfmnDtrZxoKIzOnkTyrU
Source: explorer.exe, 00000009.00000002.592642796.0000000005142000.00000004.00000001.sdmp	String found in binary or memory: https://www.kfs.ltd/iae2?Cb=2Mu6jGWgIoofF63Ti3l%2FZo55WQUYmkW4MO9hv8QsoUu7nlZl5gregCIikYrtIUhyBUOiCN

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 142.250.184.65:443 -> 192.168.2.6:49727 version: TLS 1.2

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 00000009.00000002.587412850.00000000006F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.587981327.0000000000B30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.587932425.0000000000B00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.404736024.000000001E290000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.399177906.0000000000080000.00000040.00000001.sdmp, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Source: 00000009.00000002.587412850.00000000006F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.587412850.00000000006F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.587981327.0000000000B30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.587981327.0000000000B30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.587932425.0000000000B00000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.587932425.0000000000B00000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.404736024.000000001E290000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.404736024.000000001E290000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.587887659.0000000000983000.00000004.00000020.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 00000004.00000002.399177906.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.399177906.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.592534520.0000000004FC7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth

Contains functionality to call native functions

Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02295C7C NtProtectVirtualMemory,		0_2_02295C7C
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_022904A2 EnumWindows,NtSetInformationThread,		0_2_022904A2
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02292D2E NtSetInformationThread,NtWriteVirtualMemory,		0_2_02292D2E
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02296167 NtSetInformationThread,NtWriteVirtualMemory,NtResumeThread,		0_2_02296167
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291627 NtSetInformationThread,NtWriteVirtualMemory,		0_2_02291627
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_0229261A NtWriteVirtualMemory,		0_2_0229261A
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02294E54 NtWriteVirtualMemory,		0_2_02294E54
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_0229228C NtWriteVirtualMemory,		0_2_0229228C
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_022962EF NtResumeThread,		0_2_022962EF
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_022962F2 NtResumeThread,		0_2_022962F2
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_022922F5 NtWriteVirtualMemory,		0_2_022922F5
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_022926D9 NtWriteVirtualMemory,		0_2_022926D9
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_022927BD NtWriteVirtualMemory,		0_2_022927BD
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_022927DC NtWriteVirtualMemory,		0_2_022927DC
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02293C21 NtSetInformationThread,		0_2_02293C21
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02292831 NtWriteVirtualMemory,		0_2_02292831
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02296405 NtResumeThread,		0_2_02296405
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02292455 NtWriteVirtualMemory,		0_2_02292455
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_022924A9 NtWriteVirtualMemory,		0_2_022924A9
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_022904AB EnumWindows,NtSetInformationThread,		0_2_022904AB
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_0229288F NtWriteVirtualMemory,		0_2_0229288F
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_022928ED NtWriteVirtualMemory,		0_2_022928ED
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_0229213D NtWriteVirtualMemory,		0_2_0229213D
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02290500 NtSetInformationThread,		0_2_02290500
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02290504 NtSetInformationThread,		0_2_02290504
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_0229256D NtWriteVirtualMemory,		0_2_0229256D
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_0229056D NtSetInformationThread,		0_2_0229056D
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_0229616D NtResumeThread,		0_2_0229616D
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_022905BD NtSetInformationThread,TerminateProcess,		0_2_022905BD
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02292999 NtWriteVirtualMemory,		0_2_02292999
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_0229659C NtWriteVirtualMemory,		0_2_0229659C
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02292D95 NtSetInformationThread,		0_2_02292D95
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02292596 NtWriteVirtualMemory,		0_2_02292596
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_022929CD NtWriteVirtualMemory,		0_2_022929CD
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_022925CE NtWriteVirtualMemory,		0_2_022925CE
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529660 NtAllocateVirtualMemory,LdrInitializeThunk,		4_2_1E529660
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5296E0 NtFreeVirtualMemory,LdrInitializeThunk,		4_2_1E5296E0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529710 NtQueryInformationToken,LdrInitializeThunk,		4_2_1E529710
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529FE0 NtCreateMutant,LdrInitializeThunk,		4_2_1E529FE0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529780 NtMapViewOfSection,LdrInitializeThunk,		4_2_1E529780
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5297A0 NtUnmapViewOfSection,LdrInitializeThunk,		4_2_1E5297A0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529540 NtReadFile,LdrInitializeThunk,		4_2_1E529540
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5295D0 NtClose,LdrInitializeThunk,		4_2_1E5295D0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529A50 NtCreateFile,LdrInitializeThunk,		4_2_1E529A50
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529A00 NtProtectVirtualMemory,LdrInitializeThunk,		4_2_1E529A00
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529A20 NtResumeThread,LdrInitializeThunk,		4_2_1E529A20
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529840 NtDelayExecution,LdrInitializeThunk,		4_2_1E529840
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529860 NtQuerySystemInformation,LdrInitializeThunk,		4_2_1E529860
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5298F0 NtReadVirtualMemory,LdrInitializeThunk,		4_2_1E5298F0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529910 NtAdjustPrivilegesToken,LdrInitializeThunk,		4_2_1E529910
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5299A0 NtCreateSection,LdrInitializeThunk,		4_2_1E5299A0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529650 NtQueryValueKey,		4_2_1E529650
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529670 NtQueryInformationProcess,		4_2_1E529670
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529610 NtEnumerateValueKey,		4_2_1E529610
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5296D0 NtCreateKey,		4_2_1E5296D0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E52A770 NtOpenThread,		4_2_1E52A770
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529770 NtSetInformationFile,		4_2_1E529770
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529760 NtOpenProcess,		4_2_1E529760
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E52A710 NtOpenProcessToken,		4_2_1E52A710
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529730 NtQueryVirtualMemory,		4_2_1E529730
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529560 NtWriteFile,		4_2_1E529560
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E52AD30 NtSetContextThread,		4_2_1E52AD30
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529520 NtWaitForSingleObject,		4_2_1E529520
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5295F0 NtQueryInformationFile,		4_2_1E5295F0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529A10 NtQuerySection,		4_2_1E529A10
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529A80 NtOpenDirectoryObject,		4_2_1E529A80
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529B00 NtSetValueKey,		4_2_1E529B00
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E52A3B0 NtGetContextThread,		4_2_1E52A3B0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E52B040 NtSuspendThread,		4_2_1E52B040
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529820 NtEnumerateKey,		4_2_1E529820
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5298A0 NtWriteVirtualMemory,		4_2_1E5298A0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E529950 NtQueueApcThread,		4_2_1E529950
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5299D0 NtCreateProcessEx,		4_2_1E5299D0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_00565C7C NtProtectVirtualMemory,		4_2_00565C7C
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_00566167 NtQueryInformationProcess,		4_2_00566167
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_00566405 NtQueryInformationProcess,		4_2_00566405
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_0056616D NtQueryInformationProcess,		4_2_0056616D
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_005662F2 NtQueryInformationProcess,		4_2_005662F2
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_005662EF NtQueryInformationProcess,		4_2_005662EF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF95D0 NtClose,LdrInitializeThunk,		9_2_04AF95D0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9540 NtReadFile,LdrInitializeThunk,		9_2_04AF9540
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF96E0 NtFreeVirtualMemory,LdrInitializeThunk,		9_2_04AF96E0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF96D0 NtCreateKey,LdrInitializeThunk,		9_2_04AF96D0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9660 NtAllocateVirtualMemory,LdrInitializeThunk,		9_2_04AF9660
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9650 NtQueryValueKey,LdrInitializeThunk,		9_2_04AF9650
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9780 NtMapViewOfSection,LdrInitializeThunk,		9_2_04AF9780
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9FE0 NtCreateMutant,LdrInitializeThunk,		9_2_04AF9FE0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9710 NtQueryInformationToken,LdrInitializeThunk,		9_2_04AF9710
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9860 NtQuerySystemInformation,LdrInitializeThunk,		9_2_04AF9860
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9840 NtDelayExecution,LdrInitializeThunk,		9_2_04AF9840
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF99A0 NtCreateSection,LdrInitializeThunk,		9_2_04AF99A0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9910 NtAdjustPrivilegesToken,LdrInitializeThunk,		9_2_04AF9910
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9A50 NtCreateFile,LdrInitializeThunk,		9_2_04AF9A50
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF95F0 NtQueryInformationFile,		9_2_04AF95F0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9520 NtWaitForSingleObject,		9_2_04AF9520
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AFAD30 NtSetContextThread,		9_2_04AFAD30
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9560 NtWriteFile,		9_2_04AF9560
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9610 NtEnumerateValueKey,		9_2_04AF9610
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9670 NtQueryInformationProcess,		9_2_04AF9670
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF97A0 NtUnmapViewOfSection,		9_2_04AF97A0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9730 NtQueryVirtualMemory,		9_2_04AF9730
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AFA710 NtOpenProcessToken,		9_2_04AFA710
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9760 NtOpenProcess,		9_2_04AF9760
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AFA770 NtOpenThread,		9_2_04AFA770
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9770 NtSetInformationFile,		9_2_04AF9770
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF98A0 NtWriteVirtualMemory,		9_2_04AF98A0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF98F0 NtReadVirtualMemory,		9_2_04AF98F0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9820 NtEnumerateKey,		9_2_04AF9820
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AFB040 NtSuspendThread,		9_2_04AFB040
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF99D0 NtCreateProcessEx,		9_2_04AF99D0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9950 NtQueueApcThread,		9_2_04AF9950
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9A80 NtOpenDirectoryObject,		9_2_04AF9A80
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9A20 NtResumeThread,		9_2_04AF9A20
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9A00 NtProtectVirtualMemory,		9_2_04AF9A00
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9A10 NtQuerySection,		9_2_04AF9A10
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AFA3B0 NtGetContextThread,		9_2_04AFA3B0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF9B00 NtSetValueKey,		9_2_04AF9B00
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_007081C0 NtCreateFile,		9_2_007081C0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_00708270 NtReadFile,		9_2_00708270
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_007082F0 NtClose,		9_2_007082F0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_007083A0 NtAllocateVirtualMemory,		9_2_007083A0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_007081BD NtCreateFile,		9_2_007081BD
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_0070826A NtReadFile,		9_2_0070826A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_00708212 NtReadFile,		9_2_00708212
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_007082EA NtClose,		9_2_007082EA
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_0070839D NtAllocateVirtualMemory,		9_2_0070839D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_0070841A NtAllocateVirtualMemory,		9_2_0070841A

Detected potential crypto function

Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_00401348		0_2_00401348
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_00401365		0_2_00401365
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5AD616		4_2_1E5AD616
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E506E30		4_2_1E506E30
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B2EF7		4_2_1E5B2EF7
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5BDFCE		4_2_1E5BDFCE
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B1FF1		4_2_1E5B1FF1
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5AD466		4_2_1E5AD466
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F841F		4_2_1E4F841F
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B1D55		4_2_1E5B1D55
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B2D07		4_2_1E5B2D07
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E0D20		4_2_1E4E0D20
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B25DD		4_2_1E5B25DD
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4FD5E0		4_2_1E4FD5E0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E512581		4_2_1E512581
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B22AE		4_2_1E5B22AE
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B2B28		4_2_1E5B2B28
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A03DA		4_2_1E5A03DA
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5ADBD2		4_2_1E5ADBD2
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51EBB0		4_2_1E51EBB0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A1002		4_2_1E5A1002
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5BE824		4_2_1E5BE824
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B28EC		4_2_1E5B28EC
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4FB090		4_2_1E4FB090
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5120A0		4_2_1E5120A0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B20A8		4_2_1E5B20A8
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4EF900		4_2_1E4EF900
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E504120		4_2_1E504120
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC841F		9_2_04AC841F
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B7D466		9_2_04B7D466
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE2581		9_2_04AE2581
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ACD5E0		9_2_04ACD5E0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B825DD		9_2_04B825DD
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AB0D20		9_2_04AB0D20
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B82D07		9_2_04B82D07
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B81D55		9_2_04B81D55
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B82EF7		9_2_04B82EF7
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AD6E30		9_2_04AD6E30
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B7D616		9_2_04B7D616
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B81FF1		9_2_04B81FF1
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B8DFCE		9_2_04B8DFCE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE20A0		9_2_04AE20A0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B820A8		9_2_04B820A8
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ACB090		9_2_04ACB090
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B828EC		9_2_04B828EC
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B8E824		9_2_04B8E824
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ADA830		9_2_04ADA830
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B71002		9_2_04B71002
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AD99BF		9_2_04AD99BF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AD4120		9_2_04AD4120
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ABF900		9_2_04ABF900
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B822AE		9_2_04B822AE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B6FA2B		9_2_04B6FA2B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AEEBB0		9_2_04AEEBB0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B7DBD2		9_2_04B7DBD2
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B703DA		9_2_04B703DA
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B82B28		9_2_04B82B28
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ADAB40		9_2_04ADAB40
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_006F8C60		9_2_006F8C60
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_0070C5BD		9_2_0070C5BD
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_006F2D87		9_2_006F2D87
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_006F2D90		9_2_006F2D90
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_006F2FB0		9_2_006F2FB0

Found potential string decryption / allocating functions

Source: C:\Windows\SysWOW64\explorer.exe	Code function: String function: 04ABB150 appears 72 times
Source: C:\Users\user\Desktop\211094.exe	Code function: String function: 1E4EB150 appears 45 times

PE file contains strange resources

Source: 211094.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 211094.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: 211094.exe, 00000000.00000002.339451864.0000000002260000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs 211094.exe
Source: 211094.exe, 00000000.00000000.318342223.0000000000416000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSKUMLERIERNE.exe vs 211094.exe
Source: 211094.exe, 00000000.00000002.339491184.00000000022C0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSKUMLERIERNE.exeFE2XTeltplsu vs 211094.exe
Source: 211094.exe, 00000004.00000002.408131386.000000001EB3E000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameEXPLORER.EXEj% vs 211094.exe
Source: 211094.exe, 00000004.00000002.407362131.000000001E76F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 211094.exe
Source: 211094.exe, 00000004.00000002.404606856.000000001DDA0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs 211094.exe
Source: 211094.exe, 00000004.00000000.337376018.0000000000416000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSKUMLERIERNE.exe vs 211094.exe
Source: 211094.exe, 00000004.00000002.404623819.000000001DEF0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs 211094.exe
Source: 211094.exe	Binary or memory string: OriginalFilenameSKUMLERIERNE.exe vs 211094.exe

Uses 32bit PE files

Source: 211094.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Yara signature match

Source: 00000009.00000002.587412850.00000000006F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.587412850.00000000006F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.587981327.0000000000B30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.587981327.0000000000B30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.587932425.0000000000B00000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.587932425.0000000000B00000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.404736024.000000001E290000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.404736024.000000001E290000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.587887659.0000000000983000.00000004.00000020.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000004.00000002.399177906.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.399177906.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.592534520.0000000004FC7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/

Classification label

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/0@15/9

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6700:120:WilError_01

Creates temporary files

Source: C:\Users\user\Desktop\211094.exe

File created: C:\Users\user\AppData\Local\Temp\~DF3FDFCBABC45FEEF5.TMP

Jump to behavior

Launches a second explorer.exe instance

Source: unknown

Process created: C:\Windows\SysWOW64\explorer.exe

PE file has an executable .text section and no other executable section

Source: 211094.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Source: C:\Users\user\Desktop\211094.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\211094.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Users\user\Desktop\211094.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\211094.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\211094.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: 211094.exe

ReversingLabs: Detection: 22%

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\211094.exe 'C:\Users\user\Desktop\211094.exe'
Source: unknown	Process created: C:\Users\user\Desktop\211094.exe 'C:\Users\user\Desktop\211094.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\211094.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\211094.exe	Process created: C:\Users\user\Desktop\211094.exe 'C:\Users\user\Desktop\211094.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\211094.exe'			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{317D06E8-5F24-433D-BDF7-79CE68D8ABC2}\InProcServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Binary contains paths to debug symbols

Source:	Binary string: explorer.pdbUGP source: 211094.exe, 00000004.00000002.407424749.000000001E7F0000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000006.00000000.384686029.000000000DC20000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: 211094.exe, 00000004.00000002.404809631.000000001E4C0000.00000040.00000001.sdmp, explorer.exe, 00000009.00000002.591474852.0000000004BAF000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: 211094.exe, explorer.exe
Source:	Binary string: explorer.pdb source: 211094.exe, 00000004.00000002.407424749.000000001E7F0000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000006.00000000.384686029.000000000DC20000.00000002.00000001.sdmp

Data Obfuscation:

Yara detected GuLoader

Source: Yara match	File source: 00000004.00000002.399305439.0000000000562000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 211094.exe PID: 6984, type: MEMORY
Source: Yara match	File source: Process Memory Space: 211094.exe PID: 1872, type: MEMORY

Yara detected VB6 Downloader Generic

Source: Yara match	File source: Process Memory Space: 211094.exe PID: 6984, type: MEMORY
Source: Yara match	File source: Process Memory Space: 211094.exe PID: 1872, type: MEMORY

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_00407F3A push es; retn 2ADCh		0_2_00407FE5
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_004077E6 push ss; retf		0_2_004077E7
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291A56 push edi; retf		0_2_02291A6E
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291B27 push edi; retf		0_2_02291BAA
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291B6D push edi; retf		0_2_02291B85
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291BB0 push edi; retf		0_2_02291BAA
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291B8A push edi; retf		0_2_02291B85
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291B8A push edi; retf		0_2_02291BAA
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291CAB push edi; retf		0_2_02291CC3
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291D33 push edi; retf		0_2_02291D2E
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291D33 push edi; retf		0_2_02291D53
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291D16 push edi; retf		0_2_02291D2E
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291D59 push edi; retf		0_2_02291D53
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_022919EF push edi; retf		0_2_02291A6E
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_022919EF push edi; retf		0_2_02291A93
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E53D0D1 push ecx; ret		4_2_1E53D0E4
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_00564109 pushfd ; retf		4_2_0056410A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B0D0D1 push ecx; ret		9_2_04B0D0E4
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_0070B3B5 push eax; ret		9_2_0070B408
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_0070B46C push eax; ret		9_2_0070B472
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_0070B402 push eax; ret		9_2_0070B408
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_0070B40B push eax; ret		9_2_0070B472

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\211094.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\211094.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\211094.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\211094.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\211094.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\211094.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\211094.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291627 NtSetInformationThread,NtWriteVirtualMemory,		0_2_02291627
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291671		0_2_02291671
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291645		0_2_02291645
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291AA5		0_2_02291AA5
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_022916BB		0_2_022916BB
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291A9E		0_2_02291A9E
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291A94		0_2_02291A94
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_022916F5		0_2_022916F5
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291B27		0_2_02291B27
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_0229179F		0_2_0229179F
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_022917E9		0_2_022917E9
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291BD5		0_2_02291BD5
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291835		0_2_02291835
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291888		0_2_02291888
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291C9C		0_2_02291C9C
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_022918F5		0_2_022918F5
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291948		0_2_02291948
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291995		0_2_02291995
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_022919EF		0_2_022919EF

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Source: C:\Users\user\Desktop\211094.exe	RDTSC instruction interceptor: First address: 00000000022930E8 second address: 00000000022930E8 instructions:
Source: C:\Users\user\Desktop\211094.exe	RDTSC instruction interceptor: First address: 00000000022964EA second address: 00000000022964EA instructions:

Tries to detect Any.run

Source: C:\Users\user\Desktop\211094.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe			Jump to behavior
Source: C:\Users\user\Desktop\211094.exe	File opened: C:\Program Files\qga\qga.exe			Jump to behavior
Source: C:\Users\user\Desktop\211094.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe			Jump to behavior
Source: C:\Users\user\Desktop\211094.exe	File opened: C:\Program Files\qga\qga.exe			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 211094.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\211094.exe	RDTSC instruction interceptor: First address: 00000000022930E8 second address: 00000000022930E8 instructions:
Source: C:\Users\user\Desktop\211094.exe	RDTSC instruction interceptor: First address: 00000000022964EA second address: 00000000022964EA instructions:
Source: C:\Users\user\Desktop\211094.exe	RDTSC instruction interceptor: First address: 0000000000564EA9 second address: 0000000000564EA9 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b inc cx 0x0000000d jmp 00007FE96CD147BCh 0x0000000f test bh, bh 0x00000011 mov eax, dword ptr [ebp+64h] 0x00000014 mov bx, word ptr [edx+00010040h] 0x0000001b jmp 00007FE96CD14832h 0x0000001d test bh, ch 0x0000001f mov ax, word ptr [eax] 0x00000022 xor ax, cx 0x00000025 xor bx, ax 0x00000028 test cl, FFFFFFF6h 0x0000002b cmp bx, 5A4Dh 0x00000030 je 00007FE96CD1482Bh 0x00000032 pushad 0x00000033 lfence 0x00000036 rdtsc
Source: C:\Users\user\Desktop\211094.exe	RDTSC instruction interceptor: First address: 0000000000561A42 second address: 0000000000561D0A instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 test ah, ah 0x00000005 cmp dword ptr [edi+00000814h], 00000000h 0x0000000c je 00007FE96C4D6894h 0x00000012 test bl, dl 0x00000014 pushad 0x00000015 mov edx, 00000024h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\211094.exe	RDTSC instruction interceptor: First address: 0000000000561D0A second address: 0000000000561DEB instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 call 00007FE96CD14D7Dh 0x00000008 test dx, dx 0x0000000b cmp dword ptr [edi+00000818h], 00000000h 0x00000012 je 00007FE96CD148C4h 0x00000018 ret 0x00000019 test ah, ah 0x0000001b jmp 00007FE96CD1485Ch 0x0000001d mov eax, dword ptr fs:[00000030h] 0x00000023 mov eax, dword ptr [eax+0Ch] 0x00000026 jmp 00007FE96CD1482Eh 0x00000028 cmp bh, bh 0x0000002a mov eax, dword ptr [eax+0Ch] 0x0000002d cmp ch, ch 0x0000002f test edi, 19CD959Eh 0x00000035 test bl, al 0x00000037 test cx, 9800h 0x0000003c mov ecx, dword ptr [edi+00000808h] 0x00000042 cmp ah, bh 0x00000044 jmp 00007FE96CD14819h 0x00000046 test esi, 8F9A929Dh 0x0000004c mov dword ptr [eax+20h], ecx 0x0000004f mov esi, dword ptr [edi+00000800h] 0x00000055 mov dword ptr [eax+18h], esi 0x00000058 add esi, dword ptr [edi+00000850h] 0x0000005e mov dword ptr [eax+1Ch], esi 0x00000061 jmp 00007FE96CD1482Eh 0x00000063 test dl, dl 0x00000065 pushad 0x00000066 lfence 0x00000069 rdtsc
Source: C:\Users\user\Desktop\211094.exe	RDTSC instruction interceptor: First address: 0000000000561DEB second address: 0000000000561E31 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b cmp dword ptr [ebp+70h], 01h 0x0000000f je 00007FE96C4D673Eh 0x00000015 cmp dx, 76A4h 0x0000001a mov esi, edi 0x0000001c add esi, 00001000h 0x00000022 xor ecx, ecx 0x00000024 test bh, bh 0x00000026 cmp bl, bl 0x00000028 push ecx 0x00000029 pushad 0x0000002a mov ah, 77h 0x0000002c cmp ah, 00000077h 0x0000002f jne 00007FE96C4D6C46h 0x00000035 popad 0x00000036 push edi 0x00000037 mov eax, ebp 0x00000039 cmp dx, cx 0x0000003c add eax, 0000009Ch 0x00000041 push eax 0x00000042 pushad 0x00000043 lfence 0x00000046 rdtsc
Source: C:\Users\user\Desktop\211094.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\211094.exe	RDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\explorer.exe	RDTSC instruction interceptor: First address: 00000000006F85E4 second address: 00000000006F85EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\explorer.exe	RDTSC instruction interceptor: First address: 00000000006F897E second address: 00000000006F8984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\211094.exe

Code function: 0_2_02291627 rdtsc

0_2_02291627

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\explorer.exe TID: 2932	Thread sleep time: -45000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 6780	Thread sleep time: -42000s >= -30000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: explorer.exe, 00000006.00000000.380969821.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000006.00000000.380915897.00000000083E9000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000006.00000000.380788568.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000002.600452519.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000006.00000000.376726194.00000000063F6000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.380915897.00000000083E9000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000006.00000000.376726194.00000000063F6000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.380788568.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 00000006.00000002.600452519.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: 211094.exe	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: explorer.exe, 00000006.00000002.600452519.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000006.00000000.380788568.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000006.00000000.380969821.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: explorer.exe, 00000006.00000002.600452519.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: explorer.exe, 00000006.00000002.588091491.000000000095C000.00000004.00000020.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G

Queries a list of all running processes

Source: C:\Users\user\Desktop\211094.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to hide a thread from the debugger

Source: C:\Users\user\Desktop\211094.exe

Code function: 0_2_022904A2 NtSetInformationThread 000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,?,02294B9A

0_2_022904A2

Hides threads from debuggers

Source: C:\Users\user\Desktop\211094.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\211094.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\211094.exe	Thread information set: HideFromDebugger			Jump to behavior

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\211094.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\211094.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\211094.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process queried: DebugPort			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\211094.exe

Code function: 0_2_02291627 rdtsc

0_2_02291627

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\211094.exe

Code function: 0_2_02293349 LdrInitializeThunk,

0_2_02293349

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291627 mov eax, dword ptr fs:[00000030h]		0_2_02291627
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291F39 mov eax, dword ptr fs:[00000030h]		0_2_02291F39
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02294B44 mov eax, dword ptr fs:[00000030h]		0_2_02294B44
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291F91 mov eax, dword ptr fs:[00000030h]		0_2_02291F91
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291F97 mov eax, dword ptr fs:[00000030h]		0_2_02291F97
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02294FE4 mov eax, dword ptr fs:[00000030h]		0_2_02294FE4
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02291FCD mov eax, dword ptr fs:[00000030h]		0_2_02291FCD
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_022957C5 mov eax, dword ptr fs:[00000030h]		0_2_022957C5
Source: C:\Users\user\Desktop\211094.exe	Code function: 0_2_02292D95 mov eax, dword ptr fs:[00000030h]		0_2_02292D95
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F7E41 mov eax, dword ptr fs:[00000030h]		4_2_1E4F7E41
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F7E41 mov eax, dword ptr fs:[00000030h]		4_2_1E4F7E41
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F7E41 mov eax, dword ptr fs:[00000030h]		4_2_1E4F7E41
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F7E41 mov eax, dword ptr fs:[00000030h]		4_2_1E4F7E41
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F7E41 mov eax, dword ptr fs:[00000030h]		4_2_1E4F7E41
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F7E41 mov eax, dword ptr fs:[00000030h]		4_2_1E4F7E41
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5AAE44 mov eax, dword ptr fs:[00000030h]		4_2_1E5AAE44
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5AAE44 mov eax, dword ptr fs:[00000030h]		4_2_1E5AAE44
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F766D mov eax, dword ptr fs:[00000030h]		4_2_1E4F766D
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E50AE73 mov eax, dword ptr fs:[00000030h]		4_2_1E50AE73
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E50AE73 mov eax, dword ptr fs:[00000030h]		4_2_1E50AE73
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E50AE73 mov eax, dword ptr fs:[00000030h]		4_2_1E50AE73
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E50AE73 mov eax, dword ptr fs:[00000030h]		4_2_1E50AE73
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E50AE73 mov eax, dword ptr fs:[00000030h]		4_2_1E50AE73
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51A61C mov eax, dword ptr fs:[00000030h]		4_2_1E51A61C
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51A61C mov eax, dword ptr fs:[00000030h]		4_2_1E51A61C
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4EC600 mov eax, dword ptr fs:[00000030h]		4_2_1E4EC600
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4EC600 mov eax, dword ptr fs:[00000030h]		4_2_1E4EC600
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4EC600 mov eax, dword ptr fs:[00000030h]		4_2_1E4EC600
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E518E00 mov eax, dword ptr fs:[00000030h]		4_2_1E518E00
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A1608 mov eax, dword ptr fs:[00000030h]		4_2_1E5A1608
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E59FE3F mov eax, dword ptr fs:[00000030h]		4_2_1E59FE3F
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4EE620 mov eax, dword ptr fs:[00000030h]		4_2_1E4EE620
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B8ED6 mov eax, dword ptr fs:[00000030h]		4_2_1E5B8ED6
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E528EC7 mov eax, dword ptr fs:[00000030h]		4_2_1E528EC7
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E59FEC0 mov eax, dword ptr fs:[00000030h]		4_2_1E59FEC0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5136CC mov eax, dword ptr fs:[00000030h]		4_2_1E5136CC
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F76E2 mov eax, dword ptr fs:[00000030h]		4_2_1E4F76E2
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5116E0 mov ecx, dword ptr fs:[00000030h]		4_2_1E5116E0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E57FE87 mov eax, dword ptr fs:[00000030h]		4_2_1E57FE87
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5646A7 mov eax, dword ptr fs:[00000030h]		4_2_1E5646A7
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B0EA5 mov eax, dword ptr fs:[00000030h]		4_2_1E5B0EA5
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B0EA5 mov eax, dword ptr fs:[00000030h]		4_2_1E5B0EA5
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B0EA5 mov eax, dword ptr fs:[00000030h]		4_2_1E5B0EA5
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4FEF40 mov eax, dword ptr fs:[00000030h]		4_2_1E4FEF40
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4FFF60 mov eax, dword ptr fs:[00000030h]		4_2_1E4FFF60
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B8F6A mov eax, dword ptr fs:[00000030h]		4_2_1E5B8F6A
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E50F716 mov eax, dword ptr fs:[00000030h]		4_2_1E50F716
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E57FF10 mov eax, dword ptr fs:[00000030h]		4_2_1E57FF10
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E57FF10 mov eax, dword ptr fs:[00000030h]		4_2_1E57FF10
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B070D mov eax, dword ptr fs:[00000030h]		4_2_1E5B070D
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B070D mov eax, dword ptr fs:[00000030h]		4_2_1E5B070D
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51A70E mov eax, dword ptr fs:[00000030h]		4_2_1E51A70E
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51A70E mov eax, dword ptr fs:[00000030h]		4_2_1E51A70E
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E4F2E mov eax, dword ptr fs:[00000030h]		4_2_1E4E4F2E
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E4F2E mov eax, dword ptr fs:[00000030h]		4_2_1E4E4F2E
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51E730 mov eax, dword ptr fs:[00000030h]		4_2_1E51E730
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5237F5 mov eax, dword ptr fs:[00000030h]		4_2_1E5237F5
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E567794 mov eax, dword ptr fs:[00000030h]		4_2_1E567794
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E567794 mov eax, dword ptr fs:[00000030h]		4_2_1E567794
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E567794 mov eax, dword ptr fs:[00000030h]		4_2_1E567794
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F8794 mov eax, dword ptr fs:[00000030h]		4_2_1E4F8794
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E57C450 mov eax, dword ptr fs:[00000030h]		4_2_1E57C450
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E57C450 mov eax, dword ptr fs:[00000030h]		4_2_1E57C450
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51A44B mov eax, dword ptr fs:[00000030h]		4_2_1E51A44B
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E50746D mov eax, dword ptr fs:[00000030h]		4_2_1E50746D
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B740D mov eax, dword ptr fs:[00000030h]		4_2_1E5B740D
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B740D mov eax, dword ptr fs:[00000030h]		4_2_1E5B740D
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B740D mov eax, dword ptr fs:[00000030h]		4_2_1E5B740D
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E5A1C06
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E5A1C06
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E5A1C06
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E5A1C06
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E5A1C06
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E5A1C06
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E5A1C06
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E5A1C06
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E5A1C06
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E5A1C06
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E5A1C06
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E5A1C06
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E5A1C06
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E5A1C06
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E566C0A mov eax, dword ptr fs:[00000030h]		4_2_1E566C0A
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E566C0A mov eax, dword ptr fs:[00000030h]		4_2_1E566C0A
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E566C0A mov eax, dword ptr fs:[00000030h]		4_2_1E566C0A
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E566C0A mov eax, dword ptr fs:[00000030h]		4_2_1E566C0A
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51BC2C mov eax, dword ptr fs:[00000030h]		4_2_1E51BC2C
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B8CD6 mov eax, dword ptr fs:[00000030h]		4_2_1E5B8CD6
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A14FB mov eax, dword ptr fs:[00000030h]		4_2_1E5A14FB
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E566CF0 mov eax, dword ptr fs:[00000030h]		4_2_1E566CF0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E566CF0 mov eax, dword ptr fs:[00000030h]		4_2_1E566CF0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E566CF0 mov eax, dword ptr fs:[00000030h]		4_2_1E566CF0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F849B mov eax, dword ptr fs:[00000030h]		4_2_1E4F849B
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E507D50 mov eax, dword ptr fs:[00000030h]		4_2_1E507D50
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E523D43 mov eax, dword ptr fs:[00000030h]		4_2_1E523D43
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E563540 mov eax, dword ptr fs:[00000030h]		4_2_1E563540
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E593D40 mov eax, dword ptr fs:[00000030h]		4_2_1E593D40
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E50C577 mov eax, dword ptr fs:[00000030h]		4_2_1E50C577
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E50C577 mov eax, dword ptr fs:[00000030h]		4_2_1E50C577
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E56A537 mov eax, dword ptr fs:[00000030h]		4_2_1E56A537
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5AE539 mov eax, dword ptr fs:[00000030h]		4_2_1E5AE539
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E514D3B mov eax, dword ptr fs:[00000030h]		4_2_1E514D3B
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E514D3B mov eax, dword ptr fs:[00000030h]		4_2_1E514D3B
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E514D3B mov eax, dword ptr fs:[00000030h]		4_2_1E514D3B
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B8D34 mov eax, dword ptr fs:[00000030h]		4_2_1E5B8D34
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F3D34 mov eax, dword ptr fs:[00000030h]		4_2_1E4F3D34
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F3D34 mov eax, dword ptr fs:[00000030h]		4_2_1E4F3D34
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F3D34 mov eax, dword ptr fs:[00000030h]		4_2_1E4F3D34
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F3D34 mov eax, dword ptr fs:[00000030h]		4_2_1E4F3D34
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F3D34 mov eax, dword ptr fs:[00000030h]		4_2_1E4F3D34
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F3D34 mov eax, dword ptr fs:[00000030h]		4_2_1E4F3D34
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F3D34 mov eax, dword ptr fs:[00000030h]		4_2_1E4F3D34
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F3D34 mov eax, dword ptr fs:[00000030h]		4_2_1E4F3D34
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F3D34 mov eax, dword ptr fs:[00000030h]		4_2_1E4F3D34
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F3D34 mov eax, dword ptr fs:[00000030h]		4_2_1E4F3D34
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F3D34 mov eax, dword ptr fs:[00000030h]		4_2_1E4F3D34
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F3D34 mov eax, dword ptr fs:[00000030h]		4_2_1E4F3D34
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F3D34 mov eax, dword ptr fs:[00000030h]		4_2_1E4F3D34
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4EAD30 mov eax, dword ptr fs:[00000030h]		4_2_1E4EAD30
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E566DC9 mov eax, dword ptr fs:[00000030h]		4_2_1E566DC9
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E566DC9 mov eax, dword ptr fs:[00000030h]		4_2_1E566DC9
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E566DC9 mov eax, dword ptr fs:[00000030h]		4_2_1E566DC9
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E566DC9 mov ecx, dword ptr fs:[00000030h]		4_2_1E566DC9
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E566DC9 mov eax, dword ptr fs:[00000030h]		4_2_1E566DC9
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E566DC9 mov eax, dword ptr fs:[00000030h]		4_2_1E566DC9
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E598DF1 mov eax, dword ptr fs:[00000030h]		4_2_1E598DF1
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4FD5E0 mov eax, dword ptr fs:[00000030h]		4_2_1E4FD5E0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4FD5E0 mov eax, dword ptr fs:[00000030h]		4_2_1E4FD5E0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5AFDE2 mov eax, dword ptr fs:[00000030h]		4_2_1E5AFDE2
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5AFDE2 mov eax, dword ptr fs:[00000030h]		4_2_1E5AFDE2
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5AFDE2 mov eax, dword ptr fs:[00000030h]		4_2_1E5AFDE2
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5AFDE2 mov eax, dword ptr fs:[00000030h]		4_2_1E5AFDE2
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E2D8A mov eax, dword ptr fs:[00000030h]		4_2_1E4E2D8A
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E2D8A mov eax, dword ptr fs:[00000030h]		4_2_1E4E2D8A
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E2D8A mov eax, dword ptr fs:[00000030h]		4_2_1E4E2D8A
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E2D8A mov eax, dword ptr fs:[00000030h]		4_2_1E4E2D8A
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E2D8A mov eax, dword ptr fs:[00000030h]		4_2_1E4E2D8A
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51FD9B mov eax, dword ptr fs:[00000030h]		4_2_1E51FD9B
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51FD9B mov eax, dword ptr fs:[00000030h]		4_2_1E51FD9B
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E512581 mov eax, dword ptr fs:[00000030h]		4_2_1E512581
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E512581 mov eax, dword ptr fs:[00000030h]		4_2_1E512581
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E512581 mov eax, dword ptr fs:[00000030h]		4_2_1E512581
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E512581 mov eax, dword ptr fs:[00000030h]		4_2_1E512581
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E511DB5 mov eax, dword ptr fs:[00000030h]		4_2_1E511DB5
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E511DB5 mov eax, dword ptr fs:[00000030h]		4_2_1E511DB5
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E511DB5 mov eax, dword ptr fs:[00000030h]		4_2_1E511DB5
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5135A1 mov eax, dword ptr fs:[00000030h]		4_2_1E5135A1
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B05AC mov eax, dword ptr fs:[00000030h]		4_2_1E5B05AC
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B05AC mov eax, dword ptr fs:[00000030h]		4_2_1E5B05AC
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E574257 mov eax, dword ptr fs:[00000030h]		4_2_1E574257
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E9240 mov eax, dword ptr fs:[00000030h]		4_2_1E4E9240
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E9240 mov eax, dword ptr fs:[00000030h]		4_2_1E4E9240
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E9240 mov eax, dword ptr fs:[00000030h]		4_2_1E4E9240
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E9240 mov eax, dword ptr fs:[00000030h]		4_2_1E4E9240
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5AEA55 mov eax, dword ptr fs:[00000030h]		4_2_1E5AEA55
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E52927A mov eax, dword ptr fs:[00000030h]		4_2_1E52927A
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E59B260 mov eax, dword ptr fs:[00000030h]		4_2_1E59B260
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E59B260 mov eax, dword ptr fs:[00000030h]		4_2_1E59B260
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B8A62 mov eax, dword ptr fs:[00000030h]		4_2_1E5B8A62
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F8A0A mov eax, dword ptr fs:[00000030h]		4_2_1E4F8A0A
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E503A1C mov eax, dword ptr fs:[00000030h]		4_2_1E503A1C
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5AAA16 mov eax, dword ptr fs:[00000030h]		4_2_1E5AAA16
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5AAA16 mov eax, dword ptr fs:[00000030h]		4_2_1E5AAA16
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4EAA16 mov eax, dword ptr fs:[00000030h]		4_2_1E4EAA16
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4EAA16 mov eax, dword ptr fs:[00000030h]		4_2_1E4EAA16
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E5210 mov eax, dword ptr fs:[00000030h]		4_2_1E4E5210
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E5210 mov ecx, dword ptr fs:[00000030h]		4_2_1E4E5210
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E5210 mov eax, dword ptr fs:[00000030h]		4_2_1E4E5210
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E5210 mov eax, dword ptr fs:[00000030h]		4_2_1E4E5210
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E524A2C mov eax, dword ptr fs:[00000030h]		4_2_1E524A2C
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E524A2C mov eax, dword ptr fs:[00000030h]		4_2_1E524A2C
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E512ACB mov eax, dword ptr fs:[00000030h]		4_2_1E512ACB
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E512AE4 mov eax, dword ptr fs:[00000030h]		4_2_1E512AE4
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51D294 mov eax, dword ptr fs:[00000030h]		4_2_1E51D294
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51D294 mov eax, dword ptr fs:[00000030h]		4_2_1E51D294
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51FAB0 mov eax, dword ptr fs:[00000030h]		4_2_1E51FAB0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E52A5 mov eax, dword ptr fs:[00000030h]		4_2_1E4E52A5
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E52A5 mov eax, dword ptr fs:[00000030h]		4_2_1E4E52A5
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E52A5 mov eax, dword ptr fs:[00000030h]		4_2_1E4E52A5
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E52A5 mov eax, dword ptr fs:[00000030h]		4_2_1E4E52A5
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E52A5 mov eax, dword ptr fs:[00000030h]		4_2_1E4E52A5
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4FAAB0 mov eax, dword ptr fs:[00000030h]		4_2_1E4FAAB0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4FAAB0 mov eax, dword ptr fs:[00000030h]		4_2_1E4FAAB0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B8B58 mov eax, dword ptr fs:[00000030h]		4_2_1E5B8B58
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4EDB40 mov eax, dword ptr fs:[00000030h]		4_2_1E4EDB40
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4EF358 mov eax, dword ptr fs:[00000030h]		4_2_1E4EF358
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E513B7A mov eax, dword ptr fs:[00000030h]		4_2_1E513B7A
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E513B7A mov eax, dword ptr fs:[00000030h]		4_2_1E513B7A
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4EDB60 mov ecx, dword ptr fs:[00000030h]		4_2_1E4EDB60
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A131B mov eax, dword ptr fs:[00000030h]		4_2_1E5A131B
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5653CA mov eax, dword ptr fs:[00000030h]		4_2_1E5653CA
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5653CA mov eax, dword ptr fs:[00000030h]		4_2_1E5653CA
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5103E2 mov eax, dword ptr fs:[00000030h]		4_2_1E5103E2
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5103E2 mov eax, dword ptr fs:[00000030h]		4_2_1E5103E2
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5103E2 mov eax, dword ptr fs:[00000030h]		4_2_1E5103E2
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5103E2 mov eax, dword ptr fs:[00000030h]		4_2_1E5103E2
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5103E2 mov eax, dword ptr fs:[00000030h]		4_2_1E5103E2
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5103E2 mov eax, dword ptr fs:[00000030h]		4_2_1E5103E2
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E50DBE9 mov eax, dword ptr fs:[00000030h]		4_2_1E50DBE9
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F1B8F mov eax, dword ptr fs:[00000030h]		4_2_1E4F1B8F
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4F1B8F mov eax, dword ptr fs:[00000030h]		4_2_1E4F1B8F
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51B390 mov eax, dword ptr fs:[00000030h]		4_2_1E51B390
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E512397 mov eax, dword ptr fs:[00000030h]		4_2_1E512397
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A138A mov eax, dword ptr fs:[00000030h]		4_2_1E5A138A
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E59D380 mov ecx, dword ptr fs:[00000030h]		4_2_1E59D380
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E514BAD mov eax, dword ptr fs:[00000030h]		4_2_1E514BAD
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E514BAD mov eax, dword ptr fs:[00000030h]		4_2_1E514BAD
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E514BAD mov eax, dword ptr fs:[00000030h]		4_2_1E514BAD
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B5BA5 mov eax, dword ptr fs:[00000030h]		4_2_1E5B5BA5
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E500050 mov eax, dword ptr fs:[00000030h]		4_2_1E500050
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E500050 mov eax, dword ptr fs:[00000030h]		4_2_1E500050
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A2073 mov eax, dword ptr fs:[00000030h]		4_2_1E5A2073
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B1074 mov eax, dword ptr fs:[00000030h]		4_2_1E5B1074
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E567016 mov eax, dword ptr fs:[00000030h]		4_2_1E567016
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E567016 mov eax, dword ptr fs:[00000030h]		4_2_1E567016
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E567016 mov eax, dword ptr fs:[00000030h]		4_2_1E567016
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B4015 mov eax, dword ptr fs:[00000030h]		4_2_1E5B4015
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5B4015 mov eax, dword ptr fs:[00000030h]		4_2_1E5B4015
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4FB02A mov eax, dword ptr fs:[00000030h]		4_2_1E4FB02A
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4FB02A mov eax, dword ptr fs:[00000030h]		4_2_1E4FB02A
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4FB02A mov eax, dword ptr fs:[00000030h]		4_2_1E4FB02A
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4FB02A mov eax, dword ptr fs:[00000030h]		4_2_1E4FB02A
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51002D mov eax, dword ptr fs:[00000030h]		4_2_1E51002D
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51002D mov eax, dword ptr fs:[00000030h]		4_2_1E51002D
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51002D mov eax, dword ptr fs:[00000030h]		4_2_1E51002D
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51002D mov eax, dword ptr fs:[00000030h]		4_2_1E51002D
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51002D mov eax, dword ptr fs:[00000030h]		4_2_1E51002D
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E57B8D0 mov eax, dword ptr fs:[00000030h]		4_2_1E57B8D0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E57B8D0 mov ecx, dword ptr fs:[00000030h]		4_2_1E57B8D0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E57B8D0 mov eax, dword ptr fs:[00000030h]		4_2_1E57B8D0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E57B8D0 mov eax, dword ptr fs:[00000030h]		4_2_1E57B8D0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E57B8D0 mov eax, dword ptr fs:[00000030h]		4_2_1E57B8D0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E57B8D0 mov eax, dword ptr fs:[00000030h]		4_2_1E57B8D0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E58EC mov eax, dword ptr fs:[00000030h]		4_2_1E4E58EC
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E40E1 mov eax, dword ptr fs:[00000030h]		4_2_1E4E40E1
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E40E1 mov eax, dword ptr fs:[00000030h]		4_2_1E4E40E1
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E40E1 mov eax, dword ptr fs:[00000030h]		4_2_1E4E40E1
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E9080 mov eax, dword ptr fs:[00000030h]		4_2_1E4E9080
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E563884 mov eax, dword ptr fs:[00000030h]		4_2_1E563884
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E563884 mov eax, dword ptr fs:[00000030h]		4_2_1E563884
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51F0BF mov ecx, dword ptr fs:[00000030h]		4_2_1E51F0BF
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51F0BF mov eax, dword ptr fs:[00000030h]		4_2_1E51F0BF
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51F0BF mov eax, dword ptr fs:[00000030h]		4_2_1E51F0BF
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5120A0 mov eax, dword ptr fs:[00000030h]		4_2_1E5120A0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5120A0 mov eax, dword ptr fs:[00000030h]		4_2_1E5120A0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5120A0 mov eax, dword ptr fs:[00000030h]		4_2_1E5120A0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5120A0 mov eax, dword ptr fs:[00000030h]		4_2_1E5120A0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5120A0 mov eax, dword ptr fs:[00000030h]		4_2_1E5120A0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5120A0 mov eax, dword ptr fs:[00000030h]		4_2_1E5120A0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5290AF mov eax, dword ptr fs:[00000030h]		4_2_1E5290AF
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E50B944 mov eax, dword ptr fs:[00000030h]		4_2_1E50B944
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E50B944 mov eax, dword ptr fs:[00000030h]		4_2_1E50B944
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4EC962 mov eax, dword ptr fs:[00000030h]		4_2_1E4EC962
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4EB171 mov eax, dword ptr fs:[00000030h]		4_2_1E4EB171
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4EB171 mov eax, dword ptr fs:[00000030h]		4_2_1E4EB171
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E9100 mov eax, dword ptr fs:[00000030h]		4_2_1E4E9100
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E9100 mov eax, dword ptr fs:[00000030h]		4_2_1E4E9100
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4E9100 mov eax, dword ptr fs:[00000030h]		4_2_1E4E9100
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51513A mov eax, dword ptr fs:[00000030h]		4_2_1E51513A
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51513A mov eax, dword ptr fs:[00000030h]		4_2_1E51513A
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E504120 mov eax, dword ptr fs:[00000030h]		4_2_1E504120
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E504120 mov eax, dword ptr fs:[00000030h]		4_2_1E504120
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E504120 mov eax, dword ptr fs:[00000030h]		4_2_1E504120
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E504120 mov eax, dword ptr fs:[00000030h]		4_2_1E504120
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E504120 mov ecx, dword ptr fs:[00000030h]		4_2_1E504120
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4EB1E1 mov eax, dword ptr fs:[00000030h]		4_2_1E4EB1E1
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4EB1E1 mov eax, dword ptr fs:[00000030h]		4_2_1E4EB1E1
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E4EB1E1 mov eax, dword ptr fs:[00000030h]		4_2_1E4EB1E1
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5741E8 mov eax, dword ptr fs:[00000030h]		4_2_1E5741E8
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E512990 mov eax, dword ptr fs:[00000030h]		4_2_1E512990
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E50C182 mov eax, dword ptr fs:[00000030h]		4_2_1E50C182
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E51A185 mov eax, dword ptr fs:[00000030h]		4_2_1E51A185
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5651BE mov eax, dword ptr fs:[00000030h]		4_2_1E5651BE
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5651BE mov eax, dword ptr fs:[00000030h]		4_2_1E5651BE
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5651BE mov eax, dword ptr fs:[00000030h]		4_2_1E5651BE
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5651BE mov eax, dword ptr fs:[00000030h]		4_2_1E5651BE
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5669A6 mov eax, dword ptr fs:[00000030h]		4_2_1E5669A6
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5161A0 mov eax, dword ptr fs:[00000030h]		4_2_1E5161A0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5161A0 mov eax, dword ptr fs:[00000030h]		4_2_1E5161A0
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A49A4 mov eax, dword ptr fs:[00000030h]		4_2_1E5A49A4
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A49A4 mov eax, dword ptr fs:[00000030h]		4_2_1E5A49A4
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A49A4 mov eax, dword ptr fs:[00000030h]		4_2_1E5A49A4
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_1E5A49A4 mov eax, dword ptr fs:[00000030h]		4_2_1E5A49A4
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_00562D91 mov eax, dword ptr fs:[00000030h]		4_2_00562D91
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_00564B44 mov eax, dword ptr fs:[00000030h]		4_2_00564B44
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_005657C5 mov eax, dword ptr fs:[00000030h]		4_2_005657C5
Source: C:\Users\user\Desktop\211094.exe	Code function: 4_2_00564FE4 mov eax, dword ptr fs:[00000030h]		4_2_00564FE4
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC849B mov eax, dword ptr fs:[00000030h]		9_2_04AC849B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B36CF0 mov eax, dword ptr fs:[00000030h]		9_2_04B36CF0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B36CF0 mov eax, dword ptr fs:[00000030h]		9_2_04B36CF0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B36CF0 mov eax, dword ptr fs:[00000030h]		9_2_04B36CF0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B714FB mov eax, dword ptr fs:[00000030h]		9_2_04B714FB
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B88CD6 mov eax, dword ptr fs:[00000030h]		9_2_04B88CD6
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AEBC2C mov eax, dword ptr fs:[00000030h]		9_2_04AEBC2C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B71C06 mov eax, dword ptr fs:[00000030h]		9_2_04B71C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B71C06 mov eax, dword ptr fs:[00000030h]		9_2_04B71C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B71C06 mov eax, dword ptr fs:[00000030h]		9_2_04B71C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B71C06 mov eax, dword ptr fs:[00000030h]		9_2_04B71C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B71C06 mov eax, dword ptr fs:[00000030h]		9_2_04B71C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B71C06 mov eax, dword ptr fs:[00000030h]		9_2_04B71C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B71C06 mov eax, dword ptr fs:[00000030h]		9_2_04B71C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B71C06 mov eax, dword ptr fs:[00000030h]		9_2_04B71C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B71C06 mov eax, dword ptr fs:[00000030h]		9_2_04B71C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B71C06 mov eax, dword ptr fs:[00000030h]		9_2_04B71C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B71C06 mov eax, dword ptr fs:[00000030h]		9_2_04B71C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B71C06 mov eax, dword ptr fs:[00000030h]		9_2_04B71C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B71C06 mov eax, dword ptr fs:[00000030h]		9_2_04B71C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B71C06 mov eax, dword ptr fs:[00000030h]		9_2_04B71C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B8740D mov eax, dword ptr fs:[00000030h]		9_2_04B8740D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B8740D mov eax, dword ptr fs:[00000030h]		9_2_04B8740D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B8740D mov eax, dword ptr fs:[00000030h]		9_2_04B8740D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B36C0A mov eax, dword ptr fs:[00000030h]		9_2_04B36C0A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B36C0A mov eax, dword ptr fs:[00000030h]		9_2_04B36C0A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B36C0A mov eax, dword ptr fs:[00000030h]		9_2_04B36C0A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B36C0A mov eax, dword ptr fs:[00000030h]		9_2_04B36C0A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AD746D mov eax, dword ptr fs:[00000030h]		9_2_04AD746D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B4C450 mov eax, dword ptr fs:[00000030h]		9_2_04B4C450
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B4C450 mov eax, dword ptr fs:[00000030h]		9_2_04B4C450
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AEA44B mov eax, dword ptr fs:[00000030h]		9_2_04AEA44B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE35A1 mov eax, dword ptr fs:[00000030h]		9_2_04AE35A1
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B805AC mov eax, dword ptr fs:[00000030h]		9_2_04B805AC
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B805AC mov eax, dword ptr fs:[00000030h]		9_2_04B805AC
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE1DB5 mov eax, dword ptr fs:[00000030h]		9_2_04AE1DB5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE1DB5 mov eax, dword ptr fs:[00000030h]		9_2_04AE1DB5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE1DB5 mov eax, dword ptr fs:[00000030h]		9_2_04AE1DB5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AB2D8A mov eax, dword ptr fs:[00000030h]		9_2_04AB2D8A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AB2D8A mov eax, dword ptr fs:[00000030h]		9_2_04AB2D8A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AB2D8A mov eax, dword ptr fs:[00000030h]		9_2_04AB2D8A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AB2D8A mov eax, dword ptr fs:[00000030h]		9_2_04AB2D8A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AB2D8A mov eax, dword ptr fs:[00000030h]		9_2_04AB2D8A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE2581 mov eax, dword ptr fs:[00000030h]		9_2_04AE2581
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE2581 mov eax, dword ptr fs:[00000030h]		9_2_04AE2581
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE2581 mov eax, dword ptr fs:[00000030h]		9_2_04AE2581
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE2581 mov eax, dword ptr fs:[00000030h]		9_2_04AE2581
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AEFD9B mov eax, dword ptr fs:[00000030h]		9_2_04AEFD9B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AEFD9B mov eax, dword ptr fs:[00000030h]		9_2_04AEFD9B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B68DF1 mov eax, dword ptr fs:[00000030h]		9_2_04B68DF1
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ACD5E0 mov eax, dword ptr fs:[00000030h]		9_2_04ACD5E0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ACD5E0 mov eax, dword ptr fs:[00000030h]		9_2_04ACD5E0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B7FDE2 mov eax, dword ptr fs:[00000030h]		9_2_04B7FDE2
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B7FDE2 mov eax, dword ptr fs:[00000030h]		9_2_04B7FDE2
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B7FDE2 mov eax, dword ptr fs:[00000030h]		9_2_04B7FDE2
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B7FDE2 mov eax, dword ptr fs:[00000030h]		9_2_04B7FDE2
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B36DC9 mov eax, dword ptr fs:[00000030h]		9_2_04B36DC9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B36DC9 mov eax, dword ptr fs:[00000030h]		9_2_04B36DC9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B36DC9 mov eax, dword ptr fs:[00000030h]		9_2_04B36DC9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B36DC9 mov ecx, dword ptr fs:[00000030h]		9_2_04B36DC9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B36DC9 mov eax, dword ptr fs:[00000030h]		9_2_04B36DC9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B36DC9 mov eax, dword ptr fs:[00000030h]		9_2_04B36DC9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B3A537 mov eax, dword ptr fs:[00000030h]		9_2_04B3A537
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B88D34 mov eax, dword ptr fs:[00000030h]		9_2_04B88D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B7E539 mov eax, dword ptr fs:[00000030h]		9_2_04B7E539
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE4D3B mov eax, dword ptr fs:[00000030h]		9_2_04AE4D3B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE4D3B mov eax, dword ptr fs:[00000030h]		9_2_04AE4D3B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE4D3B mov eax, dword ptr fs:[00000030h]		9_2_04AE4D3B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC3D34 mov eax, dword ptr fs:[00000030h]		9_2_04AC3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC3D34 mov eax, dword ptr fs:[00000030h]		9_2_04AC3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC3D34 mov eax, dword ptr fs:[00000030h]		9_2_04AC3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC3D34 mov eax, dword ptr fs:[00000030h]		9_2_04AC3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC3D34 mov eax, dword ptr fs:[00000030h]		9_2_04AC3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC3D34 mov eax, dword ptr fs:[00000030h]		9_2_04AC3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC3D34 mov eax, dword ptr fs:[00000030h]		9_2_04AC3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC3D34 mov eax, dword ptr fs:[00000030h]		9_2_04AC3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC3D34 mov eax, dword ptr fs:[00000030h]		9_2_04AC3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC3D34 mov eax, dword ptr fs:[00000030h]		9_2_04AC3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC3D34 mov eax, dword ptr fs:[00000030h]		9_2_04AC3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC3D34 mov eax, dword ptr fs:[00000030h]		9_2_04AC3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC3D34 mov eax, dword ptr fs:[00000030h]		9_2_04AC3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ABAD30 mov eax, dword ptr fs:[00000030h]		9_2_04ABAD30
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ADC577 mov eax, dword ptr fs:[00000030h]		9_2_04ADC577
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ADC577 mov eax, dword ptr fs:[00000030h]		9_2_04ADC577
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF3D43 mov eax, dword ptr fs:[00000030h]		9_2_04AF3D43
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B33540 mov eax, dword ptr fs:[00000030h]		9_2_04B33540
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B63D40 mov eax, dword ptr fs:[00000030h]		9_2_04B63D40
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AD7D50 mov eax, dword ptr fs:[00000030h]		9_2_04AD7D50
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B346A7 mov eax, dword ptr fs:[00000030h]		9_2_04B346A7
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B80EA5 mov eax, dword ptr fs:[00000030h]		9_2_04B80EA5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B80EA5 mov eax, dword ptr fs:[00000030h]		9_2_04B80EA5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B80EA5 mov eax, dword ptr fs:[00000030h]		9_2_04B80EA5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B4FE87 mov eax, dword ptr fs:[00000030h]		9_2_04B4FE87
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE16E0 mov ecx, dword ptr fs:[00000030h]		9_2_04AE16E0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC76E2 mov eax, dword ptr fs:[00000030h]		9_2_04AC76E2
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE36CC mov eax, dword ptr fs:[00000030h]		9_2_04AE36CC
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF8EC7 mov eax, dword ptr fs:[00000030h]		9_2_04AF8EC7
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B88ED6 mov eax, dword ptr fs:[00000030h]		9_2_04B88ED6
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B6FEC0 mov eax, dword ptr fs:[00000030h]		9_2_04B6FEC0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B6FE3F mov eax, dword ptr fs:[00000030h]		9_2_04B6FE3F
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ABE620 mov eax, dword ptr fs:[00000030h]		9_2_04ABE620
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ABC600 mov eax, dword ptr fs:[00000030h]		9_2_04ABC600
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ABC600 mov eax, dword ptr fs:[00000030h]		9_2_04ABC600
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ABC600 mov eax, dword ptr fs:[00000030h]		9_2_04ABC600
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE8E00 mov eax, dword ptr fs:[00000030h]		9_2_04AE8E00
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AEA61C mov eax, dword ptr fs:[00000030h]		9_2_04AEA61C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AEA61C mov eax, dword ptr fs:[00000030h]		9_2_04AEA61C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B71608 mov eax, dword ptr fs:[00000030h]		9_2_04B71608
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC766D mov eax, dword ptr fs:[00000030h]		9_2_04AC766D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ADAE73 mov eax, dword ptr fs:[00000030h]		9_2_04ADAE73
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ADAE73 mov eax, dword ptr fs:[00000030h]		9_2_04ADAE73
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ADAE73 mov eax, dword ptr fs:[00000030h]		9_2_04ADAE73
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ADAE73 mov eax, dword ptr fs:[00000030h]		9_2_04ADAE73
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ADAE73 mov eax, dword ptr fs:[00000030h]		9_2_04ADAE73
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC7E41 mov eax, dword ptr fs:[00000030h]		9_2_04AC7E41
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC7E41 mov eax, dword ptr fs:[00000030h]		9_2_04AC7E41
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC7E41 mov eax, dword ptr fs:[00000030h]		9_2_04AC7E41
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC7E41 mov eax, dword ptr fs:[00000030h]		9_2_04AC7E41
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC7E41 mov eax, dword ptr fs:[00000030h]		9_2_04AC7E41
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC7E41 mov eax, dword ptr fs:[00000030h]		9_2_04AC7E41
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B7AE44 mov eax, dword ptr fs:[00000030h]		9_2_04B7AE44
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B7AE44 mov eax, dword ptr fs:[00000030h]		9_2_04B7AE44
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B37794 mov eax, dword ptr fs:[00000030h]		9_2_04B37794
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B37794 mov eax, dword ptr fs:[00000030h]		9_2_04B37794
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B37794 mov eax, dword ptr fs:[00000030h]		9_2_04B37794
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AC8794 mov eax, dword ptr fs:[00000030h]		9_2_04AC8794
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF37F5 mov eax, dword ptr fs:[00000030h]		9_2_04AF37F5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AB4F2E mov eax, dword ptr fs:[00000030h]		9_2_04AB4F2E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AB4F2E mov eax, dword ptr fs:[00000030h]		9_2_04AB4F2E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ADB73D mov eax, dword ptr fs:[00000030h]		9_2_04ADB73D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ADB73D mov eax, dword ptr fs:[00000030h]		9_2_04ADB73D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AEE730 mov eax, dword ptr fs:[00000030h]		9_2_04AEE730
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AEA70E mov eax, dword ptr fs:[00000030h]		9_2_04AEA70E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AEA70E mov eax, dword ptr fs:[00000030h]		9_2_04AEA70E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B4FF10 mov eax, dword ptr fs:[00000030h]		9_2_04B4FF10
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B4FF10 mov eax, dword ptr fs:[00000030h]		9_2_04B4FF10
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B8070D mov eax, dword ptr fs:[00000030h]		9_2_04B8070D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B8070D mov eax, dword ptr fs:[00000030h]		9_2_04B8070D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ADF716 mov eax, dword ptr fs:[00000030h]		9_2_04ADF716
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ACFF60 mov eax, dword ptr fs:[00000030h]		9_2_04ACFF60
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B88F6A mov eax, dword ptr fs:[00000030h]		9_2_04B88F6A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ACEF40 mov eax, dword ptr fs:[00000030h]		9_2_04ACEF40
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AF90AF mov eax, dword ptr fs:[00000030h]		9_2_04AF90AF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE20A0 mov eax, dword ptr fs:[00000030h]		9_2_04AE20A0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE20A0 mov eax, dword ptr fs:[00000030h]		9_2_04AE20A0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE20A0 mov eax, dword ptr fs:[00000030h]		9_2_04AE20A0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE20A0 mov eax, dword ptr fs:[00000030h]		9_2_04AE20A0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE20A0 mov eax, dword ptr fs:[00000030h]		9_2_04AE20A0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE20A0 mov eax, dword ptr fs:[00000030h]		9_2_04AE20A0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AEF0BF mov ecx, dword ptr fs:[00000030h]		9_2_04AEF0BF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AEF0BF mov eax, dword ptr fs:[00000030h]		9_2_04AEF0BF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AEF0BF mov eax, dword ptr fs:[00000030h]		9_2_04AEF0BF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AB9080 mov eax, dword ptr fs:[00000030h]		9_2_04AB9080
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B33884 mov eax, dword ptr fs:[00000030h]		9_2_04B33884
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B33884 mov eax, dword ptr fs:[00000030h]		9_2_04B33884
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AB58EC mov eax, dword ptr fs:[00000030h]		9_2_04AB58EC
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ADB8E4 mov eax, dword ptr fs:[00000030h]		9_2_04ADB8E4
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ADB8E4 mov eax, dword ptr fs:[00000030h]		9_2_04ADB8E4
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AB40E1 mov eax, dword ptr fs:[00000030h]		9_2_04AB40E1
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AB40E1 mov eax, dword ptr fs:[00000030h]		9_2_04AB40E1
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AB40E1 mov eax, dword ptr fs:[00000030h]		9_2_04AB40E1
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B4B8D0 mov eax, dword ptr fs:[00000030h]		9_2_04B4B8D0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B4B8D0 mov ecx, dword ptr fs:[00000030h]		9_2_04B4B8D0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B4B8D0 mov eax, dword ptr fs:[00000030h]		9_2_04B4B8D0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B4B8D0 mov eax, dword ptr fs:[00000030h]		9_2_04B4B8D0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B4B8D0 mov eax, dword ptr fs:[00000030h]		9_2_04B4B8D0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B4B8D0 mov eax, dword ptr fs:[00000030h]		9_2_04B4B8D0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE002D mov eax, dword ptr fs:[00000030h]		9_2_04AE002D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE002D mov eax, dword ptr fs:[00000030h]		9_2_04AE002D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE002D mov eax, dword ptr fs:[00000030h]		9_2_04AE002D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE002D mov eax, dword ptr fs:[00000030h]		9_2_04AE002D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE002D mov eax, dword ptr fs:[00000030h]		9_2_04AE002D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ACB02A mov eax, dword ptr fs:[00000030h]		9_2_04ACB02A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ACB02A mov eax, dword ptr fs:[00000030h]		9_2_04ACB02A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ACB02A mov eax, dword ptr fs:[00000030h]		9_2_04ACB02A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ACB02A mov eax, dword ptr fs:[00000030h]		9_2_04ACB02A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ADA830 mov eax, dword ptr fs:[00000030h]		9_2_04ADA830
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ADA830 mov eax, dword ptr fs:[00000030h]		9_2_04ADA830
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ADA830 mov eax, dword ptr fs:[00000030h]		9_2_04ADA830
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04ADA830 mov eax, dword ptr fs:[00000030h]		9_2_04ADA830
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B37016 mov eax, dword ptr fs:[00000030h]		9_2_04B37016
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B37016 mov eax, dword ptr fs:[00000030h]		9_2_04B37016
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B37016 mov eax, dword ptr fs:[00000030h]		9_2_04B37016
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B84015 mov eax, dword ptr fs:[00000030h]		9_2_04B84015
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B84015 mov eax, dword ptr fs:[00000030h]		9_2_04B84015
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B72073 mov eax, dword ptr fs:[00000030h]		9_2_04B72073
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B81074 mov eax, dword ptr fs:[00000030h]		9_2_04B81074
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AD0050 mov eax, dword ptr fs:[00000030h]		9_2_04AD0050
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AD0050 mov eax, dword ptr fs:[00000030h]		9_2_04AD0050
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B351BE mov eax, dword ptr fs:[00000030h]		9_2_04B351BE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B351BE mov eax, dword ptr fs:[00000030h]		9_2_04B351BE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B351BE mov eax, dword ptr fs:[00000030h]		9_2_04B351BE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B351BE mov eax, dword ptr fs:[00000030h]		9_2_04B351BE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE61A0 mov eax, dword ptr fs:[00000030h]		9_2_04AE61A0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AE61A0 mov eax, dword ptr fs:[00000030h]		9_2_04AE61A0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AD99BF mov ecx, dword ptr fs:[00000030h]		9_2_04AD99BF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AD99BF mov ecx, dword ptr fs:[00000030h]		9_2_04AD99BF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AD99BF mov eax, dword ptr fs:[00000030h]		9_2_04AD99BF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AD99BF mov ecx, dword ptr fs:[00000030h]		9_2_04AD99BF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AD99BF mov ecx, dword ptr fs:[00000030h]		9_2_04AD99BF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AD99BF mov eax, dword ptr fs:[00000030h]		9_2_04AD99BF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AD99BF mov ecx, dword ptr fs:[00000030h]		9_2_04AD99BF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AD99BF mov ecx, dword ptr fs:[00000030h]		9_2_04AD99BF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AD99BF mov eax, dword ptr fs:[00000030h]		9_2_04AD99BF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AD99BF mov ecx, dword ptr fs:[00000030h]		9_2_04AD99BF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AD99BF mov ecx, dword ptr fs:[00000030h]		9_2_04AD99BF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AD99BF mov eax, dword ptr fs:[00000030h]		9_2_04AD99BF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B749A4 mov eax, dword ptr fs:[00000030h]		9_2_04B749A4
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B749A4 mov eax, dword ptr fs:[00000030h]		9_2_04B749A4
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B749A4 mov eax, dword ptr fs:[00000030h]		9_2_04B749A4
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B749A4 mov eax, dword ptr fs:[00000030h]		9_2_04B749A4
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04B369A6 mov eax, dword ptr fs:[00000030h]		9_2_04B369A6
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 9_2_04AEA185 mov eax, dword ptr fs:[00000030h]		9_2_04AEA185

Enables debug privileges

Source: C:\Users\user\Desktop\211094.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 199.79.62.169 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 160.153.136.3 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.98.99.30 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 18.189.205.91 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.230.60.102 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 103.28.36.171 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 198.54.117.211 80			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\211094.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\211094.exe	Section loaded: unknown target: C:\Windows\SysWOW64\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\211094.exe	Section loaded: unknown target: C:\Windows\SysWOW64\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\211094.exe	Thread register set: target process: 3440			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Thread register set: target process: 3440			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\211094.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\211094.exe

Section unmapped: C:\Windows\SysWOW64\explorer.exe base address: B70000

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\211094.exe	Process created: C:\Users\user\Desktop\211094.exe 'C:\Users\user\Desktop\211094.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\211094.exe'			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: 211094.exe, 00000004.00000002.407424749.000000001E7F0000.00000040.00000001.sdmp, explorer.exe, 00000006.00000002.599826178.0000000004F80000.00000004.00000001.sdmp, explorer.exe, 00000009.00000002.590193584.0000000003280000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.367049312.0000000000EE0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000002.590193584.0000000003280000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: 211094.exe, 00000004.00000002.407424749.000000001E7F0000.00000040.00000001.sdmp	Binary or memory string: Microsoft-Reserved-24C26ACC-DE62-4303-88AD-6CD4F1447F18SecurityConfigureWindowsPasswordsProxy DesktopProgmanSoftware\Microsoft\Windows NT\CurrentVersion\WinlogonShellSoftware\Microsoft\Windows NT\CurrentVersion\Winlogon\AlternateShells\AvailableShells
Source: explorer.exe, 00000006.00000000.367049312.0000000000EE0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000002.590193584.0000000003280000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: explorer.exe, 00000006.00000000.367049312.0000000000EE0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000002.590193584.0000000003280000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\211094.exe

Code function: 0_2_02292F7F cpuid

0_2_02292F7F

Stealing of Sensitive Information:

Yara detected FormBook

Source: Yara match	File source: 00000009.00000002.587412850.00000000006F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.587981327.0000000000B30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.587932425.0000000000B00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.404736024.000000001E290000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.399177906.0000000000080000.00000040.00000001.sdmp, type: MEMORY

Yara detected Generic Dropper

Source: Yara match	File source: Process Memory Space: 211094.exe PID: 1872, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 776, type: MEMORY

Remote Access Functionality:

Yara detected FormBook

Source: Yara match	File source: 00000009.00000002.587412850.00000000006F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.587981327.0000000000B30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.587932425.0000000000B00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.404736024.000000001E290000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.399177906.0000000000080000.00000040.00000001.sdmp, type: MEMORY