Analysis Report Citvonvhciktufwvyzyhistnewdjgsoqdr.exe

Overview

General Information

Sample Name: Citvonvhciktufwvyzyhistnewdjgsoqdr.exe
Analysis ID: 411769
MD5: 4e71f90d1817f44313f4e101ef393968
SHA1: 3932f9822134761e7bf9bc1902f8cc28b6820559
SHA256: aace20e28e61cb328da74ff938231b1ce9a07498d477efe3efc5c5d3d04b9dc1
Tags: exeFormbooksigned
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
DLL side loading technique detected
Drops PE files to the user root directory
Drops executables to the windows directory (C:\Windows) and starts them
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Execution from Suspicious Folder
Suspicious powershell command line found
Tries to detect virtualization through RDTSC time measurements
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the user directory
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE / OLE file has an invalid certificate
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Non Interactive PowerShell
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 0000001D.00000002.916527302.0000000001270000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.clinics.life/qku9/"], "decoy": ["infinitilifecenters.com", "newsondogs.com", "enonen.com", "skinnybrew.asia", "evaair-dailoan.com", "kakao.delivery", "kenistic.com", "dichvuquatanghtc.com", "avbs1.xyz", "dornhome.com", "uuyuii.com", "elearningeasygenerator.com", "basnne.com", "snkrclassics.com", "healthtechcentral.com", "earthhoodpal.com", "voorgoed.com", "lazycooked.com", "openrank.site", "georgeswebwerks.com", "diabluma.com", "kenekch.net", "fragrans.paris", "dov12.com", "traumainformed.love", "rocket3freedom.com", "smartgrowcultiva.com", "financial345.com", "maxsecuritycompany.com", "ibitr.com", "tamhoo.com", "reciclar.space", "agustoscimerapk-tr.com", "risingstarg.com", "kambosito.space", "bossdeal.online", "xn--avenr-wsa.com", "tauznora.com", "rest-blog.com", "amercadear.com", "xn--e1agggwgm.xn--p1acf", "paintwaterlilly.com", "yago.pro", "kmakeupbrushes.com", "shawnshimazu.design", "homeverf.com", "latromi.com", "machacekbakery.com", "jillsfreegift.com", "nationwidemovingamerica.com", "healthyred.xyz", "thrg33.club", "orbit-shop.com", "akgunreklam.xyz", "vewesyqy.xyz", "contorig2.com", "reiadarealestate.com", "pmxgear.com", "chennaigranites.com", "jmboprivacy.com", "genunid.com", "alegria.club", "alexfuture.net", "anixussohigh.com"]}
Multi AV Scanner detection for dropped file
Source: C:\Users\Public\Citvon\Citvon.exe Metadefender: Detection: 35% Perma Link
Source: C:\Users\Public\Citvon\Citvon.exe ReversingLabs: Detection: 65%
Source: C:\Users\Public\NETUTILS.dll ReversingLabs: Detection: 20%
Source: C:\Windows \System32\NETUTILS.dll ReversingLabs: Detection: 20%
Multi AV Scanner detection for submitted file
Source: Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Virustotal: Detection: 70% Perma Link
Source: Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Metadefender: Detection: 35% Perma Link
Source: Citvonvhciktufwvyzyhistnewdjgsoqdr.exe ReversingLabs: Detection: 65%
Yara detected FormBook
Source: Yara match File source: 0000001D.00000002.916527302.0000000001270000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.826581239.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.866605894.0000000000580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.826744888.00000000004B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.867119537.0000000000310000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000001.696290346.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000001.815038206.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.697862956.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.867284740.00000000008D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.915615898.0000000000E50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.865473652.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.827144868.00000000005C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000001.796805895.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.916659708.00000000012A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 3.1.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.Citvon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.2.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.1.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.2.Citvon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.1.Citvon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.1.Citvon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.1.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE
Machine Learning detection for dropped file
Source: C:\Users\Public\Citvon\Citvon.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 25.2.Citvon.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.2.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.1.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 27.2.Citvon.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 27.1.Citvon.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 25.1.Citvon.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
Source: Binary string: msiexec.pdb source: Citvon.exe, 00000019.00000002.867393416.0000000000960000.00000040.00000001.sdmp
Source: Binary string: msiexec.pdbGCTL source: Citvon.exe, 00000019.00000002.867393416.0000000000960000.00000040.00000001.sdmp
Source: Binary string: netplwiz.pdb source: Netplwiz.exe, 00000008.00000002.702460692.00007FF61AD35000.00000002.00020000.sdmp
Source: Binary string: netplwiz.pdbGCTL source: Netplwiz.exe, 00000008.00000002.702460692.00007FF61AD35000.00000002.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: Citvonvhciktufwvyzyhistnewdjgsoqdr.exe, 00000003.00000002.698168920.0000000000B8F000.00000040.00000001.sdmp, Citvon.exe, 00000019.00000002.867470145.00000000009C0000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: Citvonvhciktufwvyzyhistnewdjgsoqdr.exe, Citvon.exe, 00000019.00000002.867470145.00000000009C0000.00000040.00000001.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 4x nop then pop edi 3_2_0040C3DF

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.clinics.life/qku9/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /qku9/?6lPDSJPH=4N2BxPNrndQhx4f7lxE8pKNuaIuSTDwEioPJ3Oup1sIb+BTUhD7Z9dt/VxNIQWQk9DQP&u8eTH=YdsPJP HTTP/1.1Host: www.georgeswebwerks.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 198.54.117.212 198.54.117.212
Source: global traffic HTTP traffic detected: GET /qku9/?6lPDSJPH=4N2BxPNrndQhx4f7lxE8pKNuaIuSTDwEioPJ3Oup1sIb+BTUhD7Z9dt/VxNIQWQk9DQP&u8eTH=YdsPJP HTTP/1.1Host: www.georgeswebwerks.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: onedrive.live.com
Source: powershell.exe, 0000000D.00000002.752129080.00000172C22AF000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Citvon.exe, 00000014.00000003.752641816.00000000008C4000.00000004.00000001.sdmp String found in binary or memory: http://crl.microsof
Source: Citvonvhciktufwvyzyhistnewdjgsoqdr.exe, 00000000.00000003.658488547.000000000094F000.00000004.00000001.sdmp, Citvon.exe, 00000011.00000003.736683075.000000000083A000.00000004.00000001.sdmp, Citvon.exe, 00000014.00000003.752669738.00000000008D0000.00000004.00000001.sdmp String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: Citvon.exe, 00000014.00000003.752641816.00000000008C4000.00000004.00000001.sdmp String found in binary or memory: http://mscrl.micro
Source: powershell.exe, 0000000D.00000002.749646155.00000172BA104000.00000004.00000001.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: Citvonvhciktufwvyzyhistnewdjgsoqdr.exe, 00000000.00000003.658488547.000000000094F000.00000004.00000001.sdmp, Citvon.exe, 00000011.00000003.736683075.000000000083A000.00000004.00000001.sdmp, Citvon.exe, 00000014.00000003.752669738.00000000008D0000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.digicert.com0:
Source: Citvonvhciktufwvyzyhistnewdjgsoqdr.exe, 00000000.00000003.658494505.0000000000953000.00000004.00000001.sdmp, Citvon.exe, 00000011.00000003.736683075.000000000083A000.00000004.00000001.sdmp, Citvon.exe, 00000014.00000003.752669738.00000000008D0000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.msocsp.com0
Source: powershell.exe, 0000000D.00000002.752441482.00000172C23D0000.00000004.00000001.sdmp String found in binary or memory: http://osoft.com/PKI/doefault.htm0
Source: powershell.exe, 0000000D.00000002.736725813.00000172AA2B1000.00000004.00000001.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000D.00000002.752441482.00000172C23D0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.microsoft.coT
Source: powershell.exe, 0000000D.00000002.736959186.00000172AA43B000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000000D.00000002.735431704.00000172AA0A1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000D.00000002.736959186.00000172AA43B000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000D.00000002.736725813.00000172AA2B1000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000D.00000002.749646155.00000172BA104000.00000004.00000001.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000D.00000002.749646155.00000172BA104000.00000004.00000001.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000D.00000002.749646155.00000172BA104000.00000004.00000001.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000D.00000002.736725813.00000172AA2B1000.00000004.00000001.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000D.00000003.711204031.00000172ABE21000.00000004.00000001.sdmp String found in binary or memory: https://go.micro
Source: powershell.exe, 0000000D.00000002.749646155.00000172BA104000.00000004.00000001.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: Citvon.exe, 00000011.00000003.736694886.000000000083E000.00000004.00000001.sdmp, Citvon.exe, 00000014.00000003.752669738.00000000008D0000.00000004.00000001.sdmp String found in binary or memory: https://xhtfga.dm.files.1drv.com/y4m8SMkzvpejvDLx8dnrECcyq_e2qmwA_A7cOWUQWdVRMq0yniUlzBSm_G1n5_On9Y_

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 0000001D.00000002.916527302.0000000001270000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.826581239.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.866605894.0000000000580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.826744888.00000000004B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.867119537.0000000000310000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000001.696290346.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000001.815038206.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.697862956.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.867284740.00000000008D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.915615898.0000000000E50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.865473652.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.827144868.00000000005C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000001.796805895.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.916659708.00000000012A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 3.1.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.Citvon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.2.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.1.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.2.Citvon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.1.Citvon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.1.Citvon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.1.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 0000001D.00000002.916527302.0000000001270000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001D.00000002.916527302.0000000001270000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001B.00000002.826581239.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001B.00000002.826581239.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000019.00000002.866605894.0000000000580000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000019.00000002.866605894.0000000000580000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001B.00000002.826744888.00000000004B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001B.00000002.826744888.00000000004B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000020.00000002.867119537.0000000000310000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000020.00000002.867119537.0000000000310000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000001.696290346.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000001.696290346.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001B.00000001.815038206.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001B.00000001.815038206.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.697862956.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.697862956.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000019.00000002.867284740.00000000008D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000019.00000002.867284740.00000000008D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001D.00000002.915615898.0000000000E50000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001D.00000002.915615898.0000000000E50000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000019.00000002.865473652.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000019.00000002.865473652.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001B.00000002.827144868.00000000005C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001B.00000002.827144868.00000000005C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000019.00000001.796805895.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000019.00000001.796805895.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001D.00000002.916659708.00000000012A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001D.00000002.916659708.00000000012A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.1.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.1.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 25.2.Citvon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 25.2.Citvon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 27.2.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 27.2.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.1.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.1.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 25.2.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 25.2.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 27.1.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 27.1.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 27.2.Citvon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 27.2.Citvon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 27.1.Citvon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 27.1.Citvon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 25.1.Citvon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 25.1.Citvon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 25.1.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 25.1.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_004181B0 NtCreateFile, 3_2_004181B0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00418260 NtReadFile, 3_2_00418260
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_004182E0 NtClose, 3_2_004182E0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00418390 NtAllocateVirtualMemory, 3_2_00418390
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_0041816A NtCreateFile, 3_2_0041816A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_004181AA NtCreateFile, 3_2_004181AA
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00418203 NtCreateFile, 3_2_00418203
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_004182DE NtClose, 3_2_004182DE
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_0041838C NtAllocateVirtualMemory, 3_2_0041838C
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9860 NtQuerySystemInformation,LdrInitializeThunk, 3_2_00AD9860
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD96E0 NtFreeVirtualMemory,LdrInitializeThunk, 3_2_00AD96E0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9660 NtAllocateVirtualMemory,LdrInitializeThunk, 3_2_00AD9660
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD98A0 NtWriteVirtualMemory, 3_2_00AD98A0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD98F0 NtReadVirtualMemory, 3_2_00AD98F0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9820 NtEnumerateKey, 3_2_00AD9820
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9840 NtDelayExecution, 3_2_00AD9840
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ADB040 NtSuspendThread, 3_2_00ADB040
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD99A0 NtCreateSection, 3_2_00AD99A0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD99D0 NtCreateProcessEx, 3_2_00AD99D0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9910 NtAdjustPrivilegesToken, 3_2_00AD9910
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9950 NtQueueApcThread, 3_2_00AD9950
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9A80 NtOpenDirectoryObject, 3_2_00AD9A80
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9A20 NtResumeThread, 3_2_00AD9A20
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9A00 NtProtectVirtualMemory, 3_2_00AD9A00
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9A10 NtQuerySection, 3_2_00AD9A10
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9A50 NtCreateFile, 3_2_00AD9A50
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ADA3B0 NtGetContextThread, 3_2_00ADA3B0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9B00 NtSetValueKey, 3_2_00AD9B00
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD95F0 NtQueryInformationFile, 3_2_00AD95F0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD95D0 NtClose, 3_2_00AD95D0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9520 NtWaitForSingleObject, 3_2_00AD9520
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ADAD30 NtSetContextThread, 3_2_00ADAD30
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9560 NtWriteFile, 3_2_00AD9560
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9540 NtReadFile, 3_2_00AD9540
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD96D0 NtCreateKey, 3_2_00AD96D0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9610 NtEnumerateValueKey, 3_2_00AD9610
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9670 NtQueryInformationProcess, 3_2_00AD9670
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9650 NtQueryValueKey, 3_2_00AD9650
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD97A0 NtUnmapViewOfSection, 3_2_00AD97A0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9780 NtMapViewOfSection, 3_2_00AD9780
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9FE0 NtCreateMutant, 3_2_00AD9FE0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9730 NtQueryVirtualMemory, 3_2_00AD9730
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9710 NtQueryInformationToken, 3_2_00AD9710
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ADA710 NtOpenProcessToken, 3_2_00ADA710
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9760 NtOpenProcess, 3_2_00AD9760
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9770 NtSetInformationFile, 3_2_00AD9770
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ADA770 NtOpenThread, 3_2_00ADA770
Creates files inside the system directory
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Windows Jump to behavior
Deletes files inside the Windows folder
Source: C:\Windows\SysWOW64\cmd.exe File deleted: C:\Windows \System32 Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_0041B846 3_2_0041B846
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00401030 3_2_00401030
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_0041CA60 3_2_0041CA60
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00408C4B 3_2_00408C4B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00408C50 3_2_00408C50
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_0041B4A3 3_2_0041B4A3
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00402D90 3_2_00402D90
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_0041CEBD 3_2_0041CEBD
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00402FB0 3_2_00402FB0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC20A0 3_2_00AC20A0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B620A8 3_2_00B620A8
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AAB090 3_2_00AAB090
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B628EC 3_2_00B628EC
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B6E824 3_2_00B6E824
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA830 3_2_00ABA830
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A96800 3_2_00A96800
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B51002 3_2_00B51002
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB99BF 3_2_00AB99BF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB4120 3_2_00AB4120
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9F900 3_2_00A9F900
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B622AE 3_2_00B622AE
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B632A9 3_2_00B632A9
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54AEF 3_2_00B54AEF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5E2C5 3_2_00B5E2C5
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB236 3_2_00ABB236
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B4FA2B 3_2_00B4FA2B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACEBB0 3_2_00ACEBB0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC138B 3_2_00AC138B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABEB9A 3_2_00ABEB9A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B3EB8A 3_2_00B3EB8A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AE8BE8 3_2_00AE8BE8
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B423E3 3_2_00B423E3
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5DBD2 3_2_00B5DBD2
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B503DA 3_2_00B503DA
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACABD8 3_2_00ACABD8
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B62B28 3_2_00B62B28
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5231B 3_2_00B5231B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABAB40 3_2_00ABAB40
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B3CB4F 3_2_00B3CB4F
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54496 3_2_00B54496
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA841F 3_2_00AA841F
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5D466 3_2_00B5D466
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB477 3_2_00ABB477
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC65A0 3_2_00AC65A0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC2581 3_2_00AC2581
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B52D82 3_2_00B52D82
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AAD5E0 3_2_00AAD5E0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B625DD 3_2_00B625DD
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A90D20 3_2_00A90D20
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B62D07 3_2_00B62D07
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B61D55 3_2_00B61D55
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B41EB6 3_2_00B41EB6
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B62EF7 3_2_00B62EF7
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB6E30 3_2_00AB6E30
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5D616 3_2_00B5D616
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB5600 3_2_00AB5600
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B61FF1 3_2_00B61FF1
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B567E2 3_2_00B567E2
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B6DFCE 3_2_00B6DFCE
Source: C:\Windows \System32\Netplwiz.exe Code function: 8_2_00007FF61AD32D20 8_2_00007FF61AD32D20
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 13_2_00007FFA35A81678 13_2_00007FFA35A81678
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 13_2_00007FFA35A843DC 13_2_00007FFA35A843DC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 13_2_00007FFA35A81700 13_2_00007FFA35A81700
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 13_2_00007FFA35B57962 13_2_00007FFA35B57962
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\Public\NETUTILS.dll 36D1FA474CD8271F9B74B9481025614B6FF309F767F69D9F1FF3960C7205AD12
Found potential string decryption / allocating functions
Source: C:\Users\Public\Citvon\Citvon.exe Code function: String function: 02208190 appears 45 times
Source: C:\Users\Public\Citvon\Citvon.exe Code function: String function: 0220A097 appears 42 times
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: String function: 00B25720 appears 38 times
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: String function: 00AED08C appears 39 times
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: String function: 0041A0A0 appears 31 times
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: String function: 00A9B150 appears 154 times
PE / OLE file has an invalid certificate
Source: Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Static PE information: invalid certificate
PE file contains more sections than normal
Source: NETUTILS.dll.6.dr Static PE information: Number of sections : 19 > 10
PE file contains strange resources
Source: Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Citvon.exe.0.dr Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Netplwiz.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Netplwiz.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Netplwiz.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Netplwiz.exe.6.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Netplwiz.exe.6.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Netplwiz.exe.6.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: Citvonvhciktufwvyzyhistnewdjgsoqdr.exe, 00000003.00000002.698168920.0000000000B8F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs Citvonvhciktufwvyzyhistnewdjgsoqdr.exe
Tries to load missing DLLs
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Section loaded: nviewlib.dll Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Section loaded: nviewlib.dll Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Section loaded: nviewlib.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll
Uses 32bit PE files
Source: Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
Yara signature match
Source: 0000001D.00000002.916527302.0000000001270000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001D.00000002.916527302.0000000001270000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000003.681744195.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.794009092.0000000003CD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.776445202.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.680695317.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.777072659.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.793842362.0000000003CD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.792672644.0000000003DA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.775505378.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.776207302.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 0000001A.00000000.833193136.000000000A6D7000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.791925004.0000000003DA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.777194566.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.775598772.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 0000001B.00000002.826581239.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001B.00000002.826581239.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000003.680995557.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.793060027.0000000003DA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.793181479.0000000003CD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.680590350.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.680350085.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.776689752.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.775112888.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.794640996.0000000003CD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.776879141.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000019.00000002.866605894.0000000000580000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000019.00000002.866605894.0000000000580000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000003.681371824.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.681401941.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.680945161.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.681291309.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.776094630.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.774258125.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.775315084.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.680731974.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 0000001B.00000002.826744888.00000000004B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001B.00000002.826744888.00000000004B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000003.681518622.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.775824853.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.681644403.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.680558315.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.680395573.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.681105272.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000020.00000002.867119537.0000000000310000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000020.00000002.867119537.0000000000310000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000003.680649667.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000003.00000001.696290346.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000001.696290346.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000003.794191369.0000000003CD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.792747836.0000000003CD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.777314398.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.793593765.0000000003DA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.775903098.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 0000001B.00000001.815038206.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001B.00000001.815038206.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.697862956.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.697862956.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000003.680465750.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000019.00000002.867284740.00000000008D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000019.00000002.867284740.00000000008D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000003.680834429.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.775665097.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.794887190.0000000003DA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.681184778.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.774536260.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.791822656.0000000003CD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.774973034.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.680869212.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.681329626.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.794518867.0000000003DA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.795084927.0000000003DA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 0000001D.00000002.915615898.0000000000E50000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001D.00000002.915615898.0000000000E50000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000003.680618860.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.681146145.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.774813034.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.775978278.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.680798955.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.792171644.0000000003CD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000019.00000002.865473652.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000019.00000002.865473652.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000003.776284853.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.776822633.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.775198521.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.794111065.0000000003DA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.792024075.0000000003CD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.793496729.0000000003CD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.794375014.0000000003CD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.681439102.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.793721706.0000000003DA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.681062128.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.793652322.0000000003CD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.680427643.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.680522649.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.681564607.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.792344973.0000000003CD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.776766122.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.792856444.0000000003DA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.795208960.0000000003DA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.681236193.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.793342205.0000000003DA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.793928803.0000000003DA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.681840426.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.792257287.0000000003DA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.792959972.0000000003CD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.775748652.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.792094708.0000000003DA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.792418310.0000000003DA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 0000001B.00000002.827144868.00000000005C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001B.00000002.827144868.00000000005C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000003.792530901.0000000003CD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.680764371.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.775417344.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.776363744.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000014.00000003.794288612.0000000003DA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000003.680899857.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000019.00000001.796805895.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000019.00000001.796805895.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000003.776524583.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.776620878.0000000003BD4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.776945526.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.774394805.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.774870896.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 0000001D.00000002.916659708.00000000012A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001D.00000002.916659708.00000000012A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000003.795419491.0000000003DA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000011.00000003.774740375.0000000003CA4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: C:\Users\Public\novtiC.url, type: DROPPED Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 3.1.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.1.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 25.2.Citvon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 25.2.Citvon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 27.2.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 27.2.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.1.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.1.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 25.2.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 25.2.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 27.1.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 27.1.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 27.2.Citvon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 27.2.Citvon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 27.1.Citvon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 27.1.Citvon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 25.1.Citvon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 25.1.Citvon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 25.1.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 25.1.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: classification engine Classification label: mal100.troj.evad.winEXE@29/18@9/2
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5684:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6232:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6912:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6804:120:WilError_01
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_effl5svh.hnm.ps1 Jump to behavior
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\stt.bat' '
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Virustotal: Detection: 70%
Source: Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Metadefender: Detection: 35%
Source: Citvonvhciktufwvyzyhistnewdjgsoqdr.exe ReversingLabs: Detection: 65%
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe File read: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe 'C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe'
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Process created: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\stt.bat' '
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\PXOR.bat
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows \System32\Netplwiz.exe C:\Windows \System32\Netplwiz.exe
Source: C:\Windows \System32\Netplwiz.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Cdex.bat
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command 'Add-MpPreference -ExclusionPath 'C:\Users''
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\Public\Citvon\Citvon.exe 'C:\Users\Public\Citvon\Citvon.exe'
Source: unknown Process created: C:\Users\Public\Citvon\Citvon.exe 'C:\Users\Public\Citvon\Citvon.exe'
Source: C:\Users\Public\Citvon\Citvon.exe Process created: C:\Users\Public\Citvon\Citvon.exe C:\Users\Public\Citvon\Citvon.exe
Source: C:\Users\Public\Citvon\Citvon.exe Process created: C:\Users\Public\Citvon\Citvon.exe C:\Users\Public\Citvon\Citvon.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\WWAHost.exe C:\Windows\SysWOW64\WWAHost.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\autofmt.exe C:\Windows\SysWOW64\autofmt.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exe
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Process created: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Jump to behavior
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\stt.bat' ' Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\PXOR.bat Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows \System32\Netplwiz.exe C:\Windows \System32\Netplwiz.exe Jump to behavior
Source: C:\Windows \System32\Netplwiz.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Cdex.bat Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command 'Add-MpPreference -ExclusionPath 'C:\Users'' Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Process created: C:\Users\Public\Citvon\Citvon.exe C:\Users\Public\Citvon\Citvon.exe Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Process created: C:\Users\Public\Citvon\Citvon.exe C:\Users\Public\Citvon\Citvon.exe Jump to behavior
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{317D06E8-5F24-433D-BDF7-79CE68D8ABC2}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: Binary string: msiexec.pdb source: Citvon.exe, 00000019.00000002.867393416.0000000000960000.00000040.00000001.sdmp
Source: Binary string: msiexec.pdbGCTL source: Citvon.exe, 00000019.00000002.867393416.0000000000960000.00000040.00000001.sdmp
Source: Binary string: netplwiz.pdb source: Netplwiz.exe, 00000008.00000002.702460692.00007FF61AD35000.00000002.00020000.sdmp
Source: Binary string: netplwiz.pdbGCTL source: Netplwiz.exe, 00000008.00000002.702460692.00007FF61AD35000.00000002.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: Citvonvhciktufwvyzyhistnewdjgsoqdr.exe, 00000003.00000002.698168920.0000000000B8F000.00000040.00000001.sdmp, Citvon.exe, 00000019.00000002.867470145.00000000009C0000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: Citvonvhciktufwvyzyhistnewdjgsoqdr.exe, Citvon.exe, 00000019.00000002.867470145.00000000009C0000.00000040.00000001.sdmp

Data Obfuscation:

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Unpacked PE file: 3.2.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.unpack CODE:ER;DATA:W;BSS:W;.idata:W;.tls:W;.rdata:R;.reloc:R;.rsrc:R; vs .text:ER;
Source: C:\Users\Public\Citvon\Citvon.exe Unpacked PE file: 25.2.Citvon.exe.400000.0.unpack CODE:ER;DATA:W;BSS:W;.idata:W;.tls:W;.rdata:R;.reloc:R;.rsrc:R; vs .text:ER;
Source: C:\Users\Public\Citvon\Citvon.exe Unpacked PE file: 27.2.Citvon.exe.400000.0.unpack CODE:ER;DATA:W;BSS:W;.idata:W;.tls:W;.rdata:R;.reloc:R;.rsrc:R; vs .text:ER;
Suspicious powershell command line found
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command 'Add-MpPreference -ExclusionPath 'C:\Users''
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command 'Add-MpPreference -ExclusionPath 'C:\Users'' Jump to behavior
PE file contains an invalid checksum
Source: Citvon.exe.0.dr Static PE information: real checksum: 0xb7705 should be: 0xb5507
Source: Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Static PE information: real checksum: 0xb7705 should be: 0xb5507
PE file contains sections with non-standard names
Source: NETUTILS.dll.6.dr Static PE information: section name: .xdata
Source: NETUTILS.dll.6.dr Static PE information: section name: /4
Source: NETUTILS.dll.6.dr Static PE information: section name: /19
Source: NETUTILS.dll.6.dr Static PE information: section name: /31
Source: NETUTILS.dll.6.dr Static PE information: section name: /45
Source: NETUTILS.dll.6.dr Static PE information: section name: /57
Source: NETUTILS.dll.6.dr Static PE information: section name: /70
Source: NETUTILS.dll.6.dr Static PE information: section name: /81
Source: NETUTILS.dll.6.dr Static PE information: section name: /92
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 0_3_02288222 push 00405E24h; ret 0_3_02288248
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 0_3_02288224 push 00405E24h; ret 0_3_02288248
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 0_3_0228825C push 00405E5Ch; ret 0_3_02288280
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 0_3_022853E8 push eax; ret 0_3_02285424
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 0_3_0228871C push 0040631Ch; ret 0_3_02288740
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 0_3_0228840A push 0040600Ch; ret 0_3_02288430
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 0_3_0228840C push 0040600Ch; ret 0_3_02288430
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 0_3_02289B74 push ecx; mov dword ptr [esp], eax 0_3_02289B75
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 0_3_02287F44 push 00405B69h; ret 0_3_02287F8D
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_004100F9 push ss; ret 3_2_004100FB
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00416216 push edx; ret 3_2_00416219
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_0040C303 push edx; ret 3_2_0040C30A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_0040C3CE push FFFFFF97h; iretd 3_2_0040C3D0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_0041B3B5 push eax; ret 3_2_0041B408
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_0041B46C push eax; ret 3_2_0041B472
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_0041B402 push eax; ret 3_2_0041B408
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_0041B40B push eax; ret 3_2_0041B472
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_004154F1 push ss; retf 3_2_00415683
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00415614 push ss; retf 3_2_00415683
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_0040CFD2 push ss; retf 3_2_0040CFD5
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_0040EF94 pushad ; iretd 3_2_0040EF95
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AED0D1 push ecx; ret 3_2_00AED0E4
Source: C:\Windows \System32\Netplwiz.exe Code function: 8_2_613CF021 pushfq ; iretd 8_2_613CF02A
Source: C:\Windows \System32\Netplwiz.exe Code function: 8_2_613CFD00 pushfq ; ret 8_2_613CFD01
Source: C:\Windows \System32\Netplwiz.exe Code function: 8_2_613D0DFE push rsp; iretd 8_2_613D0DFF
Source: C:\Users\Public\Citvon\Citvon.exe Code function: 17_3_022D53E8 push eax; ret 17_3_022D5424
Source: C:\Users\Public\Citvon\Citvon.exe Code function: 17_3_022DA934 push eax; ret 17_3_022DA970
Source: C:\Users\Public\Citvon\Citvon.exe Code function: 17_3_022D7F44 push 00405B69h; ret 17_3_022D7F8D
Source: C:\Users\Public\Citvon\Citvon.exe Code function: 20_3_02208222 push 00405E24h; ret 20_3_02208248
Source: C:\Users\Public\Citvon\Citvon.exe Code function: 20_3_02208222 push 00405E24h; ret 20_3_02208248
Source: C:\Users\Public\Citvon\Citvon.exe Code function: 20_3_02208224 push 00405E24h; ret 20_3_02208248

Persistence and Installation Behavior:

barindex
Drops executables to the windows directory (C:\Windows) and starts them
Source: C:\Windows\SysWOW64\cmd.exe Executable created and started: C:\Windows \System32\Netplwiz.exe Jump to behavior
Drops PE files
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe File created: C:\Users\Public\Netplwiz.exe Jump to dropped file
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe File created: C:\Users\Public\Citvon\Citvon.exe Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Windows \System32\Netplwiz.exe Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Windows \System32\NETUTILS.dll Jump to dropped file
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe File created: C:\Users\Public\NETUTILS.dll Jump to dropped file
Drops PE files to the user directory
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe File created: C:\Users\Public\Netplwiz.exe Jump to dropped file
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe File created: C:\Users\Public\NETUTILS.dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Windows \System32\Netplwiz.exe Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Windows \System32\NETUTILS.dll Jump to dropped file

Boot Survival:

barindex
Drops PE files to the user root directory
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe File created: C:\Users\Public\Netplwiz.exe Jump to dropped file
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe File created: C:\Users\Public\NETUTILS.dll Jump to dropped file
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Citvon Jump to behavior
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Citvon Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WWAHost.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe RDTSC instruction interceptor: First address: 000000000040896E second address: 0000000000408974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\Public\Citvon\Citvon.exe RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\Public\Citvon\Citvon.exe RDTSC instruction interceptor: First address: 000000000040896E second address: 0000000000408974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\WWAHost.exe RDTSC instruction interceptor: First address: 0000000000E585E4 second address: 0000000000E585EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\WWAHost.exe RDTSC instruction interceptor: First address: 0000000000E5896E second address: 0000000000E58974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msiexec.exe RDTSC instruction interceptor: First address: 00000000003185E4 second address: 00000000003185EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msiexec.exe RDTSC instruction interceptor: First address: 000000000031896E second address: 0000000000318974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains capabilities to detect virtual machines
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_004088A0 rdtsc 3_2_004088A0
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4961 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3420 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6864 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\WWAHost.exe Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: powershell.exe, 0000000D.00000002.753688742.00000172C28B0000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: powershell.exe, 0000000D.00000003.705849674.00000172A814A000.00000004.00000001.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}k
Source: powershell.exe, 0000000D.00000002.753688742.00000172C28B0000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: powershell.exe, 0000000D.00000002.753688742.00000172C28B0000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: powershell.exe, 0000000D.00000002.753688742.00000172C28B0000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Process queried: DebugPort
Source: C:\Windows\SysWOW64\WWAHost.exe Process queried: DebugPort
Source: C:\Windows\SysWOW64\msiexec.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_004088A0 rdtsc 3_2_004088A0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD9860 NtQuerySystemInformation,LdrInitializeThunk, 3_2_00AD9860
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows \System32\Netplwiz.exe Code function: 8_2_00007FF61AD317F0 GetCurrentThreadId,memset,IsDebuggerPresent,OutputDebugStringW, 8_2_00007FF61AD317F0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD90AF mov eax, dword ptr fs:[00000030h] 3_2_00AD90AF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA28AE mov eax, dword ptr fs:[00000030h] 3_2_00AA28AE
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA28AE mov eax, dword ptr fs:[00000030h] 3_2_00AA28AE
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA28AE mov eax, dword ptr fs:[00000030h] 3_2_00AA28AE
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA28AE mov ecx, dword ptr fs:[00000030h] 3_2_00AA28AE
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA28AE mov eax, dword ptr fs:[00000030h] 3_2_00AA28AE
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA28AE mov eax, dword ptr fs:[00000030h] 3_2_00AA28AE
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC20A0 mov eax, dword ptr fs:[00000030h] 3_2_00AC20A0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC20A0 mov eax, dword ptr fs:[00000030h] 3_2_00AC20A0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC20A0 mov eax, dword ptr fs:[00000030h] 3_2_00AC20A0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC20A0 mov eax, dword ptr fs:[00000030h] 3_2_00AC20A0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC20A0 mov eax, dword ptr fs:[00000030h] 3_2_00AC20A0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC20A0 mov eax, dword ptr fs:[00000030h] 3_2_00AC20A0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACF0BF mov ecx, dword ptr fs:[00000030h] 3_2_00ACF0BF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACF0BF mov eax, dword ptr fs:[00000030h] 3_2_00ACF0BF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACF0BF mov eax, dword ptr fs:[00000030h] 3_2_00ACF0BF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A99080 mov eax, dword ptr fs:[00000030h] 3_2_00A99080
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A93880 mov eax, dword ptr fs:[00000030h] 3_2_00A93880
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A93880 mov eax, dword ptr fs:[00000030h] 3_2_00A93880
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B13884 mov eax, dword ptr fs:[00000030h] 3_2_00B13884
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B13884 mov eax, dword ptr fs:[00000030h] 3_2_00B13884
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A958EC mov eax, dword ptr fs:[00000030h] 3_2_00A958EC
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A940E1 mov eax, dword ptr fs:[00000030h] 3_2_00A940E1
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A940E1 mov eax, dword ptr fs:[00000030h] 3_2_00A940E1
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A940E1 mov eax, dword ptr fs:[00000030h] 3_2_00A940E1
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB8E4 mov eax, dword ptr fs:[00000030h] 3_2_00ABB8E4
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB8E4 mov eax, dword ptr fs:[00000030h] 3_2_00ABB8E4
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA28FD mov eax, dword ptr fs:[00000030h] 3_2_00AA28FD
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA28FD mov eax, dword ptr fs:[00000030h] 3_2_00AA28FD
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA28FD mov eax, dword ptr fs:[00000030h] 3_2_00AA28FD
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B2B8D0 mov eax, dword ptr fs:[00000030h] 3_2_00B2B8D0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B2B8D0 mov ecx, dword ptr fs:[00000030h] 3_2_00B2B8D0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B2B8D0 mov eax, dword ptr fs:[00000030h] 3_2_00B2B8D0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B2B8D0 mov eax, dword ptr fs:[00000030h] 3_2_00B2B8D0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B2B8D0 mov eax, dword ptr fs:[00000030h] 3_2_00B2B8D0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B2B8D0 mov eax, dword ptr fs:[00000030h] 3_2_00B2B8D0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B518CA mov eax, dword ptr fs:[00000030h] 3_2_00B518CA
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AAB02A mov eax, dword ptr fs:[00000030h] 3_2_00AAB02A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AAB02A mov eax, dword ptr fs:[00000030h] 3_2_00AAB02A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AAB02A mov eax, dword ptr fs:[00000030h] 3_2_00AAB02A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AAB02A mov eax, dword ptr fs:[00000030h] 3_2_00AAB02A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC002D mov eax, dword ptr fs:[00000030h] 3_2_00AC002D
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC002D mov eax, dword ptr fs:[00000030h] 3_2_00AC002D
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC002D mov eax, dword ptr fs:[00000030h] 3_2_00AC002D
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC002D mov eax, dword ptr fs:[00000030h] 3_2_00AC002D
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC002D mov eax, dword ptr fs:[00000030h] 3_2_00AC002D
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC4020 mov edi, dword ptr fs:[00000030h] 3_2_00AC4020
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA830 mov eax, dword ptr fs:[00000030h] 3_2_00ABA830
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA830 mov eax, dword ptr fs:[00000030h] 3_2_00ABA830
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA830 mov eax, dword ptr fs:[00000030h] 3_2_00ABA830
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA830 mov eax, dword ptr fs:[00000030h] 3_2_00ABA830
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B64015 mov eax, dword ptr fs:[00000030h] 3_2_00B64015
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B64015 mov eax, dword ptr fs:[00000030h] 3_2_00B64015
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B17016 mov eax, dword ptr fs:[00000030h] 3_2_00B17016
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B17016 mov eax, dword ptr fs:[00000030h] 3_2_00B17016
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B17016 mov eax, dword ptr fs:[00000030h] 3_2_00B17016
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A96800 mov eax, dword ptr fs:[00000030h] 3_2_00A96800
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A96800 mov eax, dword ptr fs:[00000030h] 3_2_00A96800
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A96800 mov eax, dword ptr fs:[00000030h] 3_2_00A96800
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B61074 mov eax, dword ptr fs:[00000030h] 3_2_00B61074
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B52073 mov eax, dword ptr fs:[00000030h] 3_2_00B52073
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABF86D mov eax, dword ptr fs:[00000030h] 3_2_00ABF86D
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B51843 mov eax, dword ptr fs:[00000030h] 3_2_00B51843
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A95050 mov eax, dword ptr fs:[00000030h] 3_2_00A95050
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A95050 mov eax, dword ptr fs:[00000030h] 3_2_00A95050
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A95050 mov eax, dword ptr fs:[00000030h] 3_2_00A95050
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB0050 mov eax, dword ptr fs:[00000030h] 3_2_00AB0050
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB0050 mov eax, dword ptr fs:[00000030h] 3_2_00AB0050
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC61A0 mov eax, dword ptr fs:[00000030h] 3_2_00AC61A0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC61A0 mov eax, dword ptr fs:[00000030h] 3_2_00AC61A0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B151BE mov eax, dword ptr fs:[00000030h] 3_2_00B151BE
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B151BE mov eax, dword ptr fs:[00000030h] 3_2_00B151BE
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B151BE mov eax, dword ptr fs:[00000030h] 3_2_00B151BE
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B151BE mov eax, dword ptr fs:[00000030h] 3_2_00B151BE
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B549A4 mov eax, dword ptr fs:[00000030h] 3_2_00B549A4
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B549A4 mov eax, dword ptr fs:[00000030h] 3_2_00B549A4
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B549A4 mov eax, dword ptr fs:[00000030h] 3_2_00B549A4
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B549A4 mov eax, dword ptr fs:[00000030h] 3_2_00B549A4
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB99BF mov ecx, dword ptr fs:[00000030h] 3_2_00AB99BF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB99BF mov ecx, dword ptr fs:[00000030h] 3_2_00AB99BF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB99BF mov eax, dword ptr fs:[00000030h] 3_2_00AB99BF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB99BF mov ecx, dword ptr fs:[00000030h] 3_2_00AB99BF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB99BF mov ecx, dword ptr fs:[00000030h] 3_2_00AB99BF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB99BF mov eax, dword ptr fs:[00000030h] 3_2_00AB99BF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB99BF mov ecx, dword ptr fs:[00000030h] 3_2_00AB99BF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB99BF mov ecx, dword ptr fs:[00000030h] 3_2_00AB99BF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB99BF mov eax, dword ptr fs:[00000030h] 3_2_00AB99BF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB99BF mov ecx, dword ptr fs:[00000030h] 3_2_00AB99BF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB99BF mov ecx, dword ptr fs:[00000030h] 3_2_00AB99BF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB99BF mov eax, dword ptr fs:[00000030h] 3_2_00AB99BF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B169A6 mov eax, dword ptr fs:[00000030h] 3_2_00B169A6
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACA185 mov eax, dword ptr fs:[00000030h] 3_2_00ACA185
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABC182 mov eax, dword ptr fs:[00000030h] 3_2_00ABC182
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9519E mov eax, dword ptr fs:[00000030h] 3_2_00A9519E
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9519E mov ecx, dword ptr fs:[00000030h] 3_2_00A9519E
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC2990 mov eax, dword ptr fs:[00000030h] 3_2_00AC2990
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC4190 mov eax, dword ptr fs:[00000030h] 3_2_00AC4190
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5A189 mov eax, dword ptr fs:[00000030h] 3_2_00B5A189
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5A189 mov ecx, dword ptr fs:[00000030h] 3_2_00B5A189
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9B1E1 mov eax, dword ptr fs:[00000030h] 3_2_00A9B1E1
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9B1E1 mov eax, dword ptr fs:[00000030h] 3_2_00A9B1E1
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9B1E1 mov eax, dword ptr fs:[00000030h] 3_2_00A9B1E1
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A931E0 mov eax, dword ptr fs:[00000030h] 3_2_00A931E0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B689E7 mov eax, dword ptr fs:[00000030h] 3_2_00B689E7
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B241E8 mov eax, dword ptr fs:[00000030h] 3_2_00B241E8
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B519D8 mov eax, dword ptr fs:[00000030h] 3_2_00B519D8
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB4120 mov eax, dword ptr fs:[00000030h] 3_2_00AB4120
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB4120 mov eax, dword ptr fs:[00000030h] 3_2_00AB4120
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB4120 mov eax, dword ptr fs:[00000030h] 3_2_00AB4120
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB4120 mov eax, dword ptr fs:[00000030h] 3_2_00AB4120
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB4120 mov ecx, dword ptr fs:[00000030h] 3_2_00AB4120
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A93138 mov ecx, dword ptr fs:[00000030h] 3_2_00A93138
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC513A mov eax, dword ptr fs:[00000030h] 3_2_00AC513A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC513A mov eax, dword ptr fs:[00000030h] 3_2_00AC513A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A99100 mov eax, dword ptr fs:[00000030h] 3_2_00A99100
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A99100 mov eax, dword ptr fs:[00000030h] 3_2_00A99100
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A99100 mov eax, dword ptr fs:[00000030h] 3_2_00A99100
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9C962 mov eax, dword ptr fs:[00000030h] 3_2_00A9C962
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B68966 mov eax, dword ptr fs:[00000030h] 3_2_00B68966
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5E962 mov eax, dword ptr fs:[00000030h] 3_2_00B5E962
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9B171 mov eax, dword ptr fs:[00000030h] 3_2_00A9B171
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9B171 mov eax, dword ptr fs:[00000030h] 3_2_00A9B171
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B51951 mov eax, dword ptr fs:[00000030h] 3_2_00B51951
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB944 mov eax, dword ptr fs:[00000030h] 3_2_00ABB944
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB944 mov eax, dword ptr fs:[00000030h] 3_2_00ABB944
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9395E mov eax, dword ptr fs:[00000030h] 3_2_00A9395E
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9395E mov eax, dword ptr fs:[00000030h] 3_2_00A9395E
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A91AA0 mov eax, dword ptr fs:[00000030h] 3_2_00A91AA0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A952A5 mov eax, dword ptr fs:[00000030h] 3_2_00A952A5
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A952A5 mov eax, dword ptr fs:[00000030h] 3_2_00A952A5
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A952A5 mov eax, dword ptr fs:[00000030h] 3_2_00A952A5
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A952A5 mov eax, dword ptr fs:[00000030h] 3_2_00A952A5
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A952A5 mov eax, dword ptr fs:[00000030h] 3_2_00A952A5
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC5AA0 mov eax, dword ptr fs:[00000030h] 3_2_00AC5AA0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC5AA0 mov eax, dword ptr fs:[00000030h] 3_2_00AC5AA0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC12BD mov esi, dword ptr fs:[00000030h] 3_2_00AC12BD
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC12BD mov eax, dword ptr fs:[00000030h] 3_2_00AC12BD
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC12BD mov eax, dword ptr fs:[00000030h] 3_2_00AC12BD
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AAAAB0 mov eax, dword ptr fs:[00000030h] 3_2_00AAAAB0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AAAAB0 mov eax, dword ptr fs:[00000030h] 3_2_00AAAAB0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACFAB0 mov eax, dword ptr fs:[00000030h] 3_2_00ACFAB0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5129A mov eax, dword ptr fs:[00000030h] 3_2_00B5129A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACD294 mov eax, dword ptr fs:[00000030h] 3_2_00ACD294
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACD294 mov eax, dword ptr fs:[00000030h] 3_2_00ACD294
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC2AE4 mov eax, dword ptr fs:[00000030h] 3_2_00AC2AE4
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54AEF mov eax, dword ptr fs:[00000030h] 3_2_00B54AEF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54AEF mov eax, dword ptr fs:[00000030h] 3_2_00B54AEF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54AEF mov eax, dword ptr fs:[00000030h] 3_2_00B54AEF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54AEF mov eax, dword ptr fs:[00000030h] 3_2_00B54AEF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54AEF mov eax, dword ptr fs:[00000030h] 3_2_00B54AEF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54AEF mov eax, dword ptr fs:[00000030h] 3_2_00B54AEF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54AEF mov eax, dword ptr fs:[00000030h] 3_2_00B54AEF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54AEF mov eax, dword ptr fs:[00000030h] 3_2_00B54AEF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54AEF mov eax, dword ptr fs:[00000030h] 3_2_00B54AEF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54AEF mov eax, dword ptr fs:[00000030h] 3_2_00B54AEF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54AEF mov eax, dword ptr fs:[00000030h] 3_2_00B54AEF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54AEF mov eax, dword ptr fs:[00000030h] 3_2_00B54AEF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54AEF mov eax, dword ptr fs:[00000030h] 3_2_00B54AEF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54AEF mov eax, dword ptr fs:[00000030h] 3_2_00B54AEF
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A93ACA mov eax, dword ptr fs:[00000030h] 3_2_00A93ACA
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC2ACB mov eax, dword ptr fs:[00000030h] 3_2_00AC2ACB
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A95AC0 mov eax, dword ptr fs:[00000030h] 3_2_00A95AC0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A95AC0 mov eax, dword ptr fs:[00000030h] 3_2_00A95AC0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A95AC0 mov eax, dword ptr fs:[00000030h] 3_2_00A95AC0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B68ADD mov eax, dword ptr fs:[00000030h] 3_2_00B68ADD
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A912D4 mov eax, dword ptr fs:[00000030h] 3_2_00A912D4
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD4A2C mov eax, dword ptr fs:[00000030h] 3_2_00AD4A2C
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD4A2C mov eax, dword ptr fs:[00000030h] 3_2_00AD4A2C
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA229 mov eax, dword ptr fs:[00000030h] 3_2_00ABA229
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA229 mov eax, dword ptr fs:[00000030h] 3_2_00ABA229
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA229 mov eax, dword ptr fs:[00000030h] 3_2_00ABA229
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA229 mov eax, dword ptr fs:[00000030h] 3_2_00ABA229
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA229 mov eax, dword ptr fs:[00000030h] 3_2_00ABA229
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA229 mov eax, dword ptr fs:[00000030h] 3_2_00ABA229
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA229 mov eax, dword ptr fs:[00000030h] 3_2_00ABA229
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA229 mov eax, dword ptr fs:[00000030h] 3_2_00ABA229
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA229 mov eax, dword ptr fs:[00000030h] 3_2_00ABA229
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A94A20 mov eax, dword ptr fs:[00000030h] 3_2_00A94A20
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A94A20 mov eax, dword ptr fs:[00000030h] 3_2_00A94A20
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A98239 mov eax, dword ptr fs:[00000030h] 3_2_00A98239
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A98239 mov eax, dword ptr fs:[00000030h] 3_2_00A98239
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A98239 mov eax, dword ptr fs:[00000030h] 3_2_00A98239
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B51229 mov eax, dword ptr fs:[00000030h] 3_2_00B51229
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB236 mov eax, dword ptr fs:[00000030h] 3_2_00ABB236
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB236 mov eax, dword ptr fs:[00000030h] 3_2_00ABB236
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB236 mov eax, dword ptr fs:[00000030h] 3_2_00ABB236
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB236 mov eax, dword ptr fs:[00000030h] 3_2_00ABB236
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB236 mov eax, dword ptr fs:[00000030h] 3_2_00ABB236
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB236 mov eax, dword ptr fs:[00000030h] 3_2_00ABB236
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA8A0A mov eax, dword ptr fs:[00000030h] 3_2_00AA8A0A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5AA16 mov eax, dword ptr fs:[00000030h] 3_2_00B5AA16
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5AA16 mov eax, dword ptr fs:[00000030h] 3_2_00B5AA16
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB3A1C mov eax, dword ptr fs:[00000030h] 3_2_00AB3A1C
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A95210 mov eax, dword ptr fs:[00000030h] 3_2_00A95210
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A95210 mov ecx, dword ptr fs:[00000030h] 3_2_00A95210
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A95210 mov eax, dword ptr fs:[00000030h] 3_2_00A95210
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A95210 mov eax, dword ptr fs:[00000030h] 3_2_00A95210
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9AA16 mov eax, dword ptr fs:[00000030h] 3_2_00A9AA16
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9AA16 mov eax, dword ptr fs:[00000030h] 3_2_00A9AA16
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD5A69 mov eax, dword ptr fs:[00000030h] 3_2_00AD5A69
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD5A69 mov eax, dword ptr fs:[00000030h] 3_2_00AD5A69
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD5A69 mov eax, dword ptr fs:[00000030h] 3_2_00AD5A69
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B4B260 mov eax, dword ptr fs:[00000030h] 3_2_00B4B260
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B4B260 mov eax, dword ptr fs:[00000030h] 3_2_00B4B260
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B68A62 mov eax, dword ptr fs:[00000030h] 3_2_00B68A62
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD927A mov eax, dword ptr fs:[00000030h] 3_2_00AD927A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5EA55 mov eax, dword ptr fs:[00000030h] 3_2_00B5EA55
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B24257 mov eax, dword ptr fs:[00000030h] 3_2_00B24257
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A99240 mov eax, dword ptr fs:[00000030h] 3_2_00A99240
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A99240 mov eax, dword ptr fs:[00000030h] 3_2_00A99240
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A99240 mov eax, dword ptr fs:[00000030h] 3_2_00A99240
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A99240 mov eax, dword ptr fs:[00000030h] 3_2_00A99240
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B51A5F mov eax, dword ptr fs:[00000030h] 3_2_00B51A5F
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B68BB6 mov eax, dword ptr fs:[00000030h] 3_2_00B68BB6
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC4BAD mov eax, dword ptr fs:[00000030h] 3_2_00AC4BAD
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC4BAD mov eax, dword ptr fs:[00000030h] 3_2_00AC4BAD
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC4BAD mov eax, dword ptr fs:[00000030h] 3_2_00AC4BAD
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B69BBE mov eax, dword ptr fs:[00000030h] 3_2_00B69BBE
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B65BA5 mov eax, dword ptr fs:[00000030h] 3_2_00B65BA5
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B51BA8 mov eax, dword ptr fs:[00000030h] 3_2_00B51BA8
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA1B8F mov eax, dword ptr fs:[00000030h] 3_2_00AA1B8F
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA1B8F mov eax, dword ptr fs:[00000030h] 3_2_00AA1B8F
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC138B mov eax, dword ptr fs:[00000030h] 3_2_00AC138B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC138B mov eax, dword ptr fs:[00000030h] 3_2_00AC138B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC138B mov eax, dword ptr fs:[00000030h] 3_2_00AC138B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABEB9A mov eax, dword ptr fs:[00000030h] 3_2_00ABEB9A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABEB9A mov eax, dword ptr fs:[00000030h] 3_2_00ABEB9A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B4D380 mov ecx, dword ptr fs:[00000030h] 3_2_00B4D380
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B3EB8A mov ecx, dword ptr fs:[00000030h] 3_2_00B3EB8A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B3EB8A mov eax, dword ptr fs:[00000030h] 3_2_00B3EB8A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B3EB8A mov eax, dword ptr fs:[00000030h] 3_2_00B3EB8A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B3EB8A mov eax, dword ptr fs:[00000030h] 3_2_00B3EB8A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC2397 mov eax, dword ptr fs:[00000030h] 3_2_00AC2397
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACB390 mov eax, dword ptr fs:[00000030h] 3_2_00ACB390
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A94B94 mov edi, dword ptr fs:[00000030h] 3_2_00A94B94
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5138A mov eax, dword ptr fs:[00000030h] 3_2_00B5138A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A91BE9 mov eax, dword ptr fs:[00000030h] 3_2_00A91BE9
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABDBE9 mov eax, dword ptr fs:[00000030h] 3_2_00ABDBE9
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC03E2 mov eax, dword ptr fs:[00000030h] 3_2_00AC03E2
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC03E2 mov eax, dword ptr fs:[00000030h] 3_2_00AC03E2
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC03E2 mov eax, dword ptr fs:[00000030h] 3_2_00AC03E2
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC03E2 mov eax, dword ptr fs:[00000030h] 3_2_00AC03E2
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC03E2 mov eax, dword ptr fs:[00000030h] 3_2_00AC03E2
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC03E2 mov eax, dword ptr fs:[00000030h] 3_2_00AC03E2
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B423E3 mov ecx, dword ptr fs:[00000030h] 3_2_00B423E3
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B423E3 mov ecx, dword ptr fs:[00000030h] 3_2_00B423E3
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B423E3 mov eax, dword ptr fs:[00000030h] 3_2_00B423E3
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC53C5 mov eax, dword ptr fs:[00000030h] 3_2_00AC53C5
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B153CA mov eax, dword ptr fs:[00000030h] 3_2_00B153CA
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B153CA mov eax, dword ptr fs:[00000030h] 3_2_00B153CA
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 mov eax, dword ptr fs:[00000030h] 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 mov eax, dword ptr fs:[00000030h] 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 mov eax, dword ptr fs:[00000030h] 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 mov eax, dword ptr fs:[00000030h] 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 mov eax, dword ptr fs:[00000030h] 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 mov eax, dword ptr fs:[00000030h] 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 mov eax, dword ptr fs:[00000030h] 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 mov eax, dword ptr fs:[00000030h] 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 mov eax, dword ptr fs:[00000030h] 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 mov eax, dword ptr fs:[00000030h] 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 mov eax, dword ptr fs:[00000030h] 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 mov eax, dword ptr fs:[00000030h] 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 mov eax, dword ptr fs:[00000030h] 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 mov eax, dword ptr fs:[00000030h] 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 mov eax, dword ptr fs:[00000030h] 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 mov eax, dword ptr fs:[00000030h] 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 mov eax, dword ptr fs:[00000030h] 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 mov eax, dword ptr fs:[00000030h] 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 mov eax, dword ptr fs:[00000030h] 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 mov eax, dword ptr fs:[00000030h] 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABA309 mov eax, dword ptr fs:[00000030h] 3_2_00ABA309
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5131B mov eax, dword ptr fs:[00000030h] 3_2_00B5131B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9DB60 mov ecx, dword ptr fs:[00000030h] 3_2_00A9DB60
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC3B7A mov eax, dword ptr fs:[00000030h] 3_2_00AC3B7A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC3B7A mov eax, dword ptr fs:[00000030h] 3_2_00AC3B7A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AAF370 mov eax, dword ptr fs:[00000030h] 3_2_00AAF370
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AAF370 mov eax, dword ptr fs:[00000030h] 3_2_00AAF370
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AAF370 mov eax, dword ptr fs:[00000030h] 3_2_00AAF370
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9DB40 mov eax, dword ptr fs:[00000030h] 3_2_00A9DB40
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B68B58 mov eax, dword ptr fs:[00000030h] 3_2_00B68B58
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9F358 mov eax, dword ptr fs:[00000030h] 3_2_00A9F358
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC3B5A mov eax, dword ptr fs:[00000030h] 3_2_00AC3B5A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC3B5A mov eax, dword ptr fs:[00000030h] 3_2_00AC3B5A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC3B5A mov eax, dword ptr fs:[00000030h] 3_2_00AC3B5A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC3B5A mov eax, dword ptr fs:[00000030h] 3_2_00AC3B5A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B69CB3 mov eax, dword ptr fs:[00000030h] 3_2_00B69CB3
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A94CB0 mov eax, dword ptr fs:[00000030h] 3_2_00A94CB0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54496 mov eax, dword ptr fs:[00000030h] 3_2_00B54496
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54496 mov eax, dword ptr fs:[00000030h] 3_2_00B54496
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54496 mov eax, dword ptr fs:[00000030h] 3_2_00B54496
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54496 mov eax, dword ptr fs:[00000030h] 3_2_00B54496
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54496 mov eax, dword ptr fs:[00000030h] 3_2_00B54496
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54496 mov eax, dword ptr fs:[00000030h] 3_2_00B54496
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54496 mov eax, dword ptr fs:[00000030h] 3_2_00B54496
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54496 mov eax, dword ptr fs:[00000030h] 3_2_00B54496
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54496 mov eax, dword ptr fs:[00000030h] 3_2_00B54496
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54496 mov eax, dword ptr fs:[00000030h] 3_2_00B54496
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54496 mov eax, dword ptr fs:[00000030h] 3_2_00B54496
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54496 mov eax, dword ptr fs:[00000030h] 3_2_00B54496
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B54496 mov eax, dword ptr fs:[00000030h] 3_2_00B54496
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A91480 mov eax, dword ptr fs:[00000030h] 3_2_00A91480
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA849B mov eax, dword ptr fs:[00000030h] 3_2_00AA849B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9649B mov eax, dword ptr fs:[00000030h] 3_2_00A9649B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9649B mov eax, dword ptr fs:[00000030h] 3_2_00A9649B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B16CF0 mov eax, dword ptr fs:[00000030h] 3_2_00B16CF0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B16CF0 mov eax, dword ptr fs:[00000030h] 3_2_00B16CF0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B16CF0 mov eax, dword ptr fs:[00000030h] 3_2_00B16CF0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B514FB mov eax, dword ptr fs:[00000030h] 3_2_00B514FB
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B68CD6 mov eax, dword ptr fs:[00000030h] 3_2_00B68CD6
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A92CDB mov eax, dword ptr fs:[00000030h] 3_2_00A92CDB
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACBC2C mov eax, dword ptr fs:[00000030h] 3_2_00ACBC2C
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A94439 mov eax, dword ptr fs:[00000030h] 3_2_00A94439
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC3C3E mov eax, dword ptr fs:[00000030h] 3_2_00AC3C3E
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC3C3E mov eax, dword ptr fs:[00000030h] 3_2_00AC3C3E
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC3C3E mov eax, dword ptr fs:[00000030h] 3_2_00AC3C3E
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AAB433 mov eax, dword ptr fs:[00000030h] 3_2_00AAB433
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AAB433 mov eax, dword ptr fs:[00000030h] 3_2_00AAB433
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AAB433 mov eax, dword ptr fs:[00000030h] 3_2_00AAB433
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B68C14 mov eax, dword ptr fs:[00000030h] 3_2_00B68C14
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B51C06 mov eax, dword ptr fs:[00000030h] 3_2_00B51C06
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B51C06 mov eax, dword ptr fs:[00000030h] 3_2_00B51C06
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B51C06 mov eax, dword ptr fs:[00000030h] 3_2_00B51C06
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B51C06 mov eax, dword ptr fs:[00000030h] 3_2_00B51C06
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B51C06 mov eax, dword ptr fs:[00000030h] 3_2_00B51C06
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B51C06 mov eax, dword ptr fs:[00000030h] 3_2_00B51C06
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B51C06 mov eax, dword ptr fs:[00000030h] 3_2_00B51C06
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B51C06 mov eax, dword ptr fs:[00000030h] 3_2_00B51C06
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B51C06 mov eax, dword ptr fs:[00000030h] 3_2_00B51C06
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B51C06 mov eax, dword ptr fs:[00000030h] 3_2_00B51C06
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B51C06 mov eax, dword ptr fs:[00000030h] 3_2_00B51C06
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B51C06 mov eax, dword ptr fs:[00000030h] 3_2_00B51C06
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B51C06 mov eax, dword ptr fs:[00000030h] 3_2_00B51C06
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B51C06 mov eax, dword ptr fs:[00000030h] 3_2_00B51C06
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B6740D mov eax, dword ptr fs:[00000030h] 3_2_00B6740D
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B6740D mov eax, dword ptr fs:[00000030h] 3_2_00B6740D
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B6740D mov eax, dword ptr fs:[00000030h] 3_2_00B6740D
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B16C0A mov eax, dword ptr fs:[00000030h] 3_2_00B16C0A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B16C0A mov eax, dword ptr fs:[00000030h] 3_2_00B16C0A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B16C0A mov eax, dword ptr fs:[00000030h] 3_2_00B16C0A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B16C0A mov eax, dword ptr fs:[00000030h] 3_2_00B16C0A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B68C75 mov eax, dword ptr fs:[00000030h] 3_2_00B68C75
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB746D mov eax, dword ptr fs:[00000030h] 3_2_00AB746D
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACAC7B mov eax, dword ptr fs:[00000030h] 3_2_00ACAC7B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACAC7B mov eax, dword ptr fs:[00000030h] 3_2_00ACAC7B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACAC7B mov eax, dword ptr fs:[00000030h] 3_2_00ACAC7B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACAC7B mov eax, dword ptr fs:[00000030h] 3_2_00ACAC7B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACAC7B mov eax, dword ptr fs:[00000030h] 3_2_00ACAC7B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACAC7B mov eax, dword ptr fs:[00000030h] 3_2_00ACAC7B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACAC7B mov eax, dword ptr fs:[00000030h] 3_2_00ACAC7B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACAC7B mov eax, dword ptr fs:[00000030h] 3_2_00ACAC7B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACAC7B mov eax, dword ptr fs:[00000030h] 3_2_00ACAC7B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACAC7B mov eax, dword ptr fs:[00000030h] 3_2_00ACAC7B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACAC7B mov eax, dword ptr fs:[00000030h] 3_2_00ACAC7B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB477 mov eax, dword ptr fs:[00000030h] 3_2_00ABB477
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB477 mov eax, dword ptr fs:[00000030h] 3_2_00ABB477
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB477 mov eax, dword ptr fs:[00000030h] 3_2_00ABB477
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB477 mov eax, dword ptr fs:[00000030h] 3_2_00ABB477
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB477 mov eax, dword ptr fs:[00000030h] 3_2_00ABB477
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB477 mov eax, dword ptr fs:[00000030h] 3_2_00ABB477
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB477 mov eax, dword ptr fs:[00000030h] 3_2_00ABB477
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB477 mov eax, dword ptr fs:[00000030h] 3_2_00ABB477
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB477 mov eax, dword ptr fs:[00000030h] 3_2_00ABB477
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB477 mov eax, dword ptr fs:[00000030h] 3_2_00ABB477
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB477 mov eax, dword ptr fs:[00000030h] 3_2_00ABB477
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABB477 mov eax, dword ptr fs:[00000030h] 3_2_00ABB477
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD5C70 mov eax, dword ptr fs:[00000030h] 3_2_00AD5C70
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B2C450 mov eax, dword ptr fs:[00000030h] 3_2_00B2C450
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B2C450 mov eax, dword ptr fs:[00000030h] 3_2_00B2C450
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B68450 mov eax, dword ptr fs:[00000030h] 3_2_00B68450
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACA44B mov eax, dword ptr fs:[00000030h] 3_2_00ACA44B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC65A0 mov eax, dword ptr fs:[00000030h] 3_2_00AC65A0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC65A0 mov eax, dword ptr fs:[00000030h] 3_2_00AC65A0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC65A0 mov eax, dword ptr fs:[00000030h] 3_2_00AC65A0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC35A1 mov eax, dword ptr fs:[00000030h] 3_2_00AC35A1
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC1DB5 mov eax, dword ptr fs:[00000030h] 3_2_00AC1DB5
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC1DB5 mov eax, dword ptr fs:[00000030h] 3_2_00AC1DB5
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC1DB5 mov eax, dword ptr fs:[00000030h] 3_2_00AC1DB5
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B605AC mov eax, dword ptr fs:[00000030h] 3_2_00B605AC
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B605AC mov eax, dword ptr fs:[00000030h] 3_2_00B605AC
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A92D8A mov eax, dword ptr fs:[00000030h] 3_2_00A92D8A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A92D8A mov eax, dword ptr fs:[00000030h] 3_2_00A92D8A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A92D8A mov eax, dword ptr fs:[00000030h] 3_2_00A92D8A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A92D8A mov eax, dword ptr fs:[00000030h] 3_2_00A92D8A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A92D8A mov eax, dword ptr fs:[00000030h] 3_2_00A92D8A
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC2581 mov eax, dword ptr fs:[00000030h] 3_2_00AC2581
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC2581 mov eax, dword ptr fs:[00000030h] 3_2_00AC2581
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC2581 mov eax, dword ptr fs:[00000030h] 3_2_00AC2581
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC2581 mov eax, dword ptr fs:[00000030h] 3_2_00AC2581
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5B581 mov eax, dword ptr fs:[00000030h] 3_2_00B5B581
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5B581 mov eax, dword ptr fs:[00000030h] 3_2_00B5B581
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5B581 mov eax, dword ptr fs:[00000030h] 3_2_00B5B581
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5B581 mov eax, dword ptr fs:[00000030h] 3_2_00B5B581
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACFD9B mov eax, dword ptr fs:[00000030h] 3_2_00ACFD9B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACFD9B mov eax, dword ptr fs:[00000030h] 3_2_00ACFD9B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B52D82 mov eax, dword ptr fs:[00000030h] 3_2_00B52D82
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B52D82 mov eax, dword ptr fs:[00000030h] 3_2_00B52D82
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B52D82 mov eax, dword ptr fs:[00000030h] 3_2_00B52D82
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B52D82 mov eax, dword ptr fs:[00000030h] 3_2_00B52D82
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B52D82 mov eax, dword ptr fs:[00000030h] 3_2_00B52D82
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B52D82 mov eax, dword ptr fs:[00000030h] 3_2_00B52D82
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B52D82 mov eax, dword ptr fs:[00000030h] 3_2_00B52D82
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A93591 mov eax, dword ptr fs:[00000030h] 3_2_00A93591
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC95EC mov eax, dword ptr fs:[00000030h] 3_2_00AC95EC
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B48DF1 mov eax, dword ptr fs:[00000030h] 3_2_00B48DF1
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AAD5E0 mov eax, dword ptr fs:[00000030h] 3_2_00AAD5E0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AAD5E0 mov eax, dword ptr fs:[00000030h] 3_2_00AAD5E0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5FDE2 mov eax, dword ptr fs:[00000030h] 3_2_00B5FDE2
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5FDE2 mov eax, dword ptr fs:[00000030h] 3_2_00B5FDE2
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5FDE2 mov eax, dword ptr fs:[00000030h] 3_2_00B5FDE2
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5FDE2 mov eax, dword ptr fs:[00000030h] 3_2_00B5FDE2
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A995F0 mov eax, dword ptr fs:[00000030h] 3_2_00A995F0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A995F0 mov ecx, dword ptr fs:[00000030h] 3_2_00A995F0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B4FDD3 mov eax, dword ptr fs:[00000030h] 3_2_00B4FDD3
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A915C1 mov eax, dword ptr fs:[00000030h] 3_2_00A915C1
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B16DC9 mov eax, dword ptr fs:[00000030h] 3_2_00B16DC9
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B16DC9 mov eax, dword ptr fs:[00000030h] 3_2_00B16DC9
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B16DC9 mov eax, dword ptr fs:[00000030h] 3_2_00B16DC9
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B16DC9 mov ecx, dword ptr fs:[00000030h] 3_2_00B16DC9
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B16DC9 mov eax, dword ptr fs:[00000030h] 3_2_00B16DC9
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B16DC9 mov eax, dword ptr fs:[00000030h] 3_2_00B16DC9
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B68D34 mov eax, dword ptr fs:[00000030h] 3_2_00B68D34
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B1A537 mov eax, dword ptr fs:[00000030h] 3_2_00B1A537
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACF527 mov eax, dword ptr fs:[00000030h] 3_2_00ACF527
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACF527 mov eax, dword ptr fs:[00000030h] 3_2_00ACF527
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACF527 mov eax, dword ptr fs:[00000030h] 3_2_00ACF527
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B5E539 mov eax, dword ptr fs:[00000030h] 3_2_00B5E539
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC4D3B mov eax, dword ptr fs:[00000030h] 3_2_00AC4D3B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC4D3B mov eax, dword ptr fs:[00000030h] 3_2_00AC4D3B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC4D3B mov eax, dword ptr fs:[00000030h] 3_2_00AC4D3B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9AD30 mov eax, dword ptr fs:[00000030h] 3_2_00A9AD30
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA3D34 mov eax, dword ptr fs:[00000030h] 3_2_00AA3D34
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA3D34 mov eax, dword ptr fs:[00000030h] 3_2_00AA3D34
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA3D34 mov eax, dword ptr fs:[00000030h] 3_2_00AA3D34
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA3D34 mov eax, dword ptr fs:[00000030h] 3_2_00AA3D34
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA3D34 mov eax, dword ptr fs:[00000030h] 3_2_00AA3D34
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA3D34 mov eax, dword ptr fs:[00000030h] 3_2_00AA3D34
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA3D34 mov eax, dword ptr fs:[00000030h] 3_2_00AA3D34
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA3D34 mov eax, dword ptr fs:[00000030h] 3_2_00AA3D34
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA3D34 mov eax, dword ptr fs:[00000030h] 3_2_00AA3D34
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA3D34 mov eax, dword ptr fs:[00000030h] 3_2_00AA3D34
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA3D34 mov eax, dword ptr fs:[00000030h] 3_2_00AA3D34
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA3D34 mov eax, dword ptr fs:[00000030h] 3_2_00AA3D34
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA3D34 mov eax, dword ptr fs:[00000030h] 3_2_00AA3D34
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B53518 mov eax, dword ptr fs:[00000030h] 3_2_00B53518
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B53518 mov eax, dword ptr fs:[00000030h] 3_2_00B53518
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B53518 mov eax, dword ptr fs:[00000030h] 3_2_00B53518
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABC577 mov eax, dword ptr fs:[00000030h] 3_2_00ABC577
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ABC577 mov eax, dword ptr fs:[00000030h] 3_2_00ABC577
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB8D76 mov eax, dword ptr fs:[00000030h] 3_2_00AB8D76
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB8D76 mov eax, dword ptr fs:[00000030h] 3_2_00AB8D76
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB8D76 mov eax, dword ptr fs:[00000030h] 3_2_00AB8D76
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB8D76 mov eax, dword ptr fs:[00000030h] 3_2_00AB8D76
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB8D76 mov eax, dword ptr fs:[00000030h] 3_2_00AB8D76
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9354C mov eax, dword ptr fs:[00000030h] 3_2_00A9354C
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9354C mov eax, dword ptr fs:[00000030h] 3_2_00A9354C
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD3D43 mov eax, dword ptr fs:[00000030h] 3_2_00AD3D43
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B13540 mov eax, dword ptr fs:[00000030h] 3_2_00B13540
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B43D40 mov eax, dword ptr fs:[00000030h] 3_2_00B43D40
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AB7D50 mov eax, dword ptr fs:[00000030h] 3_2_00AB7D50
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD4D51 mov eax, dword ptr fs:[00000030h] 3_2_00AD4D51
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD4D51 mov eax, dword ptr fs:[00000030h] 3_2_00AD4D51
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B556B6 mov eax, dword ptr fs:[00000030h] 3_2_00B556B6
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B556B6 mov eax, dword ptr fs:[00000030h] 3_2_00B556B6
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B22EA3 mov eax, dword ptr fs:[00000030h] 3_2_00B22EA3
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B60EA5 mov eax, dword ptr fs:[00000030h] 3_2_00B60EA5
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B60EA5 mov eax, dword ptr fs:[00000030h] 3_2_00B60EA5
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B60EA5 mov eax, dword ptr fs:[00000030h] 3_2_00B60EA5
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B146A7 mov eax, dword ptr fs:[00000030h] 3_2_00B146A7
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A93E80 mov eax, dword ptr fs:[00000030h] 3_2_00A93E80
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A93E80 mov eax, dword ptr fs:[00000030h] 3_2_00A93E80
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACDE9E mov eax, dword ptr fs:[00000030h] 3_2_00ACDE9E
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACDE9E mov eax, dword ptr fs:[00000030h] 3_2_00ACDE9E
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00ACDE9E mov eax, dword ptr fs:[00000030h] 3_2_00ACDE9E
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B2FE87 mov eax, dword ptr fs:[00000030h] 3_2_00B2FE87
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AA76E2 mov eax, dword ptr fs:[00000030h] 3_2_00AA76E2
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD3EE4 mov eax, dword ptr fs:[00000030h] 3_2_00AD3EE4
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD3EE4 mov eax, dword ptr fs:[00000030h] 3_2_00AD3EE4
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD3EE4 mov eax, dword ptr fs:[00000030h] 3_2_00AD3EE4
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC16E0 mov ecx, dword ptr fs:[00000030h] 3_2_00AC16E0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B68ED6 mov eax, dword ptr fs:[00000030h] 3_2_00B68ED6
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AC36CC mov eax, dword ptr fs:[00000030h] 3_2_00AC36CC
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD8EC7 mov eax, dword ptr fs:[00000030h] 3_2_00AD8EC7
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B4FEC0 mov eax, dword ptr fs:[00000030h] 3_2_00B4FEC0
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9E620 mov eax, dword ptr fs:[00000030h] 3_2_00A9E620
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B4FE3F mov eax, dword ptr fs:[00000030h] 3_2_00B4FE3F
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00AD0E21 mov eax, dword ptr fs:[00000030h] 3_2_00AD0E21
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9A63B mov eax, dword ptr fs:[00000030h] 3_2_00A9A63B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9A63B mov eax, dword ptr fs:[00000030h] 3_2_00A9A63B
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B15623 mov eax, dword ptr fs:[00000030h] 3_2_00B15623
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B15623 mov eax, dword ptr fs:[00000030h] 3_2_00B15623
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B15623 mov eax, dword ptr fs:[00000030h] 3_2_00B15623
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B15623 mov eax, dword ptr fs:[00000030h] 3_2_00B15623
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B15623 mov eax, dword ptr fs:[00000030h] 3_2_00B15623
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B15623 mov eax, dword ptr fs:[00000030h] 3_2_00B15623
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B15623 mov eax, dword ptr fs:[00000030h] 3_2_00B15623
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B15623 mov eax, dword ptr fs:[00000030h] 3_2_00B15623
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B15623 mov eax, dword ptr fs:[00000030h] 3_2_00B15623
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00B22E14 mov eax, dword ptr fs:[00000030h] 3_2_00B22E14
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9C600 mov eax, dword ptr fs:[00000030h] 3_2_00A9C600
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Code function: 3_2_00A9C600 mov eax, dword ptr fs:[00000030h] 3_2_00A9C600
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows \System32\Netplwiz.exe Code function: 8_2_00007FF61AD32418 GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 8_2_00007FF61AD32418
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WWAHost.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\msiexec.exe Process token adjusted: Debug
Source: C:\Windows \System32\Netplwiz.exe Code function: 8_2_613C1BC0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 8_2_613C1BC0
Source: C:\Windows \System32\Netplwiz.exe Code function: 8_2_00007FF61AD33B90 SetUnhandledExceptionFilter, 8_2_00007FF61AD33B90
Source: C:\Windows \System32\Netplwiz.exe Code function: 8_2_00007FF61AD338E4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 8_2_00007FF61AD338E4

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.thrg33.club
Source: C:\Windows\explorer.exe Domain query: www.georgeswebwerks.com
Source: C:\Windows\explorer.exe Network Connect: 198.54.117.212 80 Jump to behavior
Adds a directory exclusion to Windows Defender
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command 'Add-MpPreference -ExclusionPath 'C:\Users''
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command 'Add-MpPreference -ExclusionPath 'C:\Users'' Jump to behavior
DLL side loading technique detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\System32\netutils.dll Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Memory written: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Memory written: C:\Users\Public\Citvon\Citvon.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Memory written: C:\Users\Public\Citvon\Citvon.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\Public\Citvon\Citvon.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Section loaded: unknown target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and write Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Section loaded: unknown target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and write Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Users\Public\Citvon\Citvon.exe Section loaded: unknown target: C:\Windows\SysWOW64\WWAHost.exe protection: execute and read and write
Source: C:\Users\Public\Citvon\Citvon.exe Section loaded: unknown target: C:\Windows\SysWOW64\WWAHost.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\WWAHost.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\WWAHost.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\Public\Citvon\Citvon.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Thread register set: target process: 3424
Source: C:\Windows\SysWOW64\WWAHost.exe Thread register set: target process: 3424
Queues an APC in another process (thread injection)
Source: C:\Users\Public\Citvon\Citvon.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\Public\Citvon\Citvon.exe Section unmapped: C:\Windows\SysWOW64\msiexec.exe base address: B60000 Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Section unmapped: C:\Windows\SysWOW64\WWAHost.exe base address: 1340000
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Process created: C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe C:\Users\user\Desktop\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\PXOR.bat Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows \System32\Netplwiz.exe C:\Windows \System32\Netplwiz.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command 'Add-MpPreference -ExclusionPath 'C:\Users'' Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Process created: C:\Users\Public\Citvon\Citvon.exe C:\Users\Public\Citvon\Citvon.exe Jump to behavior
Source: C:\Users\Public\Citvon\Citvon.exe Process created: C:\Users\Public\Citvon\Citvon.exe C:\Users\Public\Citvon\Citvon.exe Jump to behavior
Source: explorer.exe, 0000001A.00000002.915848941.0000000000AD8000.00000004.00000020.sdmp Binary or memory string: ProgmanMD6

Language, Device and Operating System Detection:

barindex
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows \System32\Netplwiz.exe Code function: HeapSetInformation,memset,LoadCursorW,GetStockObject,RegisterClassW,GetUserDefaultUILanguage,GetLocaleInfoW,CreateWindowExW,GetLastError,CreateWindowExW,UsersRunDllW,DestroyWindow, 8_2_00007FF61AD32A90
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows \System32\Netplwiz.exe Code function: 8_2_613C1AE0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 8_2_613C1AE0
Source: C:\Users\Public\Citvon\Citvon.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 0000001D.00000002.916527302.0000000001270000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.826581239.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.866605894.0000000000580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.826744888.00000000004B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.867119537.0000000000310000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000001.696290346.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000001.815038206.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.697862956.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.867284740.00000000008D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.915615898.0000000000E50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.865473652.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.827144868.00000000005C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000001.796805895.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.916659708.00000000012A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 3.1.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.Citvon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.2.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.1.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.2.Citvon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.1.Citvon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.1.Citvon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.1.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 0000001D.00000002.916527302.0000000001270000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.826581239.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.866605894.0000000000580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.826744888.00000000004B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.867119537.0000000000310000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000001.696290346.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000001.815038206.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.697862956.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.867284740.00000000008D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.915615898.0000000000E50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.865473652.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.827144868.00000000005C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000001.796805895.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.916659708.00000000012A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 3.1.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.Citvon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.2.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.Citvonvhciktufwvyzyhistnewdjgsoqdr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.1.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.2.Citvon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.1.Citvon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.1.Citvon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.1.Citvon.exe.400000.0.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 411769 Sample: Citvonvhciktufwvyzyhistnewd... Startdate: 12/05/2021 Architecture: WINDOWS Score: 100 72 www.rest-blog.com 2->72 94 Found malware configuration 2->94 96 Malicious sample detected (through community Yara rule) 2->96 98 Multi AV Scanner detection for dropped file 2->98 100 5 other signatures 2->100 12 Citvon.exe 16 2->12         started        16 Citvonvhciktufwvyzyhistnewdjgsoqdr.exe 1 25 2->16         started        19 Citvon.exe 16 2->19         started        signatures3 process4 dnsIp5 74 xhtfga.dm.files.1drv.com 12->74 82 2 other IPs or domains 12->82 122 Multi AV Scanner detection for dropped file 12->122 124 Detected unpacking (changes PE section rights) 12->124 126 Machine Learning detection for dropped file 12->126 21 Citvon.exe 12->21         started        76 192.168.2.1 unknown unknown 16->76 78 xhtfga.dm.files.1drv.com 16->78 84 2 other IPs or domains 16->84 62 C:\Users\Public62etplwiz.exe, PE32+ 16->62 dropped 64 C:\Users\Public64ETUTILS.dll, PE32+ 16->64 dropped 66 C:\Users\Public\Citvon\Citvon.exe, PE32 16->66 dropped 128 Drops PE files to the user root directory 16->128 130 Tries to detect virtualization through RDTSC time measurements 16->130 132 Injects a PE file into a foreign processes 16->132 24 cmd.exe 1 16->24         started        26 Citvonvhciktufwvyzyhistnewdjgsoqdr.exe 16->26         started        80 xhtfga.dm.files.1drv.com 19->80 86 2 other IPs or domains 19->86 28 Citvon.exe 19->28         started        file6 signatures7 process8 signatures9 106 Modifies the context of a thread in another process (thread injection) 21->106 108 Maps a DLL or memory area into another process 21->108 110 Sample uses process hollowing technique 21->110 112 Queues an APC in another process (thread injection) 21->112 30 explorer.exe 21->30 injected 34 cmd.exe 5 24->34         started        37 conhost.exe 24->37         started        process10 dnsIp11 88 www.georgeswebwerks.com 30->88 90 www.thrg33.club 30->90 92 parkingpage.namecheap.com 198.54.117.212, 49779, 80 NAMECHEAP-NETUS United States 30->92 134 System process connects to network (likely due to code injection or exploit) 30->134 39 WWAHost.exe 30->39         started        42 msiexec.exe 30->42         started        44 autoconv.exe 30->44         started        46 autofmt.exe 30->46         started        68 C:\Windows \System3268etplwiz.exe, PE32+ 34->68 dropped 70 C:\Windows \System3270ETUTILS.dll, PE32+ 34->70 dropped 136 Drops executables to the windows directory (C:\Windows) and starts them 34->136 48 Netplwiz.exe 34->48         started        50 conhost.exe 34->50         started        file12 signatures13 process14 signatures15 114 Modifies the context of a thread in another process (thread injection) 39->114 116 Maps a DLL or memory area into another process 39->116 118 Tries to detect virtualization through RDTSC time measurements 39->118 52 cmd.exe 1 48->52         started        process16 signatures17 102 Suspicious powershell command line found 52->102 104 Adds a directory exclusion to Windows Defender 52->104 55 powershell.exe 27 52->55         started        58 conhost.exe 52->58         started        process18 signatures19 120 DLL side loading technique detected 55->120 60 conhost.exe 55->60         started        process20
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
198.54.117.212
 parkingpage.namecheap.com United States
22612 NAMECHEAP-NETUS false

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
www.rest-blog.com 118.27.99.91 true
parkingpage.namecheap.com 198.54.117.212 true
www.thrg33.club unknown unknown
www.georgeswebwerks.com unknown unknown
onedrive.live.com unknown unknown
xhtfga.dm.files.1drv.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.clinics.life/qku9/ true
  • Avira URL Cloud: safe
 low