Play interactive tour

Edit tour

Analysis Report 350969bc_by_Libranalysis

Overview

General Information

Sample Name:	350969bc_by_Libranalysis (renamed file extension from none to exe)
Analysis ID:	412308
MD5:	350969bc82ec33af12acf100c41eb4d1
SHA1:	f17d5fc8bad55cc2b523173b43585e9edb9154e4
SHA256:	961ac1d96eb469d4a949c18c25de7bf7d3ad79a502794b470a3505fa8b65d023
Tags:	Formbook
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected AntiVM3

Yara detected FormBook

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Antivirus or Machine Learning detection for unpacked file

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

350969bc_by_Libranalysis.exe (PID: 6988 cmdline: 'C:\Users\user\Desktop\350969bc_by_Libranalysis.exe' MD5: 350969BC82EC33AF12ACF100C41EB4D1)

350969bc_by_Libranalysis.exe (PID: 7100 cmdline: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe MD5: 350969BC82EC33AF12ACF100C41EB4D1)

350969bc_by_Libranalysis.exe (PID: 7140 cmdline: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe MD5: 350969BC82EC33AF12ACF100C41EB4D1)

350969bc_by_Libranalysis.exe (PID: 3416 cmdline: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe MD5: 350969BC82EC33AF12ACF100C41EB4D1)

explorer.exe (PID: 3424 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)

control.exe (PID: 6576 cmdline: C:\Windows\SysWOW64\control.exe MD5: 40FBA3FBFD5E33E0DE1BA45472FDA66F)

cmd.exe (PID: 6260 cmdline: /c del 'C:\Users\user\Desktop\350969bc_by_Libranalysis.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 7160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.sabaidiving.com/i6rd/"], "decoy": ["blissfulbeeboutique.online", "syazanisuhaimi.com", "designaliveeuk.com", "andradeasfora.com", "barnesandn.com", "onlinecasinocrazy.com", "cornerstonemedwa.com", "fijiherald.com", "experienciaswagon.com", "cityofhouston.info", "thebenefitssherpa.com", "honeyew.com", "sliceinvestors.com", "socialeconomic.net", "ballisticjet.com", "fortuneland.fund", "globaleranking.com", "gracestationchurch.com", "mixigo.net", "ximibabes.com", "morooka.club", "kittycarehotel.com", "solartenacres.com", "bunies3.com", "celery.store", "grayboxus.com", "haopianba.com", "021rencai.net", "cortinasenrollablesloscabos.com", "qiaosouwenku.com", "856379607.xyz", "urgentdocservices.com", "countrywideeconomy.com", "onemoresysadmin.com", "salemerket.com", "susiebennett.com", "comedyforyou.com", "satssar.com", "woo.education", "shellgang.com", "wattaccounting.com", "mandapeoplesyatem.com", "cavaliertrimmershop.com", "netfx-service.com", "s138s9.com", "smoothome.com", "cabinhealthy.com", "sexyvenushuegel.net", "jsvending.info", "gej2holdings.com", "arcticluxuryvillas.com", "shinsotoknives.com", "mardigrasdecorators.com", "ainongshucai.com", "ricdevan.com", "boringcode.net", "thebotanicaltype.com", "jewelonsale.com", "sunstatepipelines.com", "jasontaylor.online", "clipsquote.com", "toypoodlebreedershome.com", "thearcadelounge.com", "unico-m.online"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.916735490.0000000000540000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000A.00000002.916735490.0000000000540000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000A.00000002.916735490.0000000000540000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.715972789.0000000001090000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.715972789.0000000001090000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.715972789.0000000001090000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.715159107.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.715159107.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.715159107.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.715784952.0000000000F30000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.715784952.0000000000F30000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.715784952.0000000000F30000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
0000000A.00000002.917116074.00000000027A0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000A.00000002.917116074.00000000027A0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000A.00000002.917116074.00000000027A0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.664412012.0000000004449000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.664412012.0000000004449000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x118428:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x1187c2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13f648:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13f9e2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x1244d5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14b6f5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x123fc1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14b1e1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x1245d7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b7f7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x12474f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x14b96f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x1191da:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1403fa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x12323c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x14a45c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x119f52:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x141172:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1295c7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1507e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x12a66a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.664412012.0000000004449000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1264f9:$sqlite3step: 68 34 1C 7B E1 0x12660c:$sqlite3step: 68 34 1C 7B E1 0x14d719:$sqlite3step: 68 34 1C 7B E1 0x14d82c:$sqlite3step: 68 34 1C 7B E1 0x126528:$sqlite3text: 68 38 2A 90 C5 0x12664d:$sqlite3text: 68 38 2A 90 C5 0x14d748:$sqlite3text: 68 38 2A 90 C5 0x14d86d:$sqlite3text: 68 38 2A 90 C5 0x12653b:$sqlite3blob: 68 53 D8 7F 8C 0x126663:$sqlite3blob: 68 53 D8 7F 8C 0x14d75b:$sqlite3blob: 68 53 D8 7F 8C 0x14d883:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: 350969bc_by_Libranalysis.exe PID: 6988	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.350969bc_by_Libranalysis.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
5.2.350969bc_by_Libranalysis.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
5.2.350969bc_by_Libranalysis.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
5.2.350969bc_by_Libranalysis.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
5.2.350969bc_by_Libranalysis.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13895:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13381:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13997:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13b0f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x859a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9312:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
5.2.350969bc_by_Libranalysis.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158b9:$sqlite3step: 68 34 1C 7B E1 0x159cc:$sqlite3step: 68 34 1C 7B E1 0x158e8:$sqlite3text: 68 38 2A 90 C5 0x15a0d:$sqlite3text: 68 38 2A 90 C5 0x158fb:$sqlite3blob: 68 53 D8 7F 8C 0x15a23:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000005.00000002.715972789.0000000001090000.00000040.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.sabaidiving.com/i6rd/"], "decoy": ["blissfulbeeboutique.online", "syazanisuhaimi.com", "designaliveeuk.com", "andradeasfora.com", "barnesandn.com", "onlinecasinocrazy.com", "cornerstonemedwa.com", "fijiherald.com", "experienciaswagon.com", "cityofhouston.info", "thebenefitssherpa.com", "honeyew.com", "sliceinvestors.com", "socialeconomic.net", "ballisticjet.com", "fortuneland.fund", "globaleranking.com", "gracestationchurch.com", "mixigo.net", "ximibabes.com", "morooka.club", "kittycarehotel.com", "solartenacres.com", "bunies3.com", "celery.store", "grayboxus.com", "haopianba.com", "021rencai.net", "cortinasenrollablesloscabos.com", "qiaosouwenku.com", "856379607.xyz", "urgentdocservices.com", "countrywideeconomy.com", "onemoresysadmin.com", "salemerket.com", "susiebennett.com", "comedyforyou.com", "satssar.com", "woo.education", "shellgang.com", "wattaccounting.com", "mandapeoplesyatem.com", "cavaliertrimmershop.com", "netfx-service.com", "s138s9.com", "smoothome.com", "cabinhealthy.com", "sexyvenushuegel.net", "jsvending.info", "gej2holdings.com", "arcticluxuryvillas.com", "shinsotoknives.com", "mardigrasdecorators.com", "ainongshucai.com", "ricdevan.com", "boringcode.net", "thebotanicaltype.com", "jewelonsale.com", "sunstatepipelines.com", "jasontaylor.online", "clipsquote.com", "toypoodlebreedershome.com", "thearcadelounge.com", "unico-m.online"]}

Multi AV Scanner detection for submitted file

Show sources

Source: 350969bc_by_Libranalysis.exe

ReversingLabs: Detection: 36%

Yara detected FormBook

Show sources

Source: Yara match	File source: 0000000A.00000002.916735490.0000000000540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.715972789.0000000001090000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.715159107.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.715784952.0000000000F30000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.917116074.00000000027A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.664412012.0000000004449000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.350969bc_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.350969bc_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Show sources

Source: 350969bc_by_Libranalysis.exe

Joe Sandbox ML: detected

Source: 5.2.350969bc_by_Libranalysis.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Source: 350969bc_by_Libranalysis.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 350969bc_by_Libranalysis.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000006.00000002.927845340.0000000005A00000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: 350969bc_by_Libranalysis.exe, 00000005.00000002.716595208.000000000150F000.00000040.00000001.sdmp, control.exe, 0000000A.00000002.917676235.0000000004710000.00000040.00000001.sdmp
Source:	Binary string: control.pdb source: 350969bc_by_Libranalysis.exe, 00000005.00000002.716167439.000000000114A000.00000004.00000020.sdmp
Source:	Binary string: wntdll.pdb source: 350969bc_by_Libranalysis.exe, control.exe
Source:	Binary string: control.pdbUGP source: 350969bc_by_Libranalysis.exe, 00000005.00000002.716167439.000000000114A000.00000004.00000020.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000006.00000002.927845340.0000000005A00000.00000002.00000001.sdmp

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49752 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49752 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49752 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49764 -> 103.15.186.68:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49764 -> 103.15.186.68:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49764 -> 103.15.186.68:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49770 -> 23.227.38.74:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49770 -> 23.227.38.74:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49770 -> 23.227.38.74:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49771 -> 192.64.147.164:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49771 -> 192.64.147.164:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49771 -> 192.64.147.164:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.sabaidiving.com/i6rd/

Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=LPK2IT8klZq3HV5LkVv0HrUERmrfkAigbODxoDO8ybIsb03GvAFTkZSuj3fGszWvHktP&9rJ=N8YdlZih HTTP/1.1Host: www.thebenefitssherpa.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=erkeaSWQY+Clkg2r/Pi/REnUuZTidSmaWK+TmjN6ZRgeJAvAzvFr0iNL5kMJBQzOKWdi&9rJ=N8YdlZih HTTP/1.1Host: www.onlinecasinocrazy.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=smN73hIgGm+8k6TIdjzBFwruzJIggaSM7b/fO07bhI8vXH2xBAb/Cwk8Hoq4ZaNv9SU/&9rJ=N8YdlZih HTTP/1.1Host: www.blissfulbeeboutique.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=OPhbRlTkoXrsQ0r3dKw1IvWRRcBcb3Q4dmj86tcXQUJSZPkW56a8j7HjPVLeeIGxTFMj&9rJ=N8YdlZih HTTP/1.1Host: www.cityofhouston.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=ghT/ntM+diyN3YW/4q0tO05CJd4dCe68Gx0VtJcOz7kJ2fBcIsU6AMgtishNfwDLzL+S&9rJ=N8YdlZih HTTP/1.1Host: www.socialeconomic.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=87tzyM19Su4M9sklYGX+FxwUh158b1qmSh9f/APlSoINpVQ2gCQ5Erv1vAVp92mNDUWx&9rJ=N8YdlZih HTTP/1.1Host: www.toypoodlebreedershome.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=lFTIMkQ5ik6igxl0SADoA/l4wqgGqwWePHw2ryfpEDmwfQ+0wMbe0XdxLJthRM6xta9b&9rJ=N8YdlZih HTTP/1.1Host: www.ricdevan.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=/0C7Nd/5ZhwBGDRTMer0ywO01wFnuraj4upl6M1zLF0nwnsKqCnReLNuI6TuwxtThkOZ&9rJ=N8YdlZih HTTP/1.1Host: www.ximibabes.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=kbJM45GZrQKbh6aR4KV/wVFZMmwDJvkUUs1obqo0rCdmSsWUtmFh0yx89FvYawyrRJzX&9rJ=N8YdlZih HTTP/1.1Host: www.sabaidiving.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=wbIaUdvQqzQbHKzWrifpae4yz+HPBnPf3VQSw8NlhdhOO9H/uFvMKdwnlncPTgk9QTjs&9rJ=N8YdlZih HTTP/1.1Host: www.onemoresysadmin.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=HOLe4E5VAs/9VGl0AghSjQ5UDYBgOj/qhjKLxJJROTaYJ7IE9VG9ZYc05xBD+gnk3HpC&9rJ=N8YdlZih HTTP/1.1Host: www.countrywideeconomy.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 52.58.78.16 52.58.78.16

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: VOODOO1US VOODOO1US
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=LPK2IT8klZq3HV5LkVv0HrUERmrfkAigbODxoDO8ybIsb03GvAFTkZSuj3fGszWvHktP&9rJ=N8YdlZih HTTP/1.1Host: www.thebenefitssherpa.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=erkeaSWQY+Clkg2r/Pi/REnUuZTidSmaWK+TmjN6ZRgeJAvAzvFr0iNL5kMJBQzOKWdi&9rJ=N8YdlZih HTTP/1.1Host: www.onlinecasinocrazy.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=smN73hIgGm+8k6TIdjzBFwruzJIggaSM7b/fO07bhI8vXH2xBAb/Cwk8Hoq4ZaNv9SU/&9rJ=N8YdlZih HTTP/1.1Host: www.blissfulbeeboutique.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=OPhbRlTkoXrsQ0r3dKw1IvWRRcBcb3Q4dmj86tcXQUJSZPkW56a8j7HjPVLeeIGxTFMj&9rJ=N8YdlZih HTTP/1.1Host: www.cityofhouston.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=ghT/ntM+diyN3YW/4q0tO05CJd4dCe68Gx0VtJcOz7kJ2fBcIsU6AMgtishNfwDLzL+S&9rJ=N8YdlZih HTTP/1.1Host: www.socialeconomic.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=87tzyM19Su4M9sklYGX+FxwUh158b1qmSh9f/APlSoINpVQ2gCQ5Erv1vAVp92mNDUWx&9rJ=N8YdlZih HTTP/1.1Host: www.toypoodlebreedershome.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=lFTIMkQ5ik6igxl0SADoA/l4wqgGqwWePHw2ryfpEDmwfQ+0wMbe0XdxLJthRM6xta9b&9rJ=N8YdlZih HTTP/1.1Host: www.ricdevan.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=/0C7Nd/5ZhwBGDRTMer0ywO01wFnuraj4upl6M1zLF0nwnsKqCnReLNuI6TuwxtThkOZ&9rJ=N8YdlZih HTTP/1.1Host: www.ximibabes.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=kbJM45GZrQKbh6aR4KV/wVFZMmwDJvkUUs1obqo0rCdmSsWUtmFh0yx89FvYawyrRJzX&9rJ=N8YdlZih HTTP/1.1Host: www.sabaidiving.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=wbIaUdvQqzQbHKzWrifpae4yz+HPBnPf3VQSw8NlhdhOO9H/uFvMKdwnlncPTgk9QTjs&9rJ=N8YdlZih HTTP/1.1Host: www.onemoresysadmin.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /i6rd/?gHSLCj58=HOLe4E5VAs/9VGl0AghSjQ5UDYBgOj/qhjKLxJJROTaYJ7IE9VG9ZYc05xBD+gnk3HpC&9rJ=N8YdlZih HTTP/1.1Host: www.countrywideeconomy.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown

DNS traffic detected: queries for: www.thebenefitssherpa.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0Date: Wed, 12 May 2021 13:48:08 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 387Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 63 69 74 79 6f 66 68 6f 75 73 74 6f 6e 2e 69 6e 66 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache Server at www.cityofhouston.info Port 80</address></body></html>

Source: 350969bc_by_Libranalysis.exe	String found in binary or memory: Http://google.com.br
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662905887.0000000003441000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 00000006.00000000.666349326.0000000002B50000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: control.exe, 0000000A.00000002.918833437.0000000004DC2000.00000004.00000001.sdmp	String found in binary or memory: http://www.countrywideeconomy.com
Source: control.exe, 0000000A.00000002.918833437.0000000004DC2000.00000004.00000001.sdmp	String found in binary or memory: http://www.countrywideeconomy.com/
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: control.exe, 0000000A.00000002.918833437.0000000004DC2000.00000004.00000001.sdmp	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 0000000A.00000002.916735490.0000000000540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.715972789.0000000001090000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.715159107.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.715784952.0000000000F30000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.917116074.00000000027A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.664412012.0000000004449000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.350969bc_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.350969bc_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 0000000A.00000002.916735490.0000000000540000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.916735490.0000000000540000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.715972789.0000000001090000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.715972789.0000000001090000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.715159107.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.715159107.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.715784952.0000000000F30000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.715784952.0000000000F30000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.917116074.00000000027A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.917116074.00000000027A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.664412012.0000000004449000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.664412012.0000000004449000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.350969bc_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.350969bc_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.350969bc_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.350969bc_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_004181C0 NtCreateFile,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_00418270 NtReadFile,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_004182F0 NtClose,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_004183A0 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_004181BA NtCreateFile,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0041839A NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459540 NtReadFile,LdrInitializeThunk,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459910 NtAdjustPrivilegesToken,LdrInitializeThunk,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014595D0 NtClose,LdrInitializeThunk,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014599A0 NtCreateSection,LdrInitializeThunk,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459840 NtDelayExecution,LdrInitializeThunk,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459860 NtQuerySystemInformation,LdrInitializeThunk,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014598F0 NtReadVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459710 NtQueryInformationToken,LdrInitializeThunk,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459FE0 NtCreateMutant,LdrInitializeThunk,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459780 NtMapViewOfSection,LdrInitializeThunk,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014597A0 NtUnmapViewOfSection,LdrInitializeThunk,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459A50 NtCreateFile,LdrInitializeThunk,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459660 NtAllocateVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459A00 NtProtectVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459A20 NtResumeThread,LdrInitializeThunk,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014596E0 NtFreeVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459950 NtQueueApcThread,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459560 NtWriteFile,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459520 NtWaitForSingleObject,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0145AD30 NtSetContextThread,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014599D0 NtCreateProcessEx,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014595F0 NtQueryInformationFile,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0145B040 NtSuspendThread,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459820 NtEnumerateKey,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014598A0 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459760 NtOpenProcess,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459770 NtSetInformationFile,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0145A770 NtOpenThread,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459B00 NtSetValueKey,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0145A710 NtOpenProcessToken,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459730 NtQueryVirtualMemory,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0145A3B0 NtGetContextThread,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459650 NtQueryValueKey,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459670 NtQueryInformationProcess,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459610 NtEnumerateValueKey,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459A10 NtQuerySection,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014596D0 NtCreateKey,
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01459A80 NtOpenDirectoryObject,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779860 NtQuerySystemInformation,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779840 NtDelayExecution,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779540 NtReadFile,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779910 NtAdjustPrivilegesToken,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047795D0 NtClose,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047799A0 NtCreateSection,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779660 NtAllocateVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779A50 NtCreateFile,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779650 NtQueryValueKey,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047796E0 NtFreeVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047796D0 NtCreateKey,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779710 NtQueryInformationToken,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779FE0 NtCreateMutant,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779780 NtMapViewOfSection,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0477B040 NtSuspendThread,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779820 NtEnumerateKey,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047798F0 NtReadVirtualMemory,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047798A0 NtWriteVirtualMemory,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779560 NtWriteFile,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779950 NtQueueApcThread,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0477AD30 NtSetContextThread,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779520 NtWaitForSingleObject,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047795F0 NtQueryInformationFile,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047799D0 NtCreateProcessEx,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779670 NtQueryInformationProcess,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779A20 NtResumeThread,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779610 NtEnumerateValueKey,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779A10 NtQuerySection,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779A00 NtProtectVirtualMemory,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779A80 NtOpenDirectoryObject,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779770 NtSetInformationFile,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0477A770 NtOpenThread,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779760 NtOpenProcess,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779730 NtQueryVirtualMemory,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0477A710 NtOpenProcessToken,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04779B00 NtSetValueKey,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0477A3B0 NtGetContextThread,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047797A0 NtUnmapViewOfSection,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_027B8270 NtReadFile,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_027B82F0 NtClose,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_027B83A0 NtAllocateVirtualMemory,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_027B81C0 NtCreateFile,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_027B839A NtAllocateVirtualMemory,
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_027B81BA NtCreateFile,

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 0_2_0186D4E1
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 0_2_0186C2B0
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 0_2_01869990
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 0_2_0186FCB0
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 0_2_0186FCC0
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0041C07D
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_00401030
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0041B93A
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0041BB23
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_00408C60
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0041C576
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0041B52F
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_00402D87
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_00402D90
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0041B77D
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_00402FB0
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E1D55
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0141F900
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E2D07
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01410D20
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01434120
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0142D5E0
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01442581
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014D1002
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0142841F
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0142B090
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014420A0
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E20A8
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E2B28
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E1FF1
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144EBB0
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01436E30
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E2EF7
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E22AE
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_048020A8
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0474841F
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047F1002
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047620A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0474B090
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04730D20
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04754120
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_048025DD
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0473F900
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04802D07
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0474D5E0
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04801D55
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04762581
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_048022AE
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04756E30
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04802EF7
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04801FF1
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04802B28
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047FDBD2
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476EBB0
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_027BB93B
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_027A2FB0
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_027A8C60
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_027BC576
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_027BB52F
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_027A2D90
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_027A2D87

Source: C:\Windows\SysWOW64\control.exe	Code function: String function: 0473B150 appears 35 times
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: String function: 0141B150 appears 35 times

Source: 350969bc_by_Libranalysis.exe	Binary or memory string: OriginalFilename vs 350969bc_by_Libranalysis.exe
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.669296365.0000000006830000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll@ vs 350969bc_by_Libranalysis.exe
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662905887.0000000003441000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSimpleUI.dll( vs 350969bc_by_Libranalysis.exe
Source: 350969bc_by_Libranalysis.exe	Binary or memory string: OriginalFilename vs 350969bc_by_Libranalysis.exe
Source: 350969bc_by_Libranalysis.exe	Binary or memory string: OriginalFilename vs 350969bc_by_Libranalysis.exe
Source: 350969bc_by_Libranalysis.exe	Binary or memory string: OriginalFilename vs 350969bc_by_Libranalysis.exe
Source: 350969bc_by_Libranalysis.exe, 00000005.00000002.716595208.000000000150F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 350969bc_by_Libranalysis.exe
Source: 350969bc_by_Libranalysis.exe, 00000005.00000002.716202775.0000000001171000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameCONTROL.EXEj% vs 350969bc_by_Libranalysis.exe
Source: 350969bc_by_Libranalysis.exe	Binary or memory string: OriginalFilenameTextInfo.exe8 vs 350969bc_by_Libranalysis.exe

Source: 350969bc_by_Libranalysis.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 0000000A.00000002.916735490.0000000000540000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.916735490.0000000000540000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.715972789.0000000001090000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.715972789.0000000001090000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.715159107.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.715159107.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.715784952.0000000000F30000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.715784952.0000000000F30000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.917116074.00000000027A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.917116074.00000000027A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.664412012.0000000004449000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.664412012.0000000004449000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.350969bc_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.350969bc_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.350969bc_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.350969bc_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: 350969bc_by_Libranalysis.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@11/1@12/12

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\350969bc_by_Libranalysis.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7160:120:WilError_01

Source: 350969bc_by_Libranalysis.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: 350969bc_by_Libranalysis.exe

ReversingLabs: Detection: 36%

Source: 350969bc_by_Libranalysis.exe

String found in binary or memory: &Report-HelpToolStripMenuItem1

Source: unknown	Process created: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe 'C:\Users\user\Desktop\350969bc_by_Libranalysis.exe'
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process created: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe C:\Users\user\Desktop\350969bc_by_Libranalysis.exe
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process created: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe C:\Users\user\Desktop\350969bc_by_Libranalysis.exe
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process created: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe C:\Users\user\Desktop\350969bc_by_Libranalysis.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\control.exe C:\Windows\SysWOW64\control.exe
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\350969bc_by_Libranalysis.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process created: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe C:\Users\user\Desktop\350969bc_by_Libranalysis.exe
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process created: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe C:\Users\user\Desktop\350969bc_by_Libranalysis.exe
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process created: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe C:\Users\user\Desktop\350969bc_by_Libranalysis.exe
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\350969bc_by_Libranalysis.exe'

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: 350969bc_by_Libranalysis.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 350969bc_by_Libranalysis.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: 350969bc_by_Libranalysis.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000006.00000002.927845340.0000000005A00000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: 350969bc_by_Libranalysis.exe, 00000005.00000002.716595208.000000000150F000.00000040.00000001.sdmp, control.exe, 0000000A.00000002.917676235.0000000004710000.00000040.00000001.sdmp
Source:	Binary string: control.pdb source: 350969bc_by_Libranalysis.exe, 00000005.00000002.716167439.000000000114A000.00000004.00000020.sdmp
Source:	Binary string: wntdll.pdb source: 350969bc_by_Libranalysis.exe, control.exe
Source:	Binary string: control.pdbUGP source: 350969bc_by_Libranalysis.exe, 00000005.00000002.716167439.000000000114A000.00000004.00000020.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000006.00000002.927845340.0000000005A00000.00000002.00000001.sdmp

Source: 350969bc_by_Libranalysis.exe

Static PE information: 0x909C21C3 [Sun Nov 18 10:56:03 2046 UTC]

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_00410109 push ss; iretd
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_004062F9 push ebx; ret
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0041B3B5 push eax; ret
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0041B46C push eax; ret
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0041B402 push eax; ret
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0041B40B push eax; ret
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_00406D23 push esi; ret
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0146D0D1 push ecx; ret
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0478D0D1 push ecx; ret
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_027A62F9 push ebx; ret
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_027BB3B5 push eax; ret
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_027B0109 push ss; iretd
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_027BB46C push eax; ret
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_027BB40B push eax; ret
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_027BB402 push eax; ret
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_027A6D23 push esi; ret

Source: initial sample

Static PE information: section name: .text entropy: 7.87688083082

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 350969bc_by_Libranalysis.exe PID: 6988, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	RDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\control.exe	RDTSC instruction interceptor: First address: 00000000027A85E4 second address: 00000000027A85EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\control.exe	RDTSC instruction interceptor: First address: 00000000027A897E second address: 00000000027A8984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe

Code function: 5_2_004088B0 rdtsc

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe TID: 6992	Thread sleep time: -100804s >= -30000s
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe TID: 7016	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\explorer.exe TID: 2928	Thread sleep time: -50000s >= -30000s
Source: C:\Windows\SysWOW64\control.exe TID: 1744	Thread sleep time: -48000s >= -30000s

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\control.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\control.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Thread delayed: delay time: 100804
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Thread delayed: delay time: 922337203685477

Source: explorer.exe, 00000006.00000000.678102715.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000006.00000000.683720257.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000006.00000000.678766847.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.689009704.000000000FD01000.00000004.00000001.sdmp	Binary or memory string: 53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&v
Source: explorer.exe, 00000006.00000000.683720257.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: explorer.exe, 00000006.00000000.683873602.000000000A716000.00000004.00000001.sdmp	Binary or memory string: War&Prod_VMware_SATAa
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000006.00000000.675670351.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000006.00000000.678102715.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000006.00000000.683873602.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000006.00000000.678102715.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: explorer.exe, 00000006.00000000.683937578.000000000A784000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: 350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 00000006.00000000.678102715.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\control.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe

Code function: 5_2_004088B0 rdtsc

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe

Code function: 5_2_00409B20 LdrLoadDll,

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01453D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0143B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0143B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01493540 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01437D50 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0141C962 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0141B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0141B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0143C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0143C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01419100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01419100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01419100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01434120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01434120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01434120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01434120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01434120 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0141AD30 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01423D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01423D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01423D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01423D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01423D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01423D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01423D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01423D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01423D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01423D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01423D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01423D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01423D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E8D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144513A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144513A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0149A537 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01444D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01444D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01444D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01496DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01496DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01496DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01496DC9 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01496DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01496DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0141B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0141B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0141B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014A41E8 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0142D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0142D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014C8DF1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144A185 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0143C182 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01442581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01442581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01442581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01442581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01412D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01412D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01412D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01412D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01412D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01442990 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E05AC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E05AC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014461A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014461A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014435A1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014969A6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01441DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01441DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01441DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014951BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014951BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014951BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014951BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144A44B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01430050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01430050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014AC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014AC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0143746D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E1074 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014D2073 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01496C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01496C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01496C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01496C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014D1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E4015 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E4015 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01497016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01497016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01497016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0142B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0142B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0142B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0142B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144BC2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E8CD6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014AB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014AB8D0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014AB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014AB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014AB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014AB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014158EC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014D14FB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01496CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01496CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01496CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01419080 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01493884 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01493884 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0142849B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014420A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014420A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014420A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014420A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014420A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014420A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014590AF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144F0BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0141DB40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0142EF40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E8B58 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0141F358 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0141DB60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0142FF60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E8F6A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01443B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01443B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E070D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E070D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0143F716 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014D131B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014AFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014AFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01414F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01414F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144E730 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014953CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014953CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014403E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014403E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014403E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014403E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014403E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014403E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0143DBE9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014537F5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014D138A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014CD380 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01421B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01421B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01442397 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144B390 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01428794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01497794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01497794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01497794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01444BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01444BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01444BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E5BA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01419240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01419240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01419240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01419240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01427E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01427E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01427E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01427E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01427E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01427E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014A4257 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014CB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014CB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E8A62 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0142766D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0143AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0143AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0143AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0143AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0143AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0145927A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0141C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0141C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0141C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01448E00 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014D1608 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01428A0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01415210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01415210 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01415210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01415210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0141AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0141AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01433A1C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0141E620 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01454A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01454A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014CFE3F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01458EC7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014436CC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014CFEC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01442ACB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E8ED6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014276E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_01442AE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014416E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014AFE87 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014152A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014152A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014152A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014152A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014152A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014E0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_014946A7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0142AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0142AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Code function: 5_2_0144FAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047F2073 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0475746D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04750050 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04750050 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047CC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047CC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476A44B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04808CD6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476BC2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0474B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0474B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0474B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0474B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047F14FB mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0480740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0480740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0480740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04804015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04804015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047358EC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047CB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047CB8D0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047CB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047CB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047CB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047CB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476F0BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047620A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047620A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047620A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047620A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047620A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047620A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047790AF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0474849B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04739080 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04801074 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B3884 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B3884 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0473B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0473B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0475C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0475C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0473C962 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04757D50 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_048005AC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_048005AC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0475B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0475B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04773D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B3540 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0473AD30 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047FE539 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476513A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476513A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047BA537 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04764D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04764D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04764D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04754120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04754120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04754120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04754120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04754120 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04739100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04739100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04739100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047E8DF1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0473B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0473B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0473B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047C41E8 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0474D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0474D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047FFDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047FFDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047FFDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047FFDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B6DC9 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04808D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04761DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04761DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04761DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047661A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047661A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047635A1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B69A6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04762990 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476A185 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0475C182 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04762581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04762581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04762581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04762581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04732D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04732D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04732D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04732D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04732D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0475AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0475AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0475AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0475AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0475AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0477927A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0474766D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047EB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047EB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04800EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04800EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04800EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047FEA55 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047C4257 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04739240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04739240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04739240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04739240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04747E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04747E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04747E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04747E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04747E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04747E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047FAE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047FAE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047EFE3F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0473E620 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04808ED6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04774A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04774A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04735210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04735210 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04735210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04735210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0473AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0473AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04753A1C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0473C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0473C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0473C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04768E00 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047F1608 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04748A0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04762AE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047616E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047476E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04778EC7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047636CC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04762ACB mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047EFEC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0474AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0474AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476FAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047352A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047352A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047352A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047352A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047352A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047B46A7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04808A62 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047CFE87 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04763B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04763B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0473DB60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0474FF60 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04805BA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0473F358 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0473DB40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0474EF40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476E730 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04734F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_04734F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0475F716 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047F131B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047CFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047CFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0476A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047737F5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0480070D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_0480070D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047603E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047603E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047603E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\control.exe	Code function: 10_2_047603E2 mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\control.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Network Connect: 52.58.78.16 80
Source: C:\Windows\explorer.exe	Domain query: www.socialeconomic.net
Source: C:\Windows\explorer.exe	Domain query: www.onlinecasinocrazy.com
Source: C:\Windows\explorer.exe	Network Connect: 192.64.147.164 80
Source: C:\Windows\explorer.exe	Network Connect: 23.227.38.74 80
Source: C:\Windows\explorer.exe	Domain query: www.sabaidiving.com
Source: C:\Windows\explorer.exe	Domain query: www.cityofhouston.info
Source: C:\Windows\explorer.exe	Domain query: www.thebenefitssherpa.com
Source: C:\Windows\explorer.exe	Domain query: www.ximibabes.com
Source: C:\Windows\explorer.exe	Network Connect: 192.0.78.24 80
Source: C:\Windows\explorer.exe	Network Connect: 119.81.45.82 80
Source: C:\Windows\explorer.exe	Network Connect: 198.185.159.144 80
Source: C:\Windows\explorer.exe	Network Connect: 185.53.177.53 80
Source: C:\Windows\explorer.exe	Domain query: www.toypoodlebreedershome.com
Source: C:\Windows\explorer.exe	Network Connect: 103.15.186.68 80
Source: C:\Windows\explorer.exe	Domain query: www.onemoresysadmin.com
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80
Source: C:\Windows\explorer.exe	Network Connect: 81.88.52.88 80
Source: C:\Windows\explorer.exe	Network Connect: 51.222.80.112 80
Source: C:\Windows\explorer.exe	Domain query: www.ricdevan.com
Source: C:\Windows\explorer.exe	Domain query: www.countrywideeconomy.com
Source: C:\Windows\explorer.exe	Domain query: www.blissfulbeeboutique.online

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Section loaded: unknown target: C:\Windows\SysWOW64\control.exe protection: execute and read and write
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Section loaded: unknown target: C:\Windows\SysWOW64\control.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\control.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\control.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Thread register set: target process: 3424
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Thread register set: target process: 3424
Source: C:\Windows\SysWOW64\control.exe	Thread register set: target process: 3424

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe

Section unmapped: C:\Windows\SysWOW64\control.exe base address: 3C0000

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process created: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe C:\Users\user\Desktop\350969bc_by_Libranalysis.exe
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process created: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe C:\Users\user\Desktop\350969bc_by_Libranalysis.exe
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Process created: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe C:\Users\user\Desktop\350969bc_by_Libranalysis.exe
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\350969bc_by_Libranalysis.exe'

Source: explorer.exe, 00000006.00000002.916660686.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000006.00000000.665682379.0000000001080000.00000002.00000001.sdmp, control.exe, 0000000A.00000002.917227352.0000000002FB0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000006.00000000.665682379.0000000001080000.00000002.00000001.sdmp, control.exe, 0000000A.00000002.917227352.0000000002FB0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.665682379.0000000001080000.00000002.00000001.sdmp, control.exe, 0000000A.00000002.917227352.0000000002FB0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000006.00000000.665682379.0000000001080000.00000002.00000001.sdmp, control.exe, 0000000A.00000002.917227352.0000000002FB0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000006.00000000.683873602.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Queries volume information: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe VolumeInformation
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation

Source: C:\Users\user\Desktop\350969bc_by_Libranalysis.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 0000000A.00000002.916735490.0000000000540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.715972789.0000000001090000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.715159107.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.715784952.0000000000F30000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.917116074.00000000027A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.664412012.0000000004449000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.350969bc_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.350969bc_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 0000000A.00000002.916735490.0000000000540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.715972789.0000000001090000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.715159107.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.715784952.0000000000F30000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.917116074.00000000027A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.664412012.0000000004449000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.350969bc_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.350969bc_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter2	Path Interception	Process Injection512	Masquerading1	OS Credential Dumping	Security Software Discovery221	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Shared Modules1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion31	Security Account Manager	Virtualization/Sandbox Evasion31	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection512	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	System Information Discovery112	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information3	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing3	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Timestomp1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
350969bc_by_Libranalysis.exe	36%	ReversingLabs	Win32.Trojan.Wacatac
350969bc_by_Libranalysis.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
5.2.350969bc_by_Libranalysis.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

Source	Detection	Scanner	Link
cityofhouston.info	0%	Virustotal	Browse
onlinecasinocrazy.com	0%	Virustotal	Browse
onemoresysadmin.com	0%	Virustotal	Browse
www.sabaidiving.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://www.toypoodlebreedershome.com/i6rd/?gHSLCj58=87tzyM19Su4M9sklYGX+FxwUh158b1qmSh9f/APlSoINpVQ2gCQ5Erv1vAVp92mNDUWx&9rJ=N8YdlZih	0%	Avira URL Cloud	safe
http://www.ximibabes.com/i6rd/?gHSLCj58=/0C7Nd/5ZhwBGDRTMer0ywO01wFnuraj4upl6M1zLF0nwnsKqCnReLNuI6TuwxtThkOZ&9rJ=N8YdlZih	0%	Avira URL Cloud	safe
http://www.cityofhouston.info/i6rd/?gHSLCj58=OPhbRlTkoXrsQ0r3dKw1IvWRRcBcb3Q4dmj86tcXQUJSZPkW56a8j7HjPVLeeIGxTFMj&9rJ=N8YdlZih	0%	Avira URL Cloud	safe
http://www.socialeconomic.net/i6rd/?gHSLCj58=ghT/ntM+diyN3YW/4q0tO05CJd4dCe68Gx0VtJcOz7kJ2fBcIsU6AMgtishNfwDLzL+S&9rJ=N8YdlZih	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.sabaidiving.com/i6rd/?gHSLCj58=kbJM45GZrQKbh6aR4KV/wVFZMmwDJvkUUs1obqo0rCdmSsWUtmFh0yx89FvYawyrRJzX&9rJ=N8YdlZih	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.onemoresysadmin.com/i6rd/?gHSLCj58=wbIaUdvQqzQbHKzWrifpae4yz+HPBnPf3VQSw8NlhdhOO9H/uFvMKdwnlncPTgk9QTjs&9rJ=N8YdlZih	0%	Avira URL Cloud	safe
http://www.countrywideeconomy.com	0%	Avira URL Cloud	safe
http://www.onlinecasinocrazy.com/i6rd/?gHSLCj58=erkeaSWQY+Clkg2r/Pi/REnUuZTidSmaWK+TmjN6ZRgeJAvAzvFr0iNL5kMJBQzOKWdi&9rJ=N8YdlZih	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.thebenefitssherpa.com/i6rd/?gHSLCj58=LPK2IT8klZq3HV5LkVv0HrUERmrfkAigbODxoDO8ybIsb03GvAFTkZSuj3fGszWvHktP&9rJ=N8YdlZih	0%	Avira URL Cloud	safe
http://www.ricdevan.com/i6rd/?gHSLCj58=lFTIMkQ5ik6igxl0SADoA/l4wqgGqwWePHw2ryfpEDmwfQ+0wMbe0XdxLJthRM6xta9b&9rJ=N8YdlZih	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
www.sabaidiving.com/i6rd/	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.blissfulbeeboutique.online/i6rd/?gHSLCj58=smN73hIgGm+8k6TIdjzBFwruzJIggaSM7b/fO07bhI8vXH2xBAb/Cwk8Hoq4ZaNv9SU/&9rJ=N8YdlZih	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.countrywideeconomy.com/	0%	Avira URL Cloud	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.countrywideeconomy.com/i6rd/?gHSLCj58=HOLe4E5VAs/9VGl0AghSjQ5UDYBgOj/qhjKLxJJROTaYJ7IE9VG9ZYc05xBD+gnk3HpC&9rJ=N8YdlZih	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cityofhouston.info	103.15.186.68	true	true	0%, Virustotal, Browse	unknown
onlinecasinocrazy.com	119.81.45.82	true	true	0%, Virustotal, Browse	unknown
onemoresysadmin.com	192.0.78.24	true	true	0%, Virustotal, Browse	unknown
www.sabaidiving.com	192.64.147.164	true	true	0%, Virustotal, Browse	unknown
ext-sq.squarespace.com	198.185.159.144	true	false		high
toypoodlebreedershome.com	81.88.52.88	true	true		unknown
www.ricdevan.com	185.53.177.53	true	true		unknown
shops.myshopify.com	23.227.38.74	true	true		unknown
thebenefitssherpa.com	34.102.136.180	true	false		unknown
www.countrywideeconomy.com	52.58.78.16	true	true		unknown
socialeconomic.net	51.222.80.112	true	true		unknown
www.socialeconomic.net	unknown	unknown	true		unknown
www.onlinecasinocrazy.com	unknown	unknown	true		unknown
www.toypoodlebreedershome.com	unknown	unknown	true		unknown
www.onemoresysadmin.com	unknown	unknown	true		unknown
www.woo.education	unknown	unknown	true		unknown
www.cityofhouston.info	unknown	unknown	true		unknown
www.thebenefitssherpa.com	unknown	unknown	true		unknown
www.blissfulbeeboutique.online	unknown	unknown	true		unknown
www.ximibabes.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.toypoodlebreedershome.com/i6rd/?gHSLCj58=87tzyM19Su4M9sklYGX+FxwUh158b1qmSh9f/APlSoINpVQ2gCQ5Erv1vAVp92mNDUWx&9rJ=N8YdlZih	true	Avira URL Cloud: safe	unknown
http://www.ximibabes.com/i6rd/?gHSLCj58=/0C7Nd/5ZhwBGDRTMer0ywO01wFnuraj4upl6M1zLF0nwnsKqCnReLNuI6TuwxtThkOZ&9rJ=N8YdlZih	true	Avira URL Cloud: safe	unknown
http://www.cityofhouston.info/i6rd/?gHSLCj58=OPhbRlTkoXrsQ0r3dKw1IvWRRcBcb3Q4dmj86tcXQUJSZPkW56a8j7HjPVLeeIGxTFMj&9rJ=N8YdlZih	true	Avira URL Cloud: safe	unknown
http://www.socialeconomic.net/i6rd/?gHSLCj58=ghT/ntM+diyN3YW/4q0tO05CJd4dCe68Gx0VtJcOz7kJ2fBcIsU6AMgtishNfwDLzL+S&9rJ=N8YdlZih	true	Avira URL Cloud: safe	unknown
http://www.sabaidiving.com/i6rd/?gHSLCj58=kbJM45GZrQKbh6aR4KV/wVFZMmwDJvkUUs1obqo0rCdmSsWUtmFh0yx89FvYawyrRJzX&9rJ=N8YdlZih	true	Avira URL Cloud: safe	unknown
http://www.onemoresysadmin.com/i6rd/?gHSLCj58=wbIaUdvQqzQbHKzWrifpae4yz+HPBnPf3VQSw8NlhdhOO9H/uFvMKdwnlncPTgk9QTjs&9rJ=N8YdlZih	true	Avira URL Cloud: safe	unknown
http://www.onlinecasinocrazy.com/i6rd/?gHSLCj58=erkeaSWQY+Clkg2r/Pi/REnUuZTidSmaWK+TmjN6ZRgeJAvAzvFr0iNL5kMJBQzOKWdi&9rJ=N8YdlZih	true	Avira URL Cloud: safe	unknown
http://www.thebenefitssherpa.com/i6rd/?gHSLCj58=LPK2IT8klZq3HV5LkVv0HrUERmrfkAigbODxoDO8ybIsb03GvAFTkZSuj3fGszWvHktP&9rJ=N8YdlZih	false	Avira URL Cloud: safe	unknown
http://www.ricdevan.com/i6rd/?gHSLCj58=lFTIMkQ5ik6igxl0SADoA/l4wqgGqwWePHw2ryfpEDmwfQ+0wMbe0XdxLJthRM6xta9b&9rJ=N8YdlZih	true	Avira URL Cloud: safe	unknown
www.sabaidiving.com/i6rd/	true	Avira URL Cloud: safe	low
http://www.blissfulbeeboutique.online/i6rd/?gHSLCj58=smN73hIgGm+8k6TIdjzBFwruzJIggaSM7b/fO07bhI8vXH2xBAb/Cwk8Hoq4ZaNv9SU/&9rJ=N8YdlZih	true	Avira URL Cloud: safe	unknown
http://www.countrywideeconomy.com/i6rd/?gHSLCj58=HOLe4E5VAs/9VGl0AghSjQ5UDYBgOj/qhjKLxJJROTaYJ7IE9VG9ZYc05xBD+gnk3HpC&9rJ=N8YdlZih	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false		high
http://www.tiro.com	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.countrywideeconomy.com	control.exe, 0000000A.00000002.918833437.0000000004DC2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	350969bc_by_Libranalysis.exe, 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp	false		high
http://www.carterandcone.coml	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false		high
http://www.countrywideeconomy.com/	control.exe, 0000000A.00000002.918833437.0000000004DC2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.%s.comPA	explorer.exe, 00000006.00000000.666349326.0000000002B50000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://www.fonts.com	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	350969bc_by_Libranalysis.exe, 00000000.00000002.662905887.0000000003441000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	explorer.exe, 00000006.00000000.687689175.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
52.58.78.16	www.countrywideeconomy.com	United States	16509	AMAZON-02US	true
192.64.147.164	www.sabaidiving.com	United States	19867	VOODOO1US	true
23.227.38.74	shops.myshopify.com	Canada	13335	CLOUDFLARENETUS	true
192.0.78.24	onemoresysadmin.com	United States	2635	AUTOMATTICUS	true
119.81.45.82	onlinecasinocrazy.com	Singapore	36351	SOFTLAYERUS	true
198.185.159.144	ext-sq.squarespace.com	United States	53831	SQUARESPACEUS	false
185.53.177.53	www.ricdevan.com	Germany	61969	TEAMINTERNET-ASDE	true
103.15.186.68	cityofhouston.info	Japan	2519	VECTANTARTERIANetworksCorporationJP	true
34.102.136.180	thebenefitssherpa.com	United States	15169	GOOGLEUS	false
81.88.52.88	toypoodlebreedershome.com	Italy	39729	REGISTER-ASIT	true
51.222.80.112	socialeconomic.net	France	16276	OVHFR	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	412308
Start date:	12.05.2021
Start time:	15:45:53
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 34s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	350969bc_by_Libranalysis (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@11/1@12/12
EGA Information:	Failed
HDC Information:	Successful, ratio: 18.4% (good quality ratio 16.3%) Quality average: 73.4% Quality standard deviation: 32.1%
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Excluded IPs from analysis (whitelisted): 104.43.139.144, 104.42.151.234, 92.122.145.220, 13.64.90.137, 13.88.21.125, 20.82.209.183, 92.122.213.247, 92.122.213.194, 2.20.142.209, 2.20.143.16, 52.155.217.156, 20.54.26.129, 20.82.210.154 TCP Packets have been reduced to 100 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report creation exceeded maximum time and may have missing disassembly code information.

Simulations

Behavior and APIs

Time	Type	Description
15:46:44	API Interceptor	1x Sleep call for process: 350969bc_by_Libranalysis.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
52.58.78.16	Shipment Document BL,INV and packing List.exe	Get hash	malicious	Browse	www.rjroof.com/bwk/?e0D=4vdMJUauAbypOyncIj3mGOWyxqKYmFP7MPVjyJX0TlZ6LShEClzNARe6HqJLDWz2QsFLyUFcIg==&BRGTb0=DBZH
	ProForma Invoice 20210510.exe	Get hash	malicious	Browse	www.rafbar.com/u8nw/?hb8Tz=GTZNlL4u2lC1Us00w2siTAOBcwC+lUBY5op6as4vfiu2ndyHOwS1IzefqZ0oX9Ljvrcn&yVUx=0BIXczdHaL8h5fn
	0a97784c_by_Libranalysis.xlsx	Get hash	malicious	Browse	www.bestpontoonboat.com/et9g/?BZ6=bBMyEahAcXigOvOPgDjmms/4cBV9Wtmdu7/aEd/RWaUwIJILZbsGRx753LFyRZeZoLA0QA==&bdC=7njp7th
	Shipping Document.exe	Get hash	malicious	Browse	www.ehealthwy.com/ou59/?nHLD_b=F/wBt/KMP43Itvrx2w7vOpterTaFFbpTrndkSW8YN3woe1RwD49jldLS4YHInyjjH0Fk&kr4Lhj=ndkHzHd
	abc73f63_by_Libranalysis.xls	Get hash	malicious	Browse	www.fortwayneduiattorney.com/cca/?LFQLf=DQkKoy4KFmxrpP+4wA/zfG9zgCj3jVN+xnDVxHHDydHerh6N5kUzh47H2mi7uCO64HHP4Q==&PHBtKJ=OlrtB4dp
	tgix.exe	Get hash	malicious	Browse	www.physicalrobot.com/oerg/?AtxLpld=JA3D/Abhc4IR3OQLXeXKb6LQIfBkcHsKg4Z3iScHpk6TVSXolV0c13rIH8GpTmaDfWWP&orW=W6L4IdAHz
	60b88477_by_Libranalysis.exe	Get hash	malicious	Browse	www.relaxxation.com/qjnt/?_nLD=mxaFhsYrAcL/dG/heClqDIL9OHFKPqnw/WCTkSguw47Ni2/IMxTsh2aodb9jmZlwyzTK1xgprg==&m0D=AL30QHY
	e9777bb4_by_Libranalysis.exe	Get hash	malicious	Browse	www.vaginalmedicine.com/m3rc/?w8i=6BmCuDx6HNPQiFPRwokPcjAogbQnX9jjbIUytqHBtaq3fAyAKA3thvTVTfc9FuV2tCtq&CR=CpCH
	NEW ORDER.exe	Get hash	malicious	Browse	www.sanacolitademarijuana.com/u8nw/?GVIp=9bHYKsyT0auyBBl4ZenxQUebR4YwlP18dAkCPCATYDDxMs1xZZCxfJgyFOuaQUe6umYw+kXXjQ==&tzr4=jlIXVLPHc
	Ygqayrvpsvjdxblkzsmxymjfnxukvrdvft_Signed_.exe	Get hash	malicious	Browse	www.clinics.life/qku9/?sL3x=wPjLqqQ4Fl5oGjCEKguj45taGc7fhq386dHHgSG17iY4BIOMpTzTtH7Yrt22Fdj2vFYG/3Tb+A==&jrq=e4yt
	pVrqrGltiL.exe	Get hash	malicious	Browse	www.gailrichardson.com/qjnt/?lZ9=cQpYuVHXbJG9pZu9oJObHgw0bCNAclVj5UnrwSBC7KRToOBRDRnUcBg681sl3dckQEofebx0YA==&G8bDQ=7nJx1RS0B4MT9t
	krJF4BtzSv.exe	Get hash	malicious	Browse	www.hellonetworker.com/oerg/?r6A=2Id0qd+ugAnFeIUXB+gRuO324HEbs4SrVkFnQshNY9xroxdz4sfjr3km3OeVd011T3tb&YL0=8pN4l4
	70pGP1JaCf6M0kf.exe	Get hash	malicious	Browse	www.hellojesse.com/uv34/?Yn=kz3sMtkI7CkjoxhZIzOZCG4boHCoa7NSqpR26aumet80jxfhILAbk/YVwF8yKbrEfOE+8NWGOA==&I4=i0GhP0sP
	AL-IEDAHINV.No09876543.exe	Get hash	malicious	Browse	www.hellojesse.com/uv34/?gjKTUx=6lchmDL0&rnKTobm=kz3sMtkI7CkjoxhZIzOZCG4boHCoa7NSqpR26aumet80jxfhILAbk/YVwGQbJbX8Wtxo
	triage_dropped_file.exe	Get hash	malicious	Browse	www.gailrichardson.com/qjnt/?rTFDm=GBOxAlxXYbRxGd&r6q=cQpYuVHXbJG9pZu9oJObHgw0bCNAclVj5UnrwSBC7KRToOBRDRnUcBg682AmrtQcdlVJ
	y6f8O0kbEB.exe	Get hash	malicious	Browse	www.physicalrobot.com/oerg/?mHLD_0=JA3D/Abhc4IR3OQLXeXKb6LQIfBkcHsKg4Z3iScHpk6TVSXolV0c13rIH8GpTmaDfWWP&ndndnZ=UtWlYrO0rhjH
	PI34567890987.exe	Get hash	malicious	Browse	www.hellojesse.com/uv34/?S0GHnN=RRipariXRTPx&V488O=kz3sMtkI7CkjoxhZIzOZCG4boHCoa7NSqpR26aumet80jxfhILAbk/YVwFwLG6HEIIYv
	letterhead.exe	Get hash	malicious	Browse	www.adsandbanners.com/epms/?x4uDfZgH=5FcZQLEIPDinAsdvDU7qvUUfCcL2PSB22LbDCeTr+4owrfaQmoWPWt5F0XzMbxfYzfnp&Cj30v=9rJhur7HoF7lOxC
	PaymentAdvice.exe	Get hash	malicious	Browse	www.wildsoulsport.com/c22b/?Uxlt=kpNK1gW9of23sXec3wB2eGXjTzRpIjACDmlXILuFYpTB5bhnZZGkQZKPt/qXQ/DU3yyv&wP9=mfpP2VH
	UP3FvzsHWZ.exe	Get hash	malicious	Browse	www.greendaylandscaping.com/r1mo/?uDKH=7Ux04+9wxrtiaQVDDevgGV/B1TtL1QYTp7ylEXK86zgQ//45WeQOOkpXoTmAu+TPv8Ft&-ZPh=1bRpzD

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ext-sq.squarespace.com	PO 367628usa.exe	Get hash	malicious	Browse	198.185.159.144
	correct invoice.exe	Get hash	malicious	Browse	198.185.159.144
	SWIFT001411983HNK.exe	Get hash	malicious	Browse	198.185.159.144
	DOC24457188209927.exe	Get hash	malicious	Browse	198.185.159.144
	#U4f9b#U5e94#U6750#U6599.exe	Get hash	malicious	Browse	198.185.159.144
	PP,Sporda.exe	Get hash	malicious	Browse	198.185.159.144
	BORMAR SA_Cotizaci#U00f3n de producto doc.exe	Get hash	malicious	Browse	198.185.159.144
	4LkSpeVqKR.exe	Get hash	malicious	Browse	198.185.159.144
	PO889876.pdf.exe	Get hash	malicious	Browse	198.185.159.144
	202139769574 Shipping Documents.exe	Get hash	malicious	Browse	198.185.159.144
	wMqdemYyHm.exe	Get hash	malicious	Browse	198.49.23.145
	d801e424_by_Libranalysis.docx	Get hash	malicious	Browse	198.185.159.144
	7824,pdf.exe	Get hash	malicious	Browse	198.49.23.145
	PO_29_00412.exe	Get hash	malicious	Browse	198.185.159.144
	DHL_S390201.exe	Get hash	malicious	Browse	198.185.159.145
	triage_dropped_file.exe	Get hash	malicious	Browse	198.185.159.144
	Wire transfer.exe	Get hash	malicious	Browse	198.185.159.144
	mC9LnX9aGE.exe	Get hash	malicious	Browse	198.49.23.145
	4x1cYP0PFs.exe	Get hash	malicious	Browse	198.49.23.145
	SO.xlsm.exe	Get hash	malicious	Browse	198.185.159.144
shops.myshopify.com	New_Order.exe	Get hash	malicious	Browse	23.227.38.74
	correct invoice.exe	Get hash	malicious	Browse	23.227.38.74
	PP,Sporda.exe	Get hash	malicious	Browse	23.227.38.74
	Purchase Order.exe	Get hash	malicious	Browse	23.227.38.74
	PAYMENT INSTRUCTIONS COPY.exe	Get hash	malicious	Browse	23.227.38.74
	New Order.exe	Get hash	malicious	Browse	23.227.38.74
	slot Charges.exe	Get hash	malicious	Browse	23.227.38.74
	WAkePI6vWufG5Bb.exe	Get hash	malicious	Browse	23.227.38.74
	PO09641.exe	Get hash	malicious	Browse	23.227.38.74
	PO#6275473, Shipping.exe	Get hash	malicious	Browse	23.227.38.74
	4LkSpeVqKR.exe	Get hash	malicious	Browse	23.227.38.74
	PO889876.pdf.exe	Get hash	malicious	Browse	23.227.38.74
	Il nuovo ordine e nell'elenco allegato.exe	Get hash	malicious	Browse	23.227.38.74
	Order Euro 890,000.exe	Get hash	malicious	Browse	23.227.38.74
	winlog.exe	Get hash	malicious	Browse	23.227.38.74
	products order pdf .exe	Get hash	malicious	Browse	23.227.38.74
	REVISED ORDER.exe	Get hash	malicious	Browse	23.227.38.74
	e9777bb4_by_Libranalysis.exe	Get hash	malicious	Browse	23.227.38.74
	NEW ORDER.exe	Get hash	malicious	Browse	23.227.38.74
	PROFORMA INVOICE210505133444.xlsx	Get hash	malicious	Browse	23.227.38.74

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AMAZON-02US	7bYDInO.rtf	Get hash	malicious	Browse	52.210.171.182
	nT5pUwoJSS.dll	Get hash	malicious	Browse	54.247.61.18
	1c60a1e9_by_Libranalysis.rtf	Get hash	malicious	Browse	44.230.85.241
	Order 122001-220 guanzo.exe	Get hash	malicious	Browse	18.219.49.238
	main_setup_x86x64.exe	Get hash	malicious	Browse	104.192.141.1
	A6FAm1ae1j.exe	Get hash	malicious	Browse	3.138.180.119
	New_Order.exe	Get hash	malicious	Browse	75.2.115.196
	NAVTECO_R1_10_05_2021,pdf.exe	Get hash	malicious	Browse	13.58.50.133
	YDHhjjAEFbel88t.exe	Get hash	malicious	Browse	99.83.175.80
	yU7RItYEQ9kCkZE.exe	Get hash	malicious	Browse	99.83.175.80
	Shipment Document BL,INV and packing List.exe	Get hash	malicious	Browse	52.58.78.16
	4xPBZai06p.dll	Get hash	malicious	Browse	13.225.75.73
	0OyVQNXrTo.exe	Get hash	malicious	Browse	3.142.167.54
	rAd00Nae9w.dll	Get hash	malicious	Browse	13.225.75.73
	DOC24457188209927.exe	Get hash	malicious	Browse	13.224.193.2
	user-invoice-8488888.doc	Get hash	malicious	Browse	104.192.141.1
	user-invoice-8488888.doc	Get hash	malicious	Browse	104.192.141.1
	ProForma Invoice 20210510.exe	Get hash	malicious	Browse	13.113.228.117
	PO9448882.exe	Get hash	malicious	Browse	18.219.49.238
	jjbxg8kh5X.exe	Get hash	malicious	Browse	52.216.177.83
VOODOO1US	KqXtlrj1Vk.exe	Get hash	malicious	Browse	192.64.147.164
	rona.exe	Get hash	malicious	Browse	192.64.147.249
	z2xQEFs54b.exe	Get hash	malicious	Browse	192.64.147.150
	winlog.exe	Get hash	malicious	Browse	192.64.147.249
	Purchase Order.exe	Get hash	malicious	Browse	192.64.147.164
	Swift File_pdf.exe	Get hash	malicious	Browse	192.64.147.249
	Drawings.xlsm	Get hash	malicious	Browse	192.64.147.164
	RE PAYMENT REMINDER - SOA - OUTSTANDING (JAN21).EXE	Get hash	malicious	Browse	192.64.147.164
	990109.exe	Get hash	malicious	Browse	192.64.147.150
	Proforma Invoice.exe	Get hash	malicious	Browse	192.64.147.164
	CSq58hA6nO.exe	Get hash	malicious	Browse	192.64.147.164
	NQQWym075C.exe	Get hash	malicious	Browse	192.64.147.164
	kvdYhqN3Nh.exe	Get hash	malicious	Browse	192.64.147.150
	https://www.dropbox.com/l/AACILqMf9nyLCBAtI7us4fP05O8j3-IIsZk	Get hash	malicious	Browse	192.64.147.153
CLOUDFLARENETUS	7bYDInO.rtf	Get hash	malicious	Browse	104.16.18.94
	Invoice...exe	Get hash	malicious	Browse	172.67.188.154
	Tek_multiloader_5.exe	Get hash	malicious	Browse	162.159.133.233
	PO 367628usa.exe	Get hash	malicious	Browse	66.235.200.147
	Statement of Account April-2021.exe	Get hash	malicious	Browse	104.21.19.200
	2070121SN-WS for Woosim i250MSR.pif.exe	Get hash	malicious	Browse	162.159.133.233
	FACTURA COMERCIAL_________________________________________________________PDF__.exe	Get hash	malicious	Browse	172.67.188.154
	Quotation.exe	Get hash	malicious	Browse	162.159.130.233
	8wx078Pm3P.exe	Get hash	malicious	Browse	172.67.150.158
	GUaL8Nw228.exe	Get hash	malicious	Browse	104.21.30.57
	8wx078Pm3P.exe	Get hash	malicious	Browse	172.67.150.158
	qn8nIbPPCO.exe	Get hash	malicious	Browse	172.67.151.39
	viMLlTHg3d.exe	Get hash	malicious	Browse	172.67.160.89
	8n6dlwyR8l.exe	Get hash	malicious	Browse	104.21.58.140
	GUaL8Nw228.exe	Get hash	malicious	Browse	104.21.30.57
	qn8nIbPPCO.exe	Get hash	malicious	Browse	104.21.72.139
	viMLlTHg3d.exe	Get hash	malicious	Browse	172.67.160.89
	Technical data sheet.exe	Get hash	malicious	Browse	172.67.188.154
	8n6dlwyR8l.exe	Get hash	malicious	Browse	172.67.160.89
	v8wtfyQr7r.exe	Get hash	malicious	Browse	104.21.55.224

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\350969bc_by_Libranalysis.exe.log Download File
Process:	C:\Users\user\Desktop\350969bc_by_Libranalysis.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.871178969852065
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	350969bc_by_Libranalysis.exe
File size:	924672
MD5:	350969bc82ec33af12acf100c41eb4d1
SHA1:	f17d5fc8bad55cc2b523173b43585e9edb9154e4
SHA256:	961ac1d96eb469d4a949c18c25de7bf7d3ad79a502794b470a3505fa8b65d023
SHA512:	ae62d62e5e71b01a45322dd22eb4a5496b9a96b6443fc8759cd747695565d9e6b65f84da25b44239b65b15e8d615fa0bc8cd94a82351e6f18872d1fc6ee2c506
SSDEEP:	24576:rcM+tfU+NVmFr2wNV1KEjcZI30ziIwVU:rKgFzNjKEYOEWIwV
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....!................P..............0... ...@....@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4e30d2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x909C21C3 [Sun Nov 18 10:56:03 2046 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe3080	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe4000	0x5b4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xe3064	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xe10d8	0xe1200	False	0.910015269295	data	7.87688083082	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xe4000	0x5b4	0x600	False	0.422526041667	data	4.09985063561	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe6000	0xc	0x200	False	0.044921875	data	0.0980041756627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xe4090	0x324	data
RT_MANIFEST	0xe43c4	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2019
Assembly Version	1.0.0.0
InternalName	TextInfo.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	WinFormBlur
ProductVersion	1.0.0.0
FileDescription	WinFormBlur
OriginalFilename	TextInfo.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/12/21-15:47:49.762126	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49752	80	192.168.2.4	34.102.136.180
05/12/21-15:47:49.762126	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49752	80	192.168.2.4	34.102.136.180
05/12/21-15:47:49.762126	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49752	80	192.168.2.4	34.102.136.180
05/12/21-15:47:49.899209	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49752	34.102.136.180	192.168.2.4
05/12/21-15:48:07.924397	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49764	80	192.168.2.4	103.15.186.68
05/12/21-15:48:07.924397	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49764	80	192.168.2.4	103.15.186.68
05/12/21-15:48:07.924397	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49764	80	192.168.2.4	103.15.186.68
05/12/21-15:48:24.329476	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49768	185.53.177.53	192.168.2.4
05/12/21-15:48:29.463149	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49770	80	192.168.2.4	23.227.38.74
05/12/21-15:48:29.463149	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49770	80	192.168.2.4	23.227.38.74
05/12/21-15:48:29.463149	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49770	80	192.168.2.4	23.227.38.74
05/12/21-15:48:29.644690	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49770	23.227.38.74	192.168.2.4
05/12/21-15:48:35.011543	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49771	80	192.168.2.4	192.64.147.164
05/12/21-15:48:35.011543	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49771	80	192.168.2.4	192.64.147.164
05/12/21-15:48:35.011543	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49771	80	192.168.2.4	192.64.147.164

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2021 15:47:49.720372915 CEST	49752	80	192.168.2.4	34.102.136.180
May 12, 2021 15:47:49.761607885 CEST	80	49752	34.102.136.180	192.168.2.4
May 12, 2021 15:47:49.761939049 CEST	49752	80	192.168.2.4	34.102.136.180
May 12, 2021 15:47:49.762125969 CEST	49752	80	192.168.2.4	34.102.136.180
May 12, 2021 15:47:49.803127050 CEST	80	49752	34.102.136.180	192.168.2.4
May 12, 2021 15:47:49.899209023 CEST	80	49752	34.102.136.180	192.168.2.4
May 12, 2021 15:47:49.899231911 CEST	80	49752	34.102.136.180	192.168.2.4
May 12, 2021 15:47:49.899401903 CEST	49752	80	192.168.2.4	34.102.136.180
May 12, 2021 15:47:49.899447918 CEST	49752	80	192.168.2.4	34.102.136.180
May 12, 2021 15:47:49.940536022 CEST	80	49752	34.102.136.180	192.168.2.4
May 12, 2021 15:47:55.323738098 CEST	49762	80	192.168.2.4	119.81.45.82
May 12, 2021 15:47:55.530555010 CEST	80	49762	119.81.45.82	192.168.2.4
May 12, 2021 15:47:55.530677080 CEST	49762	80	192.168.2.4	119.81.45.82
May 12, 2021 15:47:55.530891895 CEST	49762	80	192.168.2.4	119.81.45.82
May 12, 2021 15:47:55.737502098 CEST	80	49762	119.81.45.82	192.168.2.4
May 12, 2021 15:47:56.787616014 CEST	49762	80	192.168.2.4	119.81.45.82
May 12, 2021 15:47:56.996212006 CEST	80	49762	119.81.45.82	192.168.2.4
May 12, 2021 15:47:56.996391058 CEST	49762	80	192.168.2.4	119.81.45.82
May 12, 2021 15:48:01.872087955 CEST	49763	80	192.168.2.4	198.185.159.144
May 12, 2021 15:48:02.004753113 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.004889011 CEST	49763	80	192.168.2.4	198.185.159.144
May 12, 2021 15:48:02.005036116 CEST	49763	80	192.168.2.4	198.185.159.144
May 12, 2021 15:48:02.137639046 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.140299082 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.140330076 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.140355110 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.140372038 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.140397072 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.140419006 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.140440941 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.140460968 CEST	49763	80	192.168.2.4	198.185.159.144
May 12, 2021 15:48:02.140465021 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.140486956 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.140507936 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.140568018 CEST	49763	80	192.168.2.4	198.185.159.144
May 12, 2021 15:48:02.140605927 CEST	49763	80	192.168.2.4	198.185.159.144
May 12, 2021 15:48:02.140696049 CEST	49763	80	192.168.2.4	198.185.159.144
May 12, 2021 15:48:02.272782087 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.272820950 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.272845030 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.272866011 CEST	49763	80	192.168.2.4	198.185.159.144
May 12, 2021 15:48:02.272867918 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.272891045 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.272900105 CEST	49763	80	192.168.2.4	198.185.159.144
May 12, 2021 15:48:02.272916079 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.272938013 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.272945881 CEST	49763	80	192.168.2.4	198.185.159.144
May 12, 2021 15:48:02.272959948 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.272970915 CEST	49763	80	192.168.2.4	198.185.159.144
May 12, 2021 15:48:02.272981882 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.273005009 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.273005962 CEST	49763	80	192.168.2.4	198.185.159.144
May 12, 2021 15:48:02.273026943 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.273040056 CEST	49763	80	192.168.2.4	198.185.159.144
May 12, 2021 15:48:02.273050070 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.273070097 CEST	49763	80	192.168.2.4	198.185.159.144
May 12, 2021 15:48:02.273071051 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.273097992 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.273116112 CEST	49763	80	192.168.2.4	198.185.159.144
May 12, 2021 15:48:02.273119926 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.273139954 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.273152113 CEST	49763	80	192.168.2.4	198.185.159.144
May 12, 2021 15:48:02.273159981 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.273179054 CEST	49763	80	192.168.2.4	198.185.159.144
May 12, 2021 15:48:02.273180962 CEST	80	49763	198.185.159.144	192.168.2.4
May 12, 2021 15:48:02.273216009 CEST	49763	80	192.168.2.4	198.185.159.144
May 12, 2021 15:48:07.568507910 CEST	49764	80	192.168.2.4	103.15.186.68
May 12, 2021 15:48:07.923923969 CEST	80	49764	103.15.186.68	192.168.2.4
May 12, 2021 15:48:07.924217939 CEST	49764	80	192.168.2.4	103.15.186.68
May 12, 2021 15:48:07.924396992 CEST	49764	80	192.168.2.4	103.15.186.68
May 12, 2021 15:48:08.275038004 CEST	80	49764	103.15.186.68	192.168.2.4
May 12, 2021 15:48:08.279015064 CEST	80	49764	103.15.186.68	192.168.2.4
May 12, 2021 15:48:08.279042006 CEST	80	49764	103.15.186.68	192.168.2.4
May 12, 2021 15:48:08.279299974 CEST	49764	80	192.168.2.4	103.15.186.68
May 12, 2021 15:48:08.279356003 CEST	49764	80	192.168.2.4	103.15.186.68
May 12, 2021 15:48:08.637468100 CEST	80	49764	103.15.186.68	192.168.2.4
May 12, 2021 15:48:13.561913967 CEST	49765	80	192.168.2.4	51.222.80.112
May 12, 2021 15:48:13.697118998 CEST	80	49765	51.222.80.112	192.168.2.4
May 12, 2021 15:48:13.697252989 CEST	49765	80	192.168.2.4	51.222.80.112
May 12, 2021 15:48:13.697396994 CEST	49765	80	192.168.2.4	51.222.80.112
May 12, 2021 15:48:13.828573942 CEST	80	49765	51.222.80.112	192.168.2.4
May 12, 2021 15:48:13.830612898 CEST	80	49765	51.222.80.112	192.168.2.4
May 12, 2021 15:48:13.830630064 CEST	80	49765	51.222.80.112	192.168.2.4
May 12, 2021 15:48:13.831099033 CEST	49765	80	192.168.2.4	51.222.80.112
May 12, 2021 15:48:13.831171989 CEST	49765	80	192.168.2.4	51.222.80.112
May 12, 2021 15:48:13.961436033 CEST	80	49765	51.222.80.112	192.168.2.4
May 12, 2021 15:48:18.927031994 CEST	49766	80	192.168.2.4	81.88.52.88
May 12, 2021 15:48:19.007870913 CEST	80	49766	81.88.52.88	192.168.2.4
May 12, 2021 15:48:19.008023977 CEST	49766	80	192.168.2.4	81.88.52.88
May 12, 2021 15:48:19.008239031 CEST	49766	80	192.168.2.4	81.88.52.88
May 12, 2021 15:48:19.089050055 CEST	80	49766	81.88.52.88	192.168.2.4
May 12, 2021 15:48:19.092015982 CEST	80	49766	81.88.52.88	192.168.2.4
May 12, 2021 15:48:19.092034101 CEST	80	49766	81.88.52.88	192.168.2.4
May 12, 2021 15:48:19.092042923 CEST	80	49766	81.88.52.88	192.168.2.4
May 12, 2021 15:48:19.092062950 CEST	80	49766	81.88.52.88	192.168.2.4
May 12, 2021 15:48:19.092201948 CEST	80	49766	81.88.52.88	192.168.2.4
May 12, 2021 15:48:19.092216969 CEST	49766	80	192.168.2.4	81.88.52.88
May 12, 2021 15:48:19.092283010 CEST	49766	80	192.168.2.4	81.88.52.88
May 12, 2021 15:48:19.092397928 CEST	49766	80	192.168.2.4	81.88.52.88
May 12, 2021 15:48:24.203677893 CEST	49768	80	192.168.2.4	185.53.177.53

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2021 15:46:36.814066887 CEST	54531	53	192.168.2.4	8.8.8.8
May 12, 2021 15:46:36.864743948 CEST	53	54531	8.8.8.8	192.168.2.4
May 12, 2021 15:46:37.713713884 CEST	49714	53	192.168.2.4	8.8.8.8
May 12, 2021 15:46:37.762743950 CEST	53	49714	8.8.8.8	192.168.2.4
May 12, 2021 15:46:38.796724081 CEST	58028	53	192.168.2.4	8.8.8.8
May 12, 2021 15:46:38.845554113 CEST	53	58028	8.8.8.8	192.168.2.4
May 12, 2021 15:46:39.592092037 CEST	53097	53	192.168.2.4	8.8.8.8
May 12, 2021 15:46:39.652911901 CEST	53	53097	8.8.8.8	192.168.2.4
May 12, 2021 15:46:42.303510904 CEST	49257	53	192.168.2.4	8.8.8.8
May 12, 2021 15:46:42.355633020 CEST	53	49257	8.8.8.8	192.168.2.4
May 12, 2021 15:46:43.388578892 CEST	62389	53	192.168.2.4	8.8.8.8
May 12, 2021 15:46:43.440186977 CEST	53	62389	8.8.8.8	192.168.2.4
May 12, 2021 15:46:45.350935936 CEST	49910	53	192.168.2.4	8.8.8.8
May 12, 2021 15:46:45.402674913 CEST	53	49910	8.8.8.8	192.168.2.4
May 12, 2021 15:46:46.534737110 CEST	55854	53	192.168.2.4	8.8.8.8
May 12, 2021 15:46:46.586438894 CEST	53	55854	8.8.8.8	192.168.2.4
May 12, 2021 15:46:47.748987913 CEST	64549	53	192.168.2.4	8.8.8.8
May 12, 2021 15:46:47.801074982 CEST	53	64549	8.8.8.8	192.168.2.4
May 12, 2021 15:46:49.071911097 CEST	63153	53	192.168.2.4	8.8.8.8
May 12, 2021 15:46:49.120729923 CEST	53	63153	8.8.8.8	192.168.2.4
May 12, 2021 15:46:50.282104015 CEST	52991	53	192.168.2.4	8.8.8.8
May 12, 2021 15:46:50.331032991 CEST	53	52991	8.8.8.8	192.168.2.4
May 12, 2021 15:46:51.485450029 CEST	53700	53	192.168.2.4	8.8.8.8
May 12, 2021 15:46:51.544975042 CEST	53	53700	8.8.8.8	192.168.2.4
May 12, 2021 15:46:52.761302948 CEST	51726	53	192.168.2.4	8.8.8.8
May 12, 2021 15:46:52.810089111 CEST	53	51726	8.8.8.8	192.168.2.4
May 12, 2021 15:46:53.900584936 CEST	56794	53	192.168.2.4	8.8.8.8
May 12, 2021 15:46:53.949546099 CEST	53	56794	8.8.8.8	192.168.2.4
May 12, 2021 15:46:54.826957941 CEST	56534	53	192.168.2.4	8.8.8.8
May 12, 2021 15:46:54.880492926 CEST	53	56534	8.8.8.8	192.168.2.4
May 12, 2021 15:46:55.795959949 CEST	56627	53	192.168.2.4	8.8.8.8
May 12, 2021 15:46:55.844654083 CEST	53	56627	8.8.8.8	192.168.2.4
May 12, 2021 15:46:56.894179106 CEST	56621	53	192.168.2.4	8.8.8.8
May 12, 2021 15:46:56.944658041 CEST	53	56621	8.8.8.8	192.168.2.4
May 12, 2021 15:46:58.453923941 CEST	63116	53	192.168.2.4	8.8.8.8
May 12, 2021 15:46:58.505796909 CEST	53	63116	8.8.8.8	192.168.2.4
May 12, 2021 15:47:00.779433966 CEST	64078	53	192.168.2.4	8.8.8.8
May 12, 2021 15:47:00.829524994 CEST	53	64078	8.8.8.8	192.168.2.4
May 12, 2021 15:47:09.577151060 CEST	64801	53	192.168.2.4	8.8.8.8
May 12, 2021 15:47:09.645700932 CEST	53	64801	8.8.8.8	192.168.2.4
May 12, 2021 15:47:20.309665918 CEST	61721	53	192.168.2.4	8.8.8.8
May 12, 2021 15:47:20.362169981 CEST	53	61721	8.8.8.8	192.168.2.4
May 12, 2021 15:47:31.677963972 CEST	51255	53	192.168.2.4	8.8.8.8
May 12, 2021 15:47:31.743438959 CEST	53	51255	8.8.8.8	192.168.2.4
May 12, 2021 15:47:45.299787045 CEST	61522	53	192.168.2.4	8.8.8.8
May 12, 2021 15:47:45.413086891 CEST	53	61522	8.8.8.8	192.168.2.4
May 12, 2021 15:47:46.130975962 CEST	52337	53	192.168.2.4	8.8.8.8
May 12, 2021 15:47:46.191771030 CEST	53	52337	8.8.8.8	192.168.2.4
May 12, 2021 15:47:46.821439981 CEST	55046	53	192.168.2.4	8.8.8.8
May 12, 2021 15:47:47.108288050 CEST	53	55046	8.8.8.8	192.168.2.4
May 12, 2021 15:47:47.545085907 CEST	49612	53	192.168.2.4	8.8.8.8
May 12, 2021 15:47:47.602678061 CEST	53	49612	8.8.8.8	192.168.2.4
May 12, 2021 15:47:48.207484961 CEST	49285	53	192.168.2.4	8.8.8.8
May 12, 2021 15:47:48.265036106 CEST	53	49285	8.8.8.8	192.168.2.4
May 12, 2021 15:47:48.434736967 CEST	50601	53	192.168.2.4	8.8.8.8
May 12, 2021 15:47:48.502091885 CEST	53	50601	8.8.8.8	192.168.2.4
May 12, 2021 15:47:49.084553003 CEST	60875	53	192.168.2.4	8.8.8.8
May 12, 2021 15:47:49.147979021 CEST	53	60875	8.8.8.8	192.168.2.4
May 12, 2021 15:47:49.649899960 CEST	56448	53	192.168.2.4	8.8.8.8
May 12, 2021 15:47:49.715104103 CEST	53	56448	8.8.8.8	192.168.2.4
May 12, 2021 15:47:49.715118885 CEST	59172	53	192.168.2.4	8.8.8.8
May 12, 2021 15:47:49.763880014 CEST	53	59172	8.8.8.8	192.168.2.4
May 12, 2021 15:47:50.554244041 CEST	62420	53	192.168.2.4	8.8.8.8
May 12, 2021 15:47:50.611854076 CEST	53	62420	8.8.8.8	192.168.2.4
May 12, 2021 15:47:51.538911104 CEST	60579	53	192.168.2.4	8.8.8.8
May 12, 2021 15:47:51.600545883 CEST	53	60579	8.8.8.8	192.168.2.4
May 12, 2021 15:47:52.124300957 CEST	50183	53	192.168.2.4	8.8.8.8
May 12, 2021 15:47:52.176544905 CEST	53	50183	8.8.8.8	192.168.2.4
May 12, 2021 15:47:52.782249928 CEST	61531	53	192.168.2.4	8.8.8.8
May 12, 2021 15:47:52.844850063 CEST	53	61531	8.8.8.8	192.168.2.4
May 12, 2021 15:47:54.907033920 CEST	49228	53	192.168.2.4	8.8.8.8
May 12, 2021 15:47:55.083226919 CEST	53	49228	8.8.8.8	192.168.2.4
May 12, 2021 15:48:01.799061060 CEST	59794	53	192.168.2.4	8.8.8.8
May 12, 2021 15:48:01.870407104 CEST	53	59794	8.8.8.8	192.168.2.4
May 12, 2021 15:48:07.185003042 CEST	55916	53	192.168.2.4	8.8.8.8
May 12, 2021 15:48:07.567153931 CEST	53	55916	8.8.8.8	192.168.2.4
May 12, 2021 15:48:13.299730062 CEST	52752	53	192.168.2.4	8.8.8.8
May 12, 2021 15:48:13.560631990 CEST	53	52752	8.8.8.8	192.168.2.4
May 12, 2021 15:48:18.851711988 CEST	60542	53	192.168.2.4	8.8.8.8
May 12, 2021 15:48:18.925479889 CEST	53	60542	8.8.8.8	192.168.2.4
May 12, 2021 15:48:22.347239017 CEST	60689	53	192.168.2.4	8.8.8.8
May 12, 2021 15:48:22.414751053 CEST	53	60689	8.8.8.8	192.168.2.4
May 12, 2021 15:48:24.136452913 CEST	64206	53	192.168.2.4	8.8.8.8
May 12, 2021 15:48:24.190939903 CEST	50904	53	192.168.2.4	8.8.8.8
May 12, 2021 15:48:24.202259064 CEST	53	64206	8.8.8.8	192.168.2.4
May 12, 2021 15:48:24.262418032 CEST	53	50904	8.8.8.8	192.168.2.4
May 12, 2021 15:48:29.346699953 CEST	57525	53	192.168.2.4	8.8.8.8
May 12, 2021 15:48:29.420010090 CEST	53	57525	8.8.8.8	192.168.2.4
May 12, 2021 15:48:34.661406040 CEST	53814	53	192.168.2.4	8.8.8.8
May 12, 2021 15:48:34.835792065 CEST	53	53814	8.8.8.8	192.168.2.4
May 12, 2021 15:48:40.305569887 CEST	53418	53	192.168.2.4	8.8.8.8
May 12, 2021 15:48:40.366614103 CEST	53	53418	8.8.8.8	192.168.2.4
May 12, 2021 15:48:45.458513021 CEST	62833	53	192.168.2.4	8.8.8.8
May 12, 2021 15:48:45.522173882 CEST	53	62833	8.8.8.8	192.168.2.4
May 12, 2021 15:48:55.627368927 CEST	59260	53	192.168.2.4	8.8.8.8
May 12, 2021 15:48:55.690572977 CEST	53	59260	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 12, 2021 15:47:49.649899960 CEST	192.168.2.4	8.8.8.8	0xf9d0	Standard query (0)	www.thebenefitssherpa.com	A (IP address)	IN (0x0001)
May 12, 2021 15:47:54.907033920 CEST	192.168.2.4	8.8.8.8	0x5743	Standard query (0)	www.onlinecasinocrazy.com	A (IP address)	IN (0x0001)
May 12, 2021 15:48:01.799061060 CEST	192.168.2.4	8.8.8.8	0x9a46	Standard query (0)	www.blissfulbeeboutique.online	A (IP address)	IN (0x0001)
May 12, 2021 15:48:07.185003042 CEST	192.168.2.4	8.8.8.8	0xd198	Standard query (0)	www.cityofhouston.info	A (IP address)	IN (0x0001)
May 12, 2021 15:48:13.299730062 CEST	192.168.2.4	8.8.8.8	0xaea8	Standard query (0)	www.socialeconomic.net	A (IP address)	IN (0x0001)
May 12, 2021 15:48:18.851711988 CEST	192.168.2.4	8.8.8.8	0x726b	Standard query (0)	www.toypoodlebreedershome.com	A (IP address)	IN (0x0001)
May 12, 2021 15:48:24.136452913 CEST	192.168.2.4	8.8.8.8	0x30ce	Standard query (0)	www.ricdevan.com	A (IP address)	IN (0x0001)
May 12, 2021 15:48:29.346699953 CEST	192.168.2.4	8.8.8.8	0xf6e2	Standard query (0)	www.ximibabes.com	A (IP address)	IN (0x0001)
May 12, 2021 15:48:34.661406040 CEST	192.168.2.4	8.8.8.8	0xcfb4	Standard query (0)	www.sabaidiving.com	A (IP address)	IN (0x0001)
May 12, 2021 15:48:40.305569887 CEST	192.168.2.4	8.8.8.8	0xb2a5	Standard query (0)	www.onemoresysadmin.com	A (IP address)	IN (0x0001)
May 12, 2021 15:48:45.458513021 CEST	192.168.2.4	8.8.8.8	0x4cc3	Standard query (0)	www.countrywideeconomy.com	A (IP address)	IN (0x0001)
May 12, 2021 15:48:55.627368927 CEST	192.168.2.4	8.8.8.8	0xfd6	Standard query (0)	www.woo.education	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 12, 2021 15:47:49.715104103 CEST	8.8.8.8	192.168.2.4	0xf9d0	No error (0)	www.thebenefitssherpa.com	thebenefitssherpa.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 15:47:49.715104103 CEST	8.8.8.8	192.168.2.4	0xf9d0	No error (0)	thebenefitssherpa.com		34.102.136.180	A (IP address)	IN (0x0001)
May 12, 2021 15:47:55.083226919 CEST	8.8.8.8	192.168.2.4	0x5743	No error (0)	www.onlinecasinocrazy.com	onlinecasinocrazy.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 15:47:55.083226919 CEST	8.8.8.8	192.168.2.4	0x5743	No error (0)	onlinecasinocrazy.com		119.81.45.82	A (IP address)	IN (0x0001)
May 12, 2021 15:48:01.870407104 CEST	8.8.8.8	192.168.2.4	0x9a46	No error (0)	www.blissfulbeeboutique.online	ext-sq.squarespace.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 15:48:01.870407104 CEST	8.8.8.8	192.168.2.4	0x9a46	No error (0)	ext-sq.squarespace.com		198.185.159.144	A (IP address)	IN (0x0001)
May 12, 2021 15:48:01.870407104 CEST	8.8.8.8	192.168.2.4	0x9a46	No error (0)	ext-sq.squarespace.com		198.49.23.145	A (IP address)	IN (0x0001)
May 12, 2021 15:48:01.870407104 CEST	8.8.8.8	192.168.2.4	0x9a46	No error (0)	ext-sq.squarespace.com		198.185.159.145	A (IP address)	IN (0x0001)
May 12, 2021 15:48:01.870407104 CEST	8.8.8.8	192.168.2.4	0x9a46	No error (0)	ext-sq.squarespace.com		198.49.23.144	A (IP address)	IN (0x0001)
May 12, 2021 15:48:07.567153931 CEST	8.8.8.8	192.168.2.4	0xd198	No error (0)	www.cityofhouston.info	cityofhouston.info		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 15:48:07.567153931 CEST	8.8.8.8	192.168.2.4	0xd198	No error (0)	cityofhouston.info		103.15.186.68	A (IP address)	IN (0x0001)
May 12, 2021 15:48:13.560631990 CEST	8.8.8.8	192.168.2.4	0xaea8	No error (0)	www.socialeconomic.net	socialeconomic.net		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 15:48:13.560631990 CEST	8.8.8.8	192.168.2.4	0xaea8	No error (0)	socialeconomic.net		51.222.80.112	A (IP address)	IN (0x0001)
May 12, 2021 15:48:18.925479889 CEST	8.8.8.8	192.168.2.4	0x726b	No error (0)	www.toypoodlebreedershome.com	toypoodlebreedershome.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 15:48:18.925479889 CEST	8.8.8.8	192.168.2.4	0x726b	No error (0)	toypoodlebreedershome.com		81.88.52.88	A (IP address)	IN (0x0001)
May 12, 2021 15:48:24.202259064 CEST	8.8.8.8	192.168.2.4	0x30ce	No error (0)	www.ricdevan.com		185.53.177.53	A (IP address)	IN (0x0001)
May 12, 2021 15:48:29.420010090 CEST	8.8.8.8	192.168.2.4	0xf6e2	No error (0)	www.ximibabes.com	ximyumi.myshopify.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 15:48:29.420010090 CEST	8.8.8.8	192.168.2.4	0xf6e2	No error (0)	ximyumi.myshopify.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 15:48:29.420010090 CEST	8.8.8.8	192.168.2.4	0xf6e2	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)
May 12, 2021 15:48:34.835792065 CEST	8.8.8.8	192.168.2.4	0xcfb4	No error (0)	www.sabaidiving.com		192.64.147.164	A (IP address)	IN (0x0001)
May 12, 2021 15:48:40.366614103 CEST	8.8.8.8	192.168.2.4	0xb2a5	No error (0)	www.onemoresysadmin.com	onemoresysadmin.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 15:48:40.366614103 CEST	8.8.8.8	192.168.2.4	0xb2a5	No error (0)	onemoresysadmin.com		192.0.78.24	A (IP address)	IN (0x0001)
May 12, 2021 15:48:40.366614103 CEST	8.8.8.8	192.168.2.4	0xb2a5	No error (0)	onemoresysadmin.com		192.0.78.25	A (IP address)	IN (0x0001)
May 12, 2021 15:48:45.522173882 CEST	8.8.8.8	192.168.2.4	0x4cc3	No error (0)	www.countrywideeconomy.com		52.58.78.16	A (IP address)	IN (0x0001)
May 12, 2021 15:48:55.690572977 CEST	8.8.8.8	192.168.2.4	0xfd6	Name error (3)	www.woo.education	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.thebenefitssherpa.com

www.onlinecasinocrazy.com

www.blissfulbeeboutique.online

www.cityofhouston.info

www.socialeconomic.net

www.toypoodlebreedershome.com

www.ricdevan.com

www.ximibabes.com

www.sabaidiving.com

www.onemoresysadmin.com

www.countrywideeconomy.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49752	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 15:47:49.762125969 CEST	1675	OUT	GET /i6rd/?gHSLCj58=LPK2IT8klZq3HV5LkVv0HrUERmrfkAigbODxoDO8ybIsb03GvAFTkZSuj3fGszWvHktP&9rJ=N8YdlZih HTTP/1.1 Host: www.thebenefitssherpa.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 15:47:49.899209023 CEST	1684	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Wed, 12 May 2021 13:47:49 GMT Content-Type: text/html Content-Length: 275 ETag: "60995c26-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49762	119.81.45.82	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 15:47:55.530891895 CEST	5420	OUT	GET /i6rd/?gHSLCj58=erkeaSWQY+Clkg2r/Pi/REnUuZTidSmaWK+TmjN6ZRgeJAvAzvFr0iNL5kMJBQzOKWdi&9rJ=N8YdlZih HTTP/1.1 Host: www.onlinecasinocrazy.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49773	52.58.78.16	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 15:48:45.566056013 CEST	6199	OUT	GET /i6rd/?gHSLCj58=HOLe4E5VAs/9VGl0AghSjQ5UDYBgOj/qhjKLxJJROTaYJ7IE9VG9ZYc05xBD+gnk3HpC&9rJ=N8YdlZih HTTP/1.1 Host: www.countrywideeconomy.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 15:48:45.607007027 CEST	6200	IN	HTTP/1.1 410 Gone Server: openresty Date: Wed, 12 May 2021 13:47:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 37 0d 0a 3c 68 74 6d 6c 3e 0a 0d 0a 39 0d 0a 20 20 3c 68 65 61 64 3e 0a 0d 0a 35 36 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 72 65 66 72 65 73 68 27 20 63 6f 6e 74 65 6e 74 3d 27 35 3b 20 75 72 6c 3d 68 74 74 70 3a 2f 2f 77 77 77 2e 63 6f 75 6e 74 72 79 77 69 64 65 65 63 6f 6e 6f 6d 79 2e 63 6f 6d 2f 27 20 2f 3e 0a 0d 0a 61 0d 0a 20 20 3c 2f 68 65 61 64 3e 0a 0d 0a 39 0d 0a 20 20 3c 62 6f 64 79 3e 0a 0d 0a 34 32 0d 0a 20 20 20 20 59 6f 75 20 61 72 65 20 62 65 69 6e 67 20 72 65 64 69 72 65 63 74 65 64 20 74 6f 20 68 74 74 70 3a 2f 2f 77 77 77 2e 63 6f 75 6e 74 72 79 77 69 64 65 65 63 6f 6e 6f 6d 79 2e 63 6f 6d 0a 0d 0a 61 0d 0a 20 20 3c 2f 62 6f 64 79 3e 0a 0d 0a 38 0d 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 7<html>9 <head>56 <meta http-equiv='refresh' content='5; url=http://www.countrywideeconomy.com/' />a </head>9 <body>42 You are being redirected to http://www.countrywideeconomy.coma </body>8</html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49763	198.185.159.144	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 15:48:02.005036116 CEST	6102	OUT	GET /i6rd/?gHSLCj58=smN73hIgGm+8k6TIdjzBFwruzJIggaSM7b/fO07bhI8vXH2xBAb/Cwk8Hoq4ZaNv9SU/&9rJ=N8YdlZih HTTP/1.1 Host: www.blissfulbeeboutique.online Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 15:48:02.140299082 CEST	6103	IN	HTTP/1.1 400 Bad Request Cache-Control: no-cache, must-revalidate Content-Length: 77564 Content-Type: text/html; charset=UTF-8 Date: Wed, 12 May 2021 13:48:02 UTC Expires: Thu, 01 Jan 1970 00:00:00 UTC Pragma: no-cache Server: Squarespace X-Contextid: gCs6earh/9UltTqOd Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 2e 36 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 31 70 78 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 34 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 61 33 61 33 61 3b 0a 20 20 7d 0a 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 6c 61 72 6b 73 6f 6e 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 0a 20 20 23 73 74 61 74 75 73 2d 70 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 32 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 73 70 61 6e 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 31 31 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 65 6d 3b 0a 20 20 20 20 Data Ascii: <!DOCTYPE html><head> <title>400 Bad Request</title> <meta name="viewport" content="width=device-width, initial-scale=1"> <style type="text/css"> body { background: white; } main { position: absolute; top: 50%; left: 50%; transform: translate(-50%, -50%); text-align: center; min-width: 95vw; } main h1 { font-weight: 300; font-size: 4.6em; color: #191919; margin: 0 0 11px 0; } main p { font-size: 1.4em; color: #3a3a3a; font-weight: 300; line-height: 2em; margin: 0; } main p a { color: #3a3a3a; text-decoration: none; border-bottom: solid 1px #3a3a3a; } body { font-family: "Clarkson", sans-serif; font-size: 12px; } #status-page { display: none; } footer { position: absolute; bottom: 22px; left: 0; width: 100%; text-align: center; line-height: 2em; } footer span { margin: 0 11px; font-size: 1em;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49764	103.15.186.68	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 15:48:07.924396992 CEST	6139	OUT	GET /i6rd/?gHSLCj58=OPhbRlTkoXrsQ0r3dKw1IvWRRcBcb3Q4dmj86tcXQUJSZPkW56a8j7HjPVLeeIGxTFMj&9rJ=N8YdlZih HTTP/1.1 Host: www.cityofhouston.info Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 15:48:08.279015064 CEST	6139	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 Date: Wed, 12 May 2021 13:48:08 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 387 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 63 69 74 79 6f 66 68 6f 75 73 74 6f 6e 2e 69 6e 66 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache Server at www.cityofhouston.info Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49765	51.222.80.112	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 15:48:13.697396994 CEST	6140	OUT	GET /i6rd/?gHSLCj58=ghT/ntM+diyN3YW/4q0tO05CJd4dCe68Gx0VtJcOz7kJ2fBcIsU6AMgtishNfwDLzL+S&9rJ=N8YdlZih HTTP/1.1 Host: www.socialeconomic.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 15:48:13.830612898 CEST	6141	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 12 May 2021 13:48:13 GMT Server: Apache Content-Security-Policy: upgrade-insecure-requests; Location: https://www.socialeconomic.net/i6rd/?gHSLCj58=ghT/ntM+diyN3YW/4q0tO05CJd4dCe68Gx0VtJcOz7kJ2fBcIsU6AMgtishNfwDLzL+S&9rJ=N8YdlZih Content-Length: 339 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 73 6f 63 69 61 6c 65 63 6f 6e 6f 6d 69 63 2e 6e 65 74 2f 69 36 72 64 2f 3f 67 48 53 4c 43 6a 35 38 3d 67 68 54 2f 6e 74 4d 2b 64 69 79 4e 33 59 57 2f 34 71 30 74 4f 30 35 43 4a 64 34 64 43 65 36 38 47 78 30 56 74 4a 63 4f 7a 37 6b 4a 32 66 42 63 49 73 55 36 41 4d 67 74 69 73 68 4e 66 77 44 4c 7a 4c 2b 53 26 61 6d 70 3b 39 72 4a 3d 4e 38 59 64 6c 5a 69 68 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.socialeconomic.net/i6rd/?gHSLCj58=ghT/ntM+diyN3YW/4q0tO05CJd4dCe68Gx0VtJcOz7kJ2fBcIsU6AMgtishNfwDLzL+S&9rJ=N8YdlZih">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49766	81.88.52.88	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 15:48:19.008239031 CEST	6142	OUT	GET /i6rd/?gHSLCj58=87tzyM19Su4M9sklYGX+FxwUh158b1qmSh9f/APlSoINpVQ2gCQ5Erv1vAVp92mNDUWx&9rJ=N8YdlZih HTTP/1.1 Host: www.toypoodlebreedershome.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 15:48:19.092015982 CEST	6143	IN	HTTP/1.1 404 Not Found Date: Wed, 12 May 2021 13:48:19 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Accept-Ranges: bytes Transfer-Encoding: chunked Content-Type: text/html Data Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 33 64 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 20 20 74 65 78 74 2d 73 68 61 64 6f 77 3a 30 20 31 70 78 20 23 66 66 66 3b 20 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 68 61 64 6f 77 3a 30 20 31 70 78 20 23 66 66 66 3b 20 2d 6d 6f 7a 2d 74 65 78 74 2d 73 68 61 64 6f 77 3a 30 20 31 70 78 20 23 66 66 66 3b 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 32 70 78 3b 20 63 6f 6c 6f 72 3a 20 23 39 30 30 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 32 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 20 7d 0a 09 09 09 68 33 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 23 63 6f 6e 74 73 20 7b 20 6d 69 6e 2d 77 69 64 74 68 3a 36 34 30 70 78 3b 20 6d 61 72 67 69 6e 3a 20 33 30 70 78 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 70 61 64 64 69 6e 67 3a 20 34 30 70 78 20 32 30 70 78 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 20 2f 2a 77 69 64 74 68 3a 20 39 30 25 3b 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 2a 2f 20 62 6f 72 64 65 72 3a 20 31 70 78 20 64 6f 74 74 65 64 20 23 39 39 39 3b 20 62 61 63 6b 67 72 6f 75 6e 64 3a 23 65 65 65 3b 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 0a 09 09 09 0d 0a 38 64 0d 0a 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: 113df<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/> <style type="text/css"> body { font-family: Arial,Helvetica Neue,Helvetica,sans-serif; text-align:center; text-shadow:0 1px #fff; -webkit-text-shadow:0 1px #fff; -moz-text-shadow:0 1px #fff; } h1 { font-size: 22px; color: #900; font-weight: bold; } h2 { font-size: 16px; color: #000000; font-weight: bold; }h3 { font-size: 16px; color: #000000; font-weight: normal; } #conts { min-width:640px; margin: 30px; background-color: #fff; padding: 40px 20px; font-size: 14px; /width: 90%; height: 100%;/ border: 1px dotted #999; background:#eee; } </style> <title>8d404 Not Found </title> </head> <body> <div id="conts">

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49768	185.53.177.53	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 15:48:24.287259102 CEST	6154	OUT	GET /i6rd/?gHSLCj58=lFTIMkQ5ik6igxl0SADoA/l4wqgGqwWePHw2ryfpEDmwfQ+0wMbe0XdxLJthRM6xta9b&9rJ=N8YdlZih HTTP/1.1 Host: www.ricdevan.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 15:48:24.329476118 CEST	6155	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Wed, 12 May 2021 13:48:24 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49770	23.227.38.74	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 15:48:29.463149071 CEST	6187	OUT	GET /i6rd/?gHSLCj58=/0C7Nd/5ZhwBGDRTMer0ywO01wFnuraj4upl6M1zLF0nwnsKqCnReLNuI6TuwxtThkOZ&9rJ=N8YdlZih HTTP/1.1 Host: www.ximibabes.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 15:48:29.644690037 CEST	6189	IN	HTTP/1.1 403 Forbidden Date: Wed, 12 May 2021 13:48:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Sorting-Hat-PodId: -1 X-Dc: gcp-us-central1 X-Request-ID: 975553ed-19fe-4a52-aebe-ef54f52968ad X-Download-Options: noopen X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block CF-Cache-Status: DYNAMIC cf-request-id: 0a026f1db800002c3ef937b000000001 Server: cloudflare CF-RAY: 64e41adc5b862c3e-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 35 63 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 65 76 65 72 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 63 63 65 73 73 20 64 65 6e 69 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 2a 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 31 46 31 46 31 3b 66 6f 6e 74 2d 73 69 7a 65 3a 36 32 2e 35 25 3b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 7d 62 6f 64 79 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 2e 37 72 65 6d 7d 61 7b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 33 30 33 30 33 30 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 20 30 2e 32 73 20 65 61 73 65 2d 69 6e 7d 61 3a 68 6f 76 65 72 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 63 6f 6c 6f 72 3a 23 41 39 41 39 41 39 7d 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 38 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 6d 61 72 67 69 6e 3a 30 20 30 20 31 2e 34 72 65 6d 20 30 7d 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 7d 2e 70 61 67 65 7b 70 61 64 64 69 6e 67 3a 34 72 65 6d 20 33 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 76 68 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 74 65 78 74 2d Data Ascii: 5c6<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <meta name="referrer" content="never" /> <title>Access denied</title> <style type="text/css"> *{box-sizing:border-box;margin:0;padding:0}html{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;background:#F1F1F1;font-size:62.5%;color:#303030;min-height:100%}body{padding:0;margin:0;line-height:2.7rem}a{color:#303030;border-bottom:1px solid #303030;text-decoration:none;padding-bottom:1rem;transition:border-color 0.2s ease-in}a:hover{border-bottom-color:#A9A9A9}h1{font-size:1.8rem;font-weight:400;margin:0 0 1.4rem 0}p{font-size:1.5rem;margin:0}.page{padding:4rem 3.5rem;margin:0;display:flex;min-height:100vh;flex-direction:column}.text-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49771	192.64.147.164	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 15:48:35.011543036 CEST	6195	OUT	GET /i6rd/?gHSLCj58=kbJM45GZrQKbh6aR4KV/wVFZMmwDJvkUUs1obqo0rCdmSsWUtmFh0yx89FvYawyrRJzX&9rJ=N8YdlZih HTTP/1.1 Host: www.sabaidiving.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 15:48:35.250890970 CEST	6196	IN	HTTP/1.1 404 Not Found Date: Wed, 12 May 2021 13:48:35 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.3.8 Set-Cookie: session=4d36d09bac3145dfbd0fe2ea9e6a7871; expires=Wed, 12-May-2021 14:18:35 GMT; path=/ Vary: Accept-Encoding,User-Agent P3P: CP="CAO PSA OUR" Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Expires: Mon, 31 Dec 2001 7:32:00 GMT Content-Length: 846 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 68 74 6d 6c 20 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 52 45 43 2d 68 74 6d 6c 34 30 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 73 61 62 61 69 64 69 76 69 6e 67 2e 63 6f 6d 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 76 61 6c 75 65 3d 22 22 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 38 2e 33 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 09 09 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 09 09 20 20 20 20 24 28 27 23 6d 61 69 6e 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 22 2f 63 66 2e 70 68 70 22 29 3b 0a 09 09 20 20 20 20 24 28 27 23 6d 61 69 6e 27 29 2e 63 73 73 28 27 76 69 73 69 62 69 6c 69 74 79 27 2c 20 27 76 69 73 69 62 6c 65 27 29 3b 0a 09 09 7d 29 3b 0a 0a 09 09 2f 2a 20 69 66 20 28 70 61 72 65 6e 74 2e 66 72 61 6d 65 73 2e 6c 65 6e 67 74 68 20 3e 20 30 29 0a 09 09 20 20 20 20 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 29 3b 20 2a 2f 0a 09 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 66 72 61 6d 65 73 65 74 20 72 6f 77 73 3d 22 31 30 30 25 2c 2a 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 6e 6f 22 20 62 6f 72 64 65 72 3d 22 30 22 20 66 72 61 6d 65 73 70 61 63 69 6e 67 3d 22 30 22 20 69 64 3d 22 66 72 61 6d 65 73 65 74 22 3e 0a 09 3c 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 22 20 73 72 63 3d 22 2f 63 66 2e 70 68 70 22 3e 3c 2f 66 72 61 6d 65 3e 0a 09 3c 66 72 61 6d 65 20 69 64 3d 22 73 75 62 31 22 20 73 72 63 3d 22 62 68 2e 70 68 70 3f 64 6d 3d 73 61 62 61 69 64 69 76 69 6e 67 2e 63 6f 6d 26 6b 77 3d 26 74 74 3d 34 64 33 36 64 30 39 62 61 63 33 31 34 35 64 66 62 64 30 66 65 32 65 61 39 65 36 61 37 38 37 31 26 74 79 3d 66 61 6c 73 65 22 20 73 74 79 6c 65 3d 22 76 69 73 69 62 69 6c 69 74 79 3a 20 68 69 64 64 65 6e 3b 22 3e 3c 2f 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 66 72 61 6d 65 73 65 74 3e 0a 3c 2f 68 74 6d 6c Data Ascii: <html xmlns="http://www.w3.org/TR/REC-html40"> <head><title>sabaidiving.com</title><meta name="keywords" value=""/><meta name="description" content=""> <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js"></script> <script type="text/javascript">$(document).ready(function () { $('#main').attr('src', "/cf.php"); $('#main').css('visibility', 'visible');});/* if (parent.frames.length > 0) top.location.replace(document.location); / </script> </head> <frameset rows="100%," frameborder="no" border="0" framespacing="0" id="frameset"><frame id="main" src="/cf.php"></frame><frame id="sub1" src="bh.php?dm=sabaidiving.com&kw=&tt=4d36d09bac3145dfbd0fe2ea9e6a7871&ty=false" style="visibility: hidden;"></frame> </frameset></html

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49772	192.0.78.24	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 15:48:40.409845114 CEST	6198	OUT	GET /i6rd/?gHSLCj58=wbIaUdvQqzQbHKzWrifpae4yz+HPBnPf3VQSw8NlhdhOO9H/uFvMKdwnlncPTgk9QTjs&9rJ=N8YdlZih HTTP/1.1 Host: www.onemoresysadmin.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 15:48:40.450537920 CEST	6198	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 12 May 2021 13:48:40 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.onemoresysadmin.com/i6rd/?gHSLCj58=wbIaUdvQqzQbHKzWrifpae4yz+HPBnPf3VQSw8NlhdhOO9H/uFvMKdwnlncPTgk9QTjs&9rJ=N8YdlZih X-ac: 2.hhn _dca Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: 350969bc_by_Libranalysis.exe PID: 6988 Parent PID: 5948

General

Start time:	15:46:42
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\350969bc_by_Libranalysis.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\350969bc_by_Libranalysis.exe'
Imagebase:	0xfb0000
File size:	924672 bytes
MD5 hash:	350969BC82EC33AF12ACF100C41EB4D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.662948300.0000000003486000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.664412012.0000000004449000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.664412012.0000000004449000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.664412012.0000000004449000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: 350969bc_by_Libranalysis.exe PID: 7100 Parent PID: 6988

General

Start time:	15:46:46
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\350969bc_by_Libranalysis.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\350969bc_by_Libranalysis.exe
Imagebase:	0x30000
File size:	924672 bytes
MD5 hash:	350969BC82EC33AF12ACF100C41EB4D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: 350969bc_by_Libranalysis.exe PID: 7140 Parent PID: 6988

General

Start time:	15:46:46
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\350969bc_by_Libranalysis.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\350969bc_by_Libranalysis.exe
Imagebase:	0x230000
File size:	924672 bytes
MD5 hash:	350969BC82EC33AF12ACF100C41EB4D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: 350969bc_by_Libranalysis.exe PID: 3416 Parent PID: 6988

General

Start time:	15:46:47
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\350969bc_by_Libranalysis.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\350969bc_by_Libranalysis.exe
Imagebase:	0x8e0000
File size:	924672 bytes
MD5 hash:	350969BC82EC33AF12ACF100C41EB4D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.715972789.0000000001090000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.715972789.0000000001090000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.715972789.0000000001090000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.715159107.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.715159107.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.715159107.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.715784952.0000000000F30000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.715784952.0000000000F30000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.715784952.0000000000F30000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: explorer.exe PID: 3424 Parent PID: 3416

General

Start time:	15:46:49
Start date:	12/05/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff6fee60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: control.exe PID: 6576 Parent PID: 3424

General

Start time:	15:47:10
Start date:	12/05/2021
Path:	C:\Windows\SysWOW64\control.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\control.exe
Imagebase:	0x3c0000
File size:	114688 bytes
MD5 hash:	40FBA3FBFD5E33E0DE1BA45472FDA66F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.916735490.0000000000540000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.916735490.0000000000540000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.916735490.0000000000540000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.917116074.00000000027A0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.917116074.00000000027A0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.917116074.00000000027A0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Analysis Process: cmd.exe PID: 6260 Parent PID: 6576

General

Start time:	15:47:14
Start date:	12/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\Desktop\350969bc_by_Libranalysis.exe'
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 7160 Parent PID: 6260

General

Start time:	15:47:14
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 350969bc_by_Libranalysis

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph