Analysis Report SKlGhwkzTi

Overview

General Information

Sample Name: SKlGhwkzTi (renamed file extension from none to exe)
Analysis ID: 432735
MD5: 8252e0bd8e579259cc18ceae0c5c6d64
SHA1: 242c3feb78e57de5c30b6f4f6b6d5d9b3332eb08
SHA256: 21b3aba425cfa96bd3c5db2b306591a3a2aa1c8ee6fbdeddfdf60b5e1c0df0ea
Tags: exetrojan
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected AntiVM3
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.adultpeace.com/p2io/"], "decoy": ["essentiallyourscandles.com", "cleanxcare.com", "bigplatesmallwallet.com", "iotcloud.technology", "dmgt4m2g8y2uh.net", "malcorinmobiliaria.com", "thriveglucose.com", "fuhaitongxin.com", "magetu.info", "pyithuhluttaw.net", "myfavbutik.com", "xzklrhy.com", "anewdistraction.com", "mercuryaid.net", "thesoulrevitalist.com", "swayam-moj.com", "liminaltechnology.com", "lucytime.com", "alfenas.info", "carmelodesign.com", "newmopeds.com", "cyrilgraze.com", "ruhexuangou.com", "trendbold.com", "centergolosinas.com", "leonardocarrillo.com", "advancedaccessapplications.com", "aideliveryrobot.com", "defenestration.world", "zgcbw.net", "shopihy.com", "3cheer.com", "untylservice.com", "totally-seo.com", "cmannouncements.com", "tpcgzwlpyggm.mobi", "hfjxhs.com", "balloon-artists.com", "vectoroutlines.com", "boogerstv.com", "procircleacademy.com", "tricqr.com", "hazard-protection.com", "buylocalclub.info", "m678.xyz", "hiddenwholesale.com", "ololmychartlogin.com", "redudiban.com", "brunoecatarina.com", "69-1hn7uc.net", "zmzcrossrt.xyz", "dreamcashbuyers.com", "yunlimall.com", "jonathan-mandt.com", "painhut.com", "pandemisorgugirisi-tr.com", "sonderbach.net", "kce0728com.net", "austinpavingcompany.com", "biztekno.com", "rodriggi.com", "micheldrake.com", "foxwaybrasil.com", "a3i7ufz4pt3.net"]}
Multi AV Scanner detection for domain / URL
Source: adultpeace.com Virustotal: Detection: 6% Perma Link
Multi AV Scanner detection for submitted file
Source: SKlGhwkzTi.exe Virustotal: Detection: 31% Perma Link
Source: SKlGhwkzTi.exe ReversingLabs: Detection: 41%
Yara detected FormBook
Source: Yara match File source: 00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.SKlGhwkzTi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.SKlGhwkzTi.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SKlGhwkzTi.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SKlGhwkzTi.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SKlGhwkzTi.exe.3de9930.1.raw.unpack, type: UNPACKEDPE
Antivirus or Machine Learning detection for unpacked file
Source: 4.2.SKlGhwkzTi.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 4.0.SKlGhwkzTi.exe.400000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: SKlGhwkzTi.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: SKlGhwkzTi.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000006.00000000.700218908.0000000005A00000.00000002.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: SKlGhwkzTi.exe, 00000004.00000002.764137531.000000000195F000.00000040.00000001.sdmp, help.exe, 0000000D.00000002.918935858.00000000039A0000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: SKlGhwkzTi.exe, help.exe
Source: Binary string: help.pdbGCTL source: SKlGhwkzTi.exe, 00000004.00000002.763881170.0000000001830000.00000040.00000001.sdmp
Source: Binary string: help.pdb source: SKlGhwkzTi.exe, 00000004.00000002.763881170.0000000001830000.00000040.00000001.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 00000006.00000000.700218908.0000000005A00000.00000002.00000001.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_02C315E0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_02C315D0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4x nop then pop edi 4_2_00416282
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4x nop then pop ebx 4_2_00406A94
Source: C:\Windows\SysWOW64\help.exe Code function: 4x nop then pop edi 13_2_032F6282
Source: C:\Windows\SysWOW64\help.exe Code function: 4x nop then pop ebx 13_2_032E6A95

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49768 -> 151.106.118.75:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49768 -> 151.106.118.75:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49768 -> 151.106.118.75:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49771 -> 192.169.223.13:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49771 -> 192.169.223.13:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49771 -> 192.169.223.13:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.adultpeace.com/p2io/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /p2io/?xN6x=es7Y2j6d/8vbylETtmEK+cycNhd4T49F/A456A8m/a4HPEjAATL8KRpgCeYlIlfO3VWH&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.hiddenwholesale.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?xN6x=ia0dgIkdnBZILDuo3zp8eo0tNiPxoXJfkPpt6P05AAGh3ZPzSagLTNX+xDwAHOv6iOkY&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.anewdistraction.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?xN6x=pxlxKDN0Rvw8YUTnsB4Bv4ohCC0AYWvU81fxb+r9dLiNjjqdMXiyL1Lf04YLJeQ+Gz7y&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.cleanxcare.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?xN6x=IctutJlD1KzdQk/q9eJAOxuhjWEnlD6jXMe1IpO47rzJ4yHlcjfL6JMqKvIaYl5lDyXZ&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.biztekno.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?xN6x=V9Q6YNEsmUTgun1x6j8RVRt0udPCykKEN/zK+I9/XCzeOC650o3noXQhbdRFxPUlYrbD&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.69-1hn7uc.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?xN6x=PONkgH6MO5ViG+zjbj4YyU3gBn/U0y1OFStIgCLmvXYcYHdxqE5/6Lr2O25ts36CozLG&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.cyrilgraze.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?xN6x=r2GsjHfGgcaZI4XPmfqM84hqAY3LnZYXU2G/Xsttb0tqrt8DFa/RFFebhWMTMoil/lgU&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.centergolosinas.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.21.65.7 104.21.65.7
Source: Joe Sandbox View IP Address: 198.185.159.144 198.185.159.144
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: PLUSSERVER-ASN1DE PLUSSERVER-ASN1DE
Source: global traffic HTTP traffic detected: GET /p2io/?xN6x=es7Y2j6d/8vbylETtmEK+cycNhd4T49F/A456A8m/a4HPEjAATL8KRpgCeYlIlfO3VWH&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.hiddenwholesale.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?xN6x=ia0dgIkdnBZILDuo3zp8eo0tNiPxoXJfkPpt6P05AAGh3ZPzSagLTNX+xDwAHOv6iOkY&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.anewdistraction.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?xN6x=pxlxKDN0Rvw8YUTnsB4Bv4ohCC0AYWvU81fxb+r9dLiNjjqdMXiyL1Lf04YLJeQ+Gz7y&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.cleanxcare.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?xN6x=IctutJlD1KzdQk/q9eJAOxuhjWEnlD6jXMe1IpO47rzJ4yHlcjfL6JMqKvIaYl5lDyXZ&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.biztekno.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?xN6x=V9Q6YNEsmUTgun1x6j8RVRt0udPCykKEN/zK+I9/XCzeOC650o3noXQhbdRFxPUlYrbD&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.69-1hn7uc.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?xN6x=PONkgH6MO5ViG+zjbj4YyU3gBn/U0y1OFStIgCLmvXYcYHdxqE5/6Lr2O25ts36CozLG&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.cyrilgraze.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?xN6x=r2GsjHfGgcaZI4XPmfqM84hqAY3LnZYXU2G/Xsttb0tqrt8DFa/RFFebhWMTMoil/lgU&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.centergolosinas.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.hiddenwholesale.com
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: SKlGhwkzTi.exe, 00000000.00000002.679283133.0000000002DE1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 00000006.00000000.716763832.0000000002B50000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: help.exe, 0000000D.00000002.919483231.0000000004052000.00000004.00000001.sdmp String found in binary or memory: https://www.cyrilgraze.com/p2io/?xN6x=PONkgH6MO5ViG

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.SKlGhwkzTi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.SKlGhwkzTi.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SKlGhwkzTi.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SKlGhwkzTi.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SKlGhwkzTi.exe.3de9930.1.raw.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.SKlGhwkzTi.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.SKlGhwkzTi.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.SKlGhwkzTi.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.SKlGhwkzTi.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.0.SKlGhwkzTi.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.0.SKlGhwkzTi.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.0.SKlGhwkzTi.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.0.SKlGhwkzTi.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.SKlGhwkzTi.exe.3de9930.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.SKlGhwkzTi.exe.3de9930.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Contains functionality to call native functions
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_004181B0 NtCreateFile, 4_2_004181B0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_00418260 NtReadFile, 4_2_00418260
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_004182E0 NtClose, 4_2_004182E0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_00418390 NtAllocateVirtualMemory, 4_2_00418390
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_004182AC NtReadFile, 4_2_004182AC
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0041838B NtAllocateVirtualMemory, 4_2_0041838B
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A99A0 NtCreateSection,LdrInitializeThunk, 4_2_018A99A0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 4_2_018A9910
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A98F0 NtReadVirtualMemory,LdrInitializeThunk, 4_2_018A98F0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9840 NtDelayExecution,LdrInitializeThunk, 4_2_018A9840
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9860 NtQuerySystemInformation,LdrInitializeThunk, 4_2_018A9860
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9A00 NtProtectVirtualMemory,LdrInitializeThunk, 4_2_018A9A00
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9A20 NtResumeThread,LdrInitializeThunk, 4_2_018A9A20
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9A50 NtCreateFile,LdrInitializeThunk, 4_2_018A9A50
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A95D0 NtClose,LdrInitializeThunk, 4_2_018A95D0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9540 NtReadFile,LdrInitializeThunk, 4_2_018A9540
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9780 NtMapViewOfSection,LdrInitializeThunk, 4_2_018A9780
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A97A0 NtUnmapViewOfSection,LdrInitializeThunk, 4_2_018A97A0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9FE0 NtCreateMutant,LdrInitializeThunk, 4_2_018A9FE0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9710 NtQueryInformationToken,LdrInitializeThunk, 4_2_018A9710
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A96E0 NtFreeVirtualMemory,LdrInitializeThunk, 4_2_018A96E0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9660 NtAllocateVirtualMemory,LdrInitializeThunk, 4_2_018A9660
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A99D0 NtCreateProcessEx, 4_2_018A99D0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9950 NtQueueApcThread, 4_2_018A9950
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A98A0 NtWriteVirtualMemory, 4_2_018A98A0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9820 NtEnumerateKey, 4_2_018A9820
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018AB040 NtSuspendThread, 4_2_018AB040
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018AA3B0 NtGetContextThread, 4_2_018AA3B0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9B00 NtSetValueKey, 4_2_018A9B00
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9A80 NtOpenDirectoryObject, 4_2_018A9A80
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9A10 NtQuerySection, 4_2_018A9A10
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A95F0 NtQueryInformationFile, 4_2_018A95F0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9520 NtWaitForSingleObject, 4_2_018A9520
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018AAD30 NtSetContextThread, 4_2_018AAD30
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9560 NtWriteFile, 4_2_018A9560
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018AA710 NtOpenProcessToken, 4_2_018AA710
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9730 NtQueryVirtualMemory, 4_2_018A9730
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9760 NtOpenProcess, 4_2_018A9760
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018AA770 NtOpenThread, 4_2_018AA770
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9770 NtSetInformationFile, 4_2_018A9770
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A96D0 NtCreateKey, 4_2_018A96D0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9610 NtEnumerateValueKey, 4_2_018A9610
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9650 NtQueryValueKey, 4_2_018A9650
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A9670 NtQueryInformationProcess, 4_2_018A9670
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09A50 NtCreateFile,LdrInitializeThunk, 13_2_03A09A50
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A099A0 NtCreateSection,LdrInitializeThunk, 13_2_03A099A0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09910 NtAdjustPrivilegesToken,LdrInitializeThunk, 13_2_03A09910
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09860 NtQuerySystemInformation,LdrInitializeThunk, 13_2_03A09860
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09840 NtDelayExecution,LdrInitializeThunk, 13_2_03A09840
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09780 NtMapViewOfSection,LdrInitializeThunk, 13_2_03A09780
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09FE0 NtCreateMutant,LdrInitializeThunk, 13_2_03A09FE0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09710 NtQueryInformationToken,LdrInitializeThunk, 13_2_03A09710
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A096E0 NtFreeVirtualMemory,LdrInitializeThunk, 13_2_03A096E0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A096D0 NtCreateKey,LdrInitializeThunk, 13_2_03A096D0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09660 NtAllocateVirtualMemory,LdrInitializeThunk, 13_2_03A09660
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09650 NtQueryValueKey,LdrInitializeThunk, 13_2_03A09650
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A095D0 NtClose,LdrInitializeThunk, 13_2_03A095D0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09540 NtReadFile,LdrInitializeThunk, 13_2_03A09540
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A0A3B0 NtGetContextThread, 13_2_03A0A3B0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09B00 NtSetValueKey, 13_2_03A09B00
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09A80 NtOpenDirectoryObject, 13_2_03A09A80
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09A20 NtResumeThread, 13_2_03A09A20
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09A00 NtProtectVirtualMemory, 13_2_03A09A00
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09A10 NtQuerySection, 13_2_03A09A10
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A099D0 NtCreateProcessEx, 13_2_03A099D0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09950 NtQueueApcThread, 13_2_03A09950
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A098A0 NtWriteVirtualMemory, 13_2_03A098A0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A098F0 NtReadVirtualMemory, 13_2_03A098F0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09820 NtEnumerateKey, 13_2_03A09820
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A0B040 NtSuspendThread, 13_2_03A0B040
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A097A0 NtUnmapViewOfSection, 13_2_03A097A0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09730 NtQueryVirtualMemory, 13_2_03A09730
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A0A710 NtOpenProcessToken, 13_2_03A0A710
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09760 NtOpenProcess, 13_2_03A09760
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A0A770 NtOpenThread, 13_2_03A0A770
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09770 NtSetInformationFile, 13_2_03A09770
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09610 NtEnumerateValueKey, 13_2_03A09610
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09670 NtQueryInformationProcess, 13_2_03A09670
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A095F0 NtQueryInformationFile, 13_2_03A095F0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09520 NtWaitForSingleObject, 13_2_03A09520
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A0AD30 NtSetContextThread, 13_2_03A0AD30
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A09560 NtWriteFile, 13_2_03A09560
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032F8390 NtAllocateVirtualMemory, 13_2_032F8390
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032F8260 NtReadFile, 13_2_032F8260
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032F82E0 NtClose, 13_2_032F82E0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032F81B0 NtCreateFile, 13_2_032F81B0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032F838B NtAllocateVirtualMemory, 13_2_032F838B
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032F82AC NtReadFile, 13_2_032F82AC
Detected potential crypto function
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 0_2_014DB284 0_2_014DB284
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 0_2_014DC2D0 0_2_014DC2D0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 0_2_014D99B0 0_2_014D99B0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 0_2_014DDF9B 0_2_014DDF9B
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 0_2_052BE0E8 0_2_052BE0E8
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 0_2_052BD240 0_2_052BD240
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 0_2_052BDAE8 0_2_052BDAE8
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 0_2_052BADF8 0_2_052BADF8
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 0_2_052BAE08 0_2_052BAE08
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_00401030 4_2_00401030
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0041B8B1 4_2_0041B8B1
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0041B963 4_2_0041B963
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_00408C4B 4_2_00408C4B
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_00408C50 4_2_00408C50
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0041B493 4_2_0041B493
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0041B496 4_2_0041B496
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0041C539 4_2_0041C539
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_00402D89 4_2_00402D89
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_00402D90 4_2_00402D90
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0041CE85 4_2_0041CE85
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0041BF12 4_2_0041BF12
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0041C795 4_2_0041C795
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_00402FB0 4_2_00402FB0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0186F900 4_2_0186F900
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01884120 4_2_01884120
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0187B090 4_2_0187B090
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018920A0 4_2_018920A0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_019320A8 4_2_019320A8
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_019328EC 4_2_019328EC
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01921002 4_2_01921002
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0193E824 4_2_0193E824
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189EBB0 4_2_0189EBB0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0192DBD2 4_2_0192DBD2
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_019203DA 4_2_019203DA
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01932B28 4_2_01932B28
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_019322AE 4_2_019322AE
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0191FA2B 4_2_0191FA2B
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01892581 4_2_01892581
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_019325DD 4_2_019325DD
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0187D5E0 4_2_0187D5E0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01932D07 4_2_01932D07
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01860D20 4_2_01860D20
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01931D55 4_2_01931D55
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0187841F 4_2_0187841F
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0192D466 4_2_0192D466
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0193DFCE 4_2_0193DFCE
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01931FF1 4_2_01931FF1
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01932EF7 4_2_01932EF7
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0192D616 4_2_0192D616
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01886E30 4_2_01886E30
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039FEBB0 13_2_039FEBB0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A8DBD2 13_2_03A8DBD2
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A92B28 13_2_03A92B28
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A922AE 13_2_03A922AE
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039CF900 13_2_039CF900
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039E4120 13_2_039E4120
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A920A8 13_2_03A920A8
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039DB090 13_2_039DB090
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F20A0 13_2_039F20A0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A928EC 13_2_03A928EC
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A81002 13_2_03A81002
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A91FF1 13_2_03A91FF1
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A92EF7 13_2_03A92EF7
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039E6E30 13_2_039E6E30
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A8D616 13_2_03A8D616
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F2581 13_2_039F2581
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A925DD 13_2_03A925DD
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039DD5E0 13_2_039DD5E0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A92D07 13_2_03A92D07
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C0D20 13_2_039C0D20
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A91D55 13_2_03A91D55
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D841F 13_2_039D841F
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A8D466 13_2_03A8D466
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032FB954 13_2_032FB954
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032FB8B1 13_2_032FB8B1
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032FBF12 13_2_032FBF12
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032E2FB0 13_2_032E2FB0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032FC795 13_2_032FC795
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032FCE85 13_2_032FCE85
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032FC539 13_2_032FC539
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032E2D89 13_2_032E2D89
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032E2D90 13_2_032E2D90
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032E8C4B 13_2_032E8C4B
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032E8C50 13_2_032E8C50
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032FB496 13_2_032FB496
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032FB493 13_2_032FB493
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: String function: 0186B150 appears 45 times
Source: C:\Windows\SysWOW64\help.exe Code function: String function: 039CB150 appears 35 times
PE file contains strange resources
Source: SKlGhwkzTi.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: SKlGhwkzTi.exe Binary or memory string: OriginalFilename vs SKlGhwkzTi.exe
Source: SKlGhwkzTi.exe, 00000000.00000002.691758486.0000000008C10000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs SKlGhwkzTi.exe
Source: SKlGhwkzTi.exe, 00000000.00000002.678186974.0000000000942000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameSoapOption.exe. vs SKlGhwkzTi.exe
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameKygo.dll* vs SKlGhwkzTi.exe
Source: SKlGhwkzTi.exe, 00000000.00000002.691169517.0000000007480000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameDSASignature.dll@ vs SKlGhwkzTi.exe
Source: SKlGhwkzTi.exe Binary or memory string: OriginalFilename vs SKlGhwkzTi.exe
Source: SKlGhwkzTi.exe, 00000004.00000002.764137531.000000000195F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SKlGhwkzTi.exe
Source: SKlGhwkzTi.exe, 00000004.00000002.761811924.0000000000E02000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameSoapOption.exe. vs SKlGhwkzTi.exe
Source: SKlGhwkzTi.exe, 00000004.00000002.763603378.00000000015A9000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameHelp.Exej% vs SKlGhwkzTi.exe
Source: SKlGhwkzTi.exe Binary or memory string: OriginalFilenameSoapOption.exe. vs SKlGhwkzTi.exe
Uses 32bit PE files
Source: SKlGhwkzTi.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.SKlGhwkzTi.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.SKlGhwkzTi.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.SKlGhwkzTi.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.SKlGhwkzTi.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.0.SKlGhwkzTi.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.0.SKlGhwkzTi.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.0.SKlGhwkzTi.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.0.SKlGhwkzTi.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.SKlGhwkzTi.exe.3de9930.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.SKlGhwkzTi.exe.3de9930.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: SKlGhwkzTi.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.troj.evad.winEXE@8/1@8/7
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SKlGhwkzTi.exe.log Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6932:120:WilError_01
Source: SKlGhwkzTi.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType*Erro ao listar Banco sql-SecurityLogonType,Select * from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)
Source: SKlGhwkzTi.exe Virustotal: Detection: 31%
Source: SKlGhwkzTi.exe ReversingLabs: Detection: 41%
Source: SKlGhwkzTi.exe String found in binary or memory: -start_number {0} -i "{1}{2}"
Source: SKlGhwkzTi.exe String found in binary or memory: <!--StartFragment -->
Source: SKlGhwkzTi.exe String found in binary or memory: -start_number {0} -i "{1}{2}"
Source: SKlGhwkzTi.exe String found in binary or memory: <!--StartFragment -->
Source: SKlGhwkzTi.exe String found in binary or memory: <<<<<<<3+<!--StartFragment -->
Source: SKlGhwkzTi.exe String found in binary or memory: %0{0}d;-start_number {0} -i "{1}{2}"
Source: unknown Process created: C:\Users\user\Desktop\SKlGhwkzTi.exe 'C:\Users\user\Desktop\SKlGhwkzTi.exe'
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process created: C:\Users\user\Desktop\SKlGhwkzTi.exe C:\Users\user\Desktop\SKlGhwkzTi.exe
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process created: C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\help.exe
Source: C:\Windows\SysWOW64\help.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\SKlGhwkzTi.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process created: C:\Users\user\Desktop\SKlGhwkzTi.exe C:\Users\user\Desktop\SKlGhwkzTi.exe Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process created: C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\help.exe Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\SKlGhwkzTi.exe' Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: SKlGhwkzTi.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SKlGhwkzTi.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000006.00000000.700218908.0000000005A00000.00000002.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: SKlGhwkzTi.exe, 00000004.00000002.764137531.000000000195F000.00000040.00000001.sdmp, help.exe, 0000000D.00000002.918935858.00000000039A0000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: SKlGhwkzTi.exe, help.exe
Source: Binary string: help.pdbGCTL source: SKlGhwkzTi.exe, 00000004.00000002.763881170.0000000001830000.00000040.00000001.sdmp
Source: Binary string: help.pdb source: SKlGhwkzTi.exe, 00000004.00000002.763881170.0000000001830000.00000040.00000001.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 00000006.00000000.700218908.0000000005A00000.00000002.00000001.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 0_2_014D9990 pushfd ; retf 0_2_014DADF2
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 0_2_014D65C8 push esp; retf 0_2_014D65CC
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 0_2_014DAC51 pushfd ; retf 0_2_014DAC52
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 0_2_014DACF1 pushfd ; retf 0_2_014DACF2
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 0_2_014DACAC push eax; iretd 0_2_014DACAD
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 0_2_014DACA8 pushfd ; retf 0_2_014DACAA
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 0_2_014DACA0 pushfd ; retf 0_2_014DACA2
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 0_2_014D55E8 push esp; retf 0002h 0_2_014D55F1
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 0_2_014D3788 push eax; retf 0_2_014D3789
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 0_2_02C3232D push FFFFFF8Bh; iretd 0_2_02C3232F
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 0_2_052BA992 pushad ; retf 0_2_052BA999
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0041B2A2 push cs; ret 4_2_0041B2A3
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0041B3F2 push eax; ret 4_2_0041B3F8
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0041B3FB push eax; ret 4_2_0041B462
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0041B3A5 push eax; ret 4_2_0041B3F8
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0041B45C push eax; ret 4_2_0041B462
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_00415414 push esp; ret 4_2_00415416
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_00414F46 push cs; ret 4_2_00414F47
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0041BF12 push dword ptr [8427D5C5h]; ret 4_2_0041C1FF
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_00415FC5 push ebp; ret 4_2_00415FC6
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018BD0D1 push ecx; ret 4_2_018BD0E4
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A1D0D1 push ecx; ret 13_2_03A1D0E4
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032FB3A5 push eax; ret 13_2_032FB3F8
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032FB3FB push eax; ret 13_2_032FB462
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032FB3F2 push eax; ret 13_2_032FB3F8
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032FB2A2 push cs; ret 13_2_032FB2A3
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032FBF12 push dword ptr [8427D5C5h]; ret 13_2_032FC1FF
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032F4F46 push cs; ret 13_2_032F4F47
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032F5FC5 push ebp; ret 13_2_032F5FC6
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032F5414 push esp; ret 13_2_032F5416
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_032FB45C push eax; ret 13_2_032FB462
Source: initial sample Static PE information: section name: .text entropy: 7.59789627336
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SKlGhwkzTi.exe PID: 6896, type: MEMORY
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe RDTSC instruction interceptor: First address: 000000000040896E second address: 0000000000408974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\help.exe RDTSC instruction interceptor: First address: 00000000032E85E4 second address: 00000000032E85EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\help.exe RDTSC instruction interceptor: First address: 00000000032E896E second address: 00000000032E8974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_004088A0 rdtsc 4_2_004088A0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe TID: 6900 Thread sleep time: -103480s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe TID: 6948 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\help.exe TID: 3120 Thread sleep time: -38000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\help.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Thread delayed: delay time: 103480 Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 00000006.00000000.706696633.000000000A9A1000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.698375339.0000000004791000.00000004.00000001.sdmp Binary or memory string: War&Prod_VMware_SATA
Source: explorer.exe, 00000006.00000000.700072671.00000000058C0000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000006.00000000.704598471.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp Binary or memory string: vmware
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000006.00000000.700611112.0000000006650000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.704598471.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000006.00000000.725511730.0000000004710000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000006.00000000.700072671.00000000058C0000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000006.00000000.704737422.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000006.00000000.700072671.00000000058C0000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: explorer.exe, 00000006.00000000.704801923.000000000A784000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 00000006.00000000.700072671.00000000058C0000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_004088A0 rdtsc 4_2_004088A0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_00409B10 LdrLoadDll, 4_2_00409B10
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0188C182 mov eax, dword ptr fs:[00000030h] 4_2_0188C182
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189A185 mov eax, dword ptr fs:[00000030h] 4_2_0189A185
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01892990 mov eax, dword ptr fs:[00000030h] 4_2_01892990
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E69A6 mov eax, dword ptr fs:[00000030h] 4_2_018E69A6
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018961A0 mov eax, dword ptr fs:[00000030h] 4_2_018961A0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018961A0 mov eax, dword ptr fs:[00000030h] 4_2_018961A0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E51BE mov eax, dword ptr fs:[00000030h] 4_2_018E51BE
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E51BE mov eax, dword ptr fs:[00000030h] 4_2_018E51BE
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E51BE mov eax, dword ptr fs:[00000030h] 4_2_018E51BE
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E51BE mov eax, dword ptr fs:[00000030h] 4_2_018E51BE
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_019249A4 mov eax, dword ptr fs:[00000030h] 4_2_019249A4
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_019249A4 mov eax, dword ptr fs:[00000030h] 4_2_019249A4
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_019249A4 mov eax, dword ptr fs:[00000030h] 4_2_019249A4
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_019249A4 mov eax, dword ptr fs:[00000030h] 4_2_019249A4
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018F41E8 mov eax, dword ptr fs:[00000030h] 4_2_018F41E8
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0186B1E1 mov eax, dword ptr fs:[00000030h] 4_2_0186B1E1
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0186B1E1 mov eax, dword ptr fs:[00000030h] 4_2_0186B1E1
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0186B1E1 mov eax, dword ptr fs:[00000030h] 4_2_0186B1E1
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01869100 mov eax, dword ptr fs:[00000030h] 4_2_01869100
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01869100 mov eax, dword ptr fs:[00000030h] 4_2_01869100
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01869100 mov eax, dword ptr fs:[00000030h] 4_2_01869100
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01884120 mov eax, dword ptr fs:[00000030h] 4_2_01884120
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01884120 mov eax, dword ptr fs:[00000030h] 4_2_01884120
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01884120 mov eax, dword ptr fs:[00000030h] 4_2_01884120
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01884120 mov eax, dword ptr fs:[00000030h] 4_2_01884120
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01884120 mov ecx, dword ptr fs:[00000030h] 4_2_01884120
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189513A mov eax, dword ptr fs:[00000030h] 4_2_0189513A
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189513A mov eax, dword ptr fs:[00000030h] 4_2_0189513A
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0188B944 mov eax, dword ptr fs:[00000030h] 4_2_0188B944
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0188B944 mov eax, dword ptr fs:[00000030h] 4_2_0188B944
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0186C962 mov eax, dword ptr fs:[00000030h] 4_2_0186C962
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0186B171 mov eax, dword ptr fs:[00000030h] 4_2_0186B171
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0186B171 mov eax, dword ptr fs:[00000030h] 4_2_0186B171
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01869080 mov eax, dword ptr fs:[00000030h] 4_2_01869080
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E3884 mov eax, dword ptr fs:[00000030h] 4_2_018E3884
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E3884 mov eax, dword ptr fs:[00000030h] 4_2_018E3884
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A90AF mov eax, dword ptr fs:[00000030h] 4_2_018A90AF
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018920A0 mov eax, dword ptr fs:[00000030h] 4_2_018920A0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018920A0 mov eax, dword ptr fs:[00000030h] 4_2_018920A0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018920A0 mov eax, dword ptr fs:[00000030h] 4_2_018920A0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018920A0 mov eax, dword ptr fs:[00000030h] 4_2_018920A0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018920A0 mov eax, dword ptr fs:[00000030h] 4_2_018920A0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018920A0 mov eax, dword ptr fs:[00000030h] 4_2_018920A0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189F0BF mov ecx, dword ptr fs:[00000030h] 4_2_0189F0BF
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189F0BF mov eax, dword ptr fs:[00000030h] 4_2_0189F0BF
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189F0BF mov eax, dword ptr fs:[00000030h] 4_2_0189F0BF
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018FB8D0 mov eax, dword ptr fs:[00000030h] 4_2_018FB8D0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018FB8D0 mov ecx, dword ptr fs:[00000030h] 4_2_018FB8D0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018FB8D0 mov eax, dword ptr fs:[00000030h] 4_2_018FB8D0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018FB8D0 mov eax, dword ptr fs:[00000030h] 4_2_018FB8D0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018FB8D0 mov eax, dword ptr fs:[00000030h] 4_2_018FB8D0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018FB8D0 mov eax, dword ptr fs:[00000030h] 4_2_018FB8D0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018640E1 mov eax, dword ptr fs:[00000030h] 4_2_018640E1
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018640E1 mov eax, dword ptr fs:[00000030h] 4_2_018640E1
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018640E1 mov eax, dword ptr fs:[00000030h] 4_2_018640E1
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018658EC mov eax, dword ptr fs:[00000030h] 4_2_018658EC
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01934015 mov eax, dword ptr fs:[00000030h] 4_2_01934015
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01934015 mov eax, dword ptr fs:[00000030h] 4_2_01934015
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E7016 mov eax, dword ptr fs:[00000030h] 4_2_018E7016
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E7016 mov eax, dword ptr fs:[00000030h] 4_2_018E7016
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E7016 mov eax, dword ptr fs:[00000030h] 4_2_018E7016
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189002D mov eax, dword ptr fs:[00000030h] 4_2_0189002D
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189002D mov eax, dword ptr fs:[00000030h] 4_2_0189002D
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189002D mov eax, dword ptr fs:[00000030h] 4_2_0189002D
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189002D mov eax, dword ptr fs:[00000030h] 4_2_0189002D
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189002D mov eax, dword ptr fs:[00000030h] 4_2_0189002D
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0187B02A mov eax, dword ptr fs:[00000030h] 4_2_0187B02A
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0187B02A mov eax, dword ptr fs:[00000030h] 4_2_0187B02A
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0187B02A mov eax, dword ptr fs:[00000030h] 4_2_0187B02A
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0187B02A mov eax, dword ptr fs:[00000030h] 4_2_0187B02A
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01880050 mov eax, dword ptr fs:[00000030h] 4_2_01880050
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01880050 mov eax, dword ptr fs:[00000030h] 4_2_01880050
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01922073 mov eax, dword ptr fs:[00000030h] 4_2_01922073
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01931074 mov eax, dword ptr fs:[00000030h] 4_2_01931074
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01871B8F mov eax, dword ptr fs:[00000030h] 4_2_01871B8F
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01871B8F mov eax, dword ptr fs:[00000030h] 4_2_01871B8F
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0191D380 mov ecx, dword ptr fs:[00000030h] 4_2_0191D380
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0192138A mov eax, dword ptr fs:[00000030h] 4_2_0192138A
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189B390 mov eax, dword ptr fs:[00000030h] 4_2_0189B390
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01892397 mov eax, dword ptr fs:[00000030h] 4_2_01892397
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01894BAD mov eax, dword ptr fs:[00000030h] 4_2_01894BAD
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01894BAD mov eax, dword ptr fs:[00000030h] 4_2_01894BAD
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01894BAD mov eax, dword ptr fs:[00000030h] 4_2_01894BAD
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01935BA5 mov eax, dword ptr fs:[00000030h] 4_2_01935BA5
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E53CA mov eax, dword ptr fs:[00000030h] 4_2_018E53CA
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E53CA mov eax, dword ptr fs:[00000030h] 4_2_018E53CA
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0188DBE9 mov eax, dword ptr fs:[00000030h] 4_2_0188DBE9
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018903E2 mov eax, dword ptr fs:[00000030h] 4_2_018903E2
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018903E2 mov eax, dword ptr fs:[00000030h] 4_2_018903E2
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018903E2 mov eax, dword ptr fs:[00000030h] 4_2_018903E2
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018903E2 mov eax, dword ptr fs:[00000030h] 4_2_018903E2
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018903E2 mov eax, dword ptr fs:[00000030h] 4_2_018903E2
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018903E2 mov eax, dword ptr fs:[00000030h] 4_2_018903E2
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0192131B mov eax, dword ptr fs:[00000030h] 4_2_0192131B
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0186DB40 mov eax, dword ptr fs:[00000030h] 4_2_0186DB40
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01938B58 mov eax, dword ptr fs:[00000030h] 4_2_01938B58
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0186F358 mov eax, dword ptr fs:[00000030h] 4_2_0186F358
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0186DB60 mov ecx, dword ptr fs:[00000030h] 4_2_0186DB60
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01893B7A mov eax, dword ptr fs:[00000030h] 4_2_01893B7A
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01893B7A mov eax, dword ptr fs:[00000030h] 4_2_01893B7A
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189D294 mov eax, dword ptr fs:[00000030h] 4_2_0189D294
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189D294 mov eax, dword ptr fs:[00000030h] 4_2_0189D294
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018652A5 mov eax, dword ptr fs:[00000030h] 4_2_018652A5
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018652A5 mov eax, dword ptr fs:[00000030h] 4_2_018652A5
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018652A5 mov eax, dword ptr fs:[00000030h] 4_2_018652A5
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018652A5 mov eax, dword ptr fs:[00000030h] 4_2_018652A5
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018652A5 mov eax, dword ptr fs:[00000030h] 4_2_018652A5
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0187AAB0 mov eax, dword ptr fs:[00000030h] 4_2_0187AAB0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0187AAB0 mov eax, dword ptr fs:[00000030h] 4_2_0187AAB0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189FAB0 mov eax, dword ptr fs:[00000030h] 4_2_0189FAB0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01892ACB mov eax, dword ptr fs:[00000030h] 4_2_01892ACB
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01892AE4 mov eax, dword ptr fs:[00000030h] 4_2_01892AE4
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0192AA16 mov eax, dword ptr fs:[00000030h] 4_2_0192AA16
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0192AA16 mov eax, dword ptr fs:[00000030h] 4_2_0192AA16
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01878A0A mov eax, dword ptr fs:[00000030h] 4_2_01878A0A
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0186AA16 mov eax, dword ptr fs:[00000030h] 4_2_0186AA16
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0186AA16 mov eax, dword ptr fs:[00000030h] 4_2_0186AA16
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01883A1C mov eax, dword ptr fs:[00000030h] 4_2_01883A1C
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01865210 mov eax, dword ptr fs:[00000030h] 4_2_01865210
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01865210 mov ecx, dword ptr fs:[00000030h] 4_2_01865210
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01865210 mov eax, dword ptr fs:[00000030h] 4_2_01865210
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01865210 mov eax, dword ptr fs:[00000030h] 4_2_01865210
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A4A2C mov eax, dword ptr fs:[00000030h] 4_2_018A4A2C
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A4A2C mov eax, dword ptr fs:[00000030h] 4_2_018A4A2C
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01869240 mov eax, dword ptr fs:[00000030h] 4_2_01869240
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01869240 mov eax, dword ptr fs:[00000030h] 4_2_01869240
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01869240 mov eax, dword ptr fs:[00000030h] 4_2_01869240
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01869240 mov eax, dword ptr fs:[00000030h] 4_2_01869240
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0192EA55 mov eax, dword ptr fs:[00000030h] 4_2_0192EA55
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018F4257 mov eax, dword ptr fs:[00000030h] 4_2_018F4257
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A927A mov eax, dword ptr fs:[00000030h] 4_2_018A927A
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0191B260 mov eax, dword ptr fs:[00000030h] 4_2_0191B260
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0191B260 mov eax, dword ptr fs:[00000030h] 4_2_0191B260
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01938A62 mov eax, dword ptr fs:[00000030h] 4_2_01938A62
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01892581 mov eax, dword ptr fs:[00000030h] 4_2_01892581
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01892581 mov eax, dword ptr fs:[00000030h] 4_2_01892581
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01892581 mov eax, dword ptr fs:[00000030h] 4_2_01892581
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01892581 mov eax, dword ptr fs:[00000030h] 4_2_01892581
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01862D8A mov eax, dword ptr fs:[00000030h] 4_2_01862D8A
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01862D8A mov eax, dword ptr fs:[00000030h] 4_2_01862D8A
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01862D8A mov eax, dword ptr fs:[00000030h] 4_2_01862D8A
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01862D8A mov eax, dword ptr fs:[00000030h] 4_2_01862D8A
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01862D8A mov eax, dword ptr fs:[00000030h] 4_2_01862D8A
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189FD9B mov eax, dword ptr fs:[00000030h] 4_2_0189FD9B
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189FD9B mov eax, dword ptr fs:[00000030h] 4_2_0189FD9B
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018935A1 mov eax, dword ptr fs:[00000030h] 4_2_018935A1
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01891DB5 mov eax, dword ptr fs:[00000030h] 4_2_01891DB5
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01891DB5 mov eax, dword ptr fs:[00000030h] 4_2_01891DB5
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01891DB5 mov eax, dword ptr fs:[00000030h] 4_2_01891DB5
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_019305AC mov eax, dword ptr fs:[00000030h] 4_2_019305AC
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_019305AC mov eax, dword ptr fs:[00000030h] 4_2_019305AC
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E6DC9 mov eax, dword ptr fs:[00000030h] 4_2_018E6DC9
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E6DC9 mov eax, dword ptr fs:[00000030h] 4_2_018E6DC9
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E6DC9 mov eax, dword ptr fs:[00000030h] 4_2_018E6DC9
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E6DC9 mov ecx, dword ptr fs:[00000030h] 4_2_018E6DC9
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E6DC9 mov eax, dword ptr fs:[00000030h] 4_2_018E6DC9
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E6DC9 mov eax, dword ptr fs:[00000030h] 4_2_018E6DC9
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01918DF1 mov eax, dword ptr fs:[00000030h] 4_2_01918DF1
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0187D5E0 mov eax, dword ptr fs:[00000030h] 4_2_0187D5E0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0187D5E0 mov eax, dword ptr fs:[00000030h] 4_2_0187D5E0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0192FDE2 mov eax, dword ptr fs:[00000030h] 4_2_0192FDE2
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0192FDE2 mov eax, dword ptr fs:[00000030h] 4_2_0192FDE2
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0192FDE2 mov eax, dword ptr fs:[00000030h] 4_2_0192FDE2
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0192FDE2 mov eax, dword ptr fs:[00000030h] 4_2_0192FDE2
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01938D34 mov eax, dword ptr fs:[00000030h] 4_2_01938D34
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0192E539 mov eax, dword ptr fs:[00000030h] 4_2_0192E539
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01894D3B mov eax, dword ptr fs:[00000030h] 4_2_01894D3B
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01894D3B mov eax, dword ptr fs:[00000030h] 4_2_01894D3B
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01894D3B mov eax, dword ptr fs:[00000030h] 4_2_01894D3B
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h] 4_2_01873D34
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h] 4_2_01873D34
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h] 4_2_01873D34
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h] 4_2_01873D34
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h] 4_2_01873D34
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h] 4_2_01873D34
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h] 4_2_01873D34
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h] 4_2_01873D34
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h] 4_2_01873D34
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h] 4_2_01873D34
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h] 4_2_01873D34
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h] 4_2_01873D34
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h] 4_2_01873D34
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0186AD30 mov eax, dword ptr fs:[00000030h] 4_2_0186AD30
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018EA537 mov eax, dword ptr fs:[00000030h] 4_2_018EA537
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A3D43 mov eax, dword ptr fs:[00000030h] 4_2_018A3D43
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E3540 mov eax, dword ptr fs:[00000030h] 4_2_018E3540
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01913D40 mov eax, dword ptr fs:[00000030h] 4_2_01913D40
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01887D50 mov eax, dword ptr fs:[00000030h] 4_2_01887D50
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0188C577 mov eax, dword ptr fs:[00000030h] 4_2_0188C577
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0188C577 mov eax, dword ptr fs:[00000030h] 4_2_0188C577
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0187849B mov eax, dword ptr fs:[00000030h] 4_2_0187849B
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01938CD6 mov eax, dword ptr fs:[00000030h] 4_2_01938CD6
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_019214FB mov eax, dword ptr fs:[00000030h] 4_2_019214FB
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E6CF0 mov eax, dword ptr fs:[00000030h] 4_2_018E6CF0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E6CF0 mov eax, dword ptr fs:[00000030h] 4_2_018E6CF0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E6CF0 mov eax, dword ptr fs:[00000030h] 4_2_018E6CF0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E6C0A mov eax, dword ptr fs:[00000030h] 4_2_018E6C0A
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E6C0A mov eax, dword ptr fs:[00000030h] 4_2_018E6C0A
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E6C0A mov eax, dword ptr fs:[00000030h] 4_2_018E6C0A
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E6C0A mov eax, dword ptr fs:[00000030h] 4_2_018E6C0A
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h] 4_2_01921C06
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h] 4_2_01921C06
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h] 4_2_01921C06
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h] 4_2_01921C06
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h] 4_2_01921C06
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h] 4_2_01921C06
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h] 4_2_01921C06
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h] 4_2_01921C06
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h] 4_2_01921C06
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h] 4_2_01921C06
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h] 4_2_01921C06
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h] 4_2_01921C06
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h] 4_2_01921C06
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h] 4_2_01921C06
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0193740D mov eax, dword ptr fs:[00000030h] 4_2_0193740D
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0193740D mov eax, dword ptr fs:[00000030h] 4_2_0193740D
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0193740D mov eax, dword ptr fs:[00000030h] 4_2_0193740D
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189BC2C mov eax, dword ptr fs:[00000030h] 4_2_0189BC2C
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189A44B mov eax, dword ptr fs:[00000030h] 4_2_0189A44B
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018FC450 mov eax, dword ptr fs:[00000030h] 4_2_018FC450
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018FC450 mov eax, dword ptr fs:[00000030h] 4_2_018FC450
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0188746D mov eax, dword ptr fs:[00000030h] 4_2_0188746D
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01878794 mov eax, dword ptr fs:[00000030h] 4_2_01878794
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E7794 mov eax, dword ptr fs:[00000030h] 4_2_018E7794
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E7794 mov eax, dword ptr fs:[00000030h] 4_2_018E7794
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E7794 mov eax, dword ptr fs:[00000030h] 4_2_018E7794
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A37F5 mov eax, dword ptr fs:[00000030h] 4_2_018A37F5
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189A70E mov eax, dword ptr fs:[00000030h] 4_2_0189A70E
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189A70E mov eax, dword ptr fs:[00000030h] 4_2_0189A70E
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0193070D mov eax, dword ptr fs:[00000030h] 4_2_0193070D
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0193070D mov eax, dword ptr fs:[00000030h] 4_2_0193070D
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0188F716 mov eax, dword ptr fs:[00000030h] 4_2_0188F716
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018FFF10 mov eax, dword ptr fs:[00000030h] 4_2_018FFF10
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018FFF10 mov eax, dword ptr fs:[00000030h] 4_2_018FFF10
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01864F2E mov eax, dword ptr fs:[00000030h] 4_2_01864F2E
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01864F2E mov eax, dword ptr fs:[00000030h] 4_2_01864F2E
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189E730 mov eax, dword ptr fs:[00000030h] 4_2_0189E730
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0187EF40 mov eax, dword ptr fs:[00000030h] 4_2_0187EF40
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0187FF60 mov eax, dword ptr fs:[00000030h] 4_2_0187FF60
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01938F6A mov eax, dword ptr fs:[00000030h] 4_2_01938F6A
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018FFE87 mov eax, dword ptr fs:[00000030h] 4_2_018FFE87
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018E46A7 mov eax, dword ptr fs:[00000030h] 4_2_018E46A7
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01930EA5 mov eax, dword ptr fs:[00000030h] 4_2_01930EA5
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01930EA5 mov eax, dword ptr fs:[00000030h] 4_2_01930EA5
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01930EA5 mov eax, dword ptr fs:[00000030h] 4_2_01930EA5
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01938ED6 mov eax, dword ptr fs:[00000030h] 4_2_01938ED6
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018936CC mov eax, dword ptr fs:[00000030h] 4_2_018936CC
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018A8EC7 mov eax, dword ptr fs:[00000030h] 4_2_018A8EC7
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0191FEC0 mov eax, dword ptr fs:[00000030h] 4_2_0191FEC0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018776E2 mov eax, dword ptr fs:[00000030h] 4_2_018776E2
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_018916E0 mov ecx, dword ptr fs:[00000030h] 4_2_018916E0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0186C600 mov eax, dword ptr fs:[00000030h] 4_2_0186C600
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0186C600 mov eax, dword ptr fs:[00000030h] 4_2_0186C600
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0186C600 mov eax, dword ptr fs:[00000030h] 4_2_0186C600
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01898E00 mov eax, dword ptr fs:[00000030h] 4_2_01898E00
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189A61C mov eax, dword ptr fs:[00000030h] 4_2_0189A61C
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0189A61C mov eax, dword ptr fs:[00000030h] 4_2_0189A61C
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01921608 mov eax, dword ptr fs:[00000030h] 4_2_01921608
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0186E620 mov eax, dword ptr fs:[00000030h] 4_2_0186E620
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0191FE3F mov eax, dword ptr fs:[00000030h] 4_2_0191FE3F
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01877E41 mov eax, dword ptr fs:[00000030h] 4_2_01877E41
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01877E41 mov eax, dword ptr fs:[00000030h] 4_2_01877E41
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01877E41 mov eax, dword ptr fs:[00000030h] 4_2_01877E41
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01877E41 mov eax, dword ptr fs:[00000030h] 4_2_01877E41
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01877E41 mov eax, dword ptr fs:[00000030h] 4_2_01877E41
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_01877E41 mov eax, dword ptr fs:[00000030h] 4_2_01877E41
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0192AE44 mov eax, dword ptr fs:[00000030h] 4_2_0192AE44
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0192AE44 mov eax, dword ptr fs:[00000030h] 4_2_0192AE44
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0187766D mov eax, dword ptr fs:[00000030h] 4_2_0187766D
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0188AE73 mov eax, dword ptr fs:[00000030h] 4_2_0188AE73
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0188AE73 mov eax, dword ptr fs:[00000030h] 4_2_0188AE73
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0188AE73 mov eax, dword ptr fs:[00000030h] 4_2_0188AE73
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0188AE73 mov eax, dword ptr fs:[00000030h] 4_2_0188AE73
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Code function: 4_2_0188AE73 mov eax, dword ptr fs:[00000030h] 4_2_0188AE73
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F2397 mov eax, dword ptr fs:[00000030h] 13_2_039F2397
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A95BA5 mov eax, dword ptr fs:[00000030h] 13_2_03A95BA5
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039FB390 mov eax, dword ptr fs:[00000030h] 13_2_039FB390
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D1B8F mov eax, dword ptr fs:[00000030h] 13_2_039D1B8F
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D1B8F mov eax, dword ptr fs:[00000030h] 13_2_039D1B8F
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A8138A mov eax, dword ptr fs:[00000030h] 13_2_03A8138A
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A7D380 mov ecx, dword ptr fs:[00000030h] 13_2_03A7D380
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F4BAD mov eax, dword ptr fs:[00000030h] 13_2_039F4BAD
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F4BAD mov eax, dword ptr fs:[00000030h] 13_2_039F4BAD
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F4BAD mov eax, dword ptr fs:[00000030h] 13_2_039F4BAD
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A453CA mov eax, dword ptr fs:[00000030h] 13_2_03A453CA
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A453CA mov eax, dword ptr fs:[00000030h] 13_2_03A453CA
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039EDBE9 mov eax, dword ptr fs:[00000030h] 13_2_039EDBE9
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F03E2 mov eax, dword ptr fs:[00000030h] 13_2_039F03E2
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F03E2 mov eax, dword ptr fs:[00000030h] 13_2_039F03E2
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F03E2 mov eax, dword ptr fs:[00000030h] 13_2_039F03E2
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F03E2 mov eax, dword ptr fs:[00000030h] 13_2_039F03E2
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F03E2 mov eax, dword ptr fs:[00000030h] 13_2_039F03E2
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F03E2 mov eax, dword ptr fs:[00000030h] 13_2_039F03E2
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A8131B mov eax, dword ptr fs:[00000030h] 13_2_03A8131B
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039CF358 mov eax, dword ptr fs:[00000030h] 13_2_039CF358
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039CDB40 mov eax, dword ptr fs:[00000030h] 13_2_039CDB40
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F3B7A mov eax, dword ptr fs:[00000030h] 13_2_039F3B7A
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F3B7A mov eax, dword ptr fs:[00000030h] 13_2_039F3B7A
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A98B58 mov eax, dword ptr fs:[00000030h] 13_2_03A98B58
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039CDB60 mov ecx, dword ptr fs:[00000030h] 13_2_039CDB60
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039FD294 mov eax, dword ptr fs:[00000030h] 13_2_039FD294
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039FD294 mov eax, dword ptr fs:[00000030h] 13_2_039FD294
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039DAAB0 mov eax, dword ptr fs:[00000030h] 13_2_039DAAB0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039DAAB0 mov eax, dword ptr fs:[00000030h] 13_2_039DAAB0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039FFAB0 mov eax, dword ptr fs:[00000030h] 13_2_039FFAB0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C52A5 mov eax, dword ptr fs:[00000030h] 13_2_039C52A5
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C52A5 mov eax, dword ptr fs:[00000030h] 13_2_039C52A5
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C52A5 mov eax, dword ptr fs:[00000030h] 13_2_039C52A5
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C52A5 mov eax, dword ptr fs:[00000030h] 13_2_039C52A5
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C52A5 mov eax, dword ptr fs:[00000030h] 13_2_039C52A5
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F2ACB mov eax, dword ptr fs:[00000030h] 13_2_039F2ACB
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F2AE4 mov eax, dword ptr fs:[00000030h] 13_2_039F2AE4
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039E3A1C mov eax, dword ptr fs:[00000030h] 13_2_039E3A1C
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039CAA16 mov eax, dword ptr fs:[00000030h] 13_2_039CAA16
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039CAA16 mov eax, dword ptr fs:[00000030h] 13_2_039CAA16
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A04A2C mov eax, dword ptr fs:[00000030h] 13_2_03A04A2C
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A04A2C mov eax, dword ptr fs:[00000030h] 13_2_03A04A2C
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C5210 mov eax, dword ptr fs:[00000030h] 13_2_039C5210
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C5210 mov ecx, dword ptr fs:[00000030h] 13_2_039C5210
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C5210 mov eax, dword ptr fs:[00000030h] 13_2_039C5210
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C5210 mov eax, dword ptr fs:[00000030h] 13_2_039C5210
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D8A0A mov eax, dword ptr fs:[00000030h] 13_2_039D8A0A
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A8AA16 mov eax, dword ptr fs:[00000030h] 13_2_03A8AA16
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A8AA16 mov eax, dword ptr fs:[00000030h] 13_2_03A8AA16
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A7B260 mov eax, dword ptr fs:[00000030h] 13_2_03A7B260
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A7B260 mov eax, dword ptr fs:[00000030h] 13_2_03A7B260
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A98A62 mov eax, dword ptr fs:[00000030h] 13_2_03A98A62
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A0927A mov eax, dword ptr fs:[00000030h] 13_2_03A0927A
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C9240 mov eax, dword ptr fs:[00000030h] 13_2_039C9240
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C9240 mov eax, dword ptr fs:[00000030h] 13_2_039C9240
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C9240 mov eax, dword ptr fs:[00000030h] 13_2_039C9240
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C9240 mov eax, dword ptr fs:[00000030h] 13_2_039C9240
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A54257 mov eax, dword ptr fs:[00000030h] 13_2_03A54257
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A8EA55 mov eax, dword ptr fs:[00000030h] 13_2_03A8EA55
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A469A6 mov eax, dword ptr fs:[00000030h] 13_2_03A469A6
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F2990 mov eax, dword ptr fs:[00000030h] 13_2_039F2990
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039FA185 mov eax, dword ptr fs:[00000030h] 13_2_039FA185
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A451BE mov eax, dword ptr fs:[00000030h] 13_2_03A451BE
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A451BE mov eax, dword ptr fs:[00000030h] 13_2_03A451BE
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A451BE mov eax, dword ptr fs:[00000030h] 13_2_03A451BE
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A451BE mov eax, dword ptr fs:[00000030h] 13_2_03A451BE
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039EC182 mov eax, dword ptr fs:[00000030h] 13_2_039EC182
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F61A0 mov eax, dword ptr fs:[00000030h] 13_2_039F61A0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F61A0 mov eax, dword ptr fs:[00000030h] 13_2_039F61A0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A541E8 mov eax, dword ptr fs:[00000030h] 13_2_03A541E8
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039CB1E1 mov eax, dword ptr fs:[00000030h] 13_2_039CB1E1
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039CB1E1 mov eax, dword ptr fs:[00000030h] 13_2_039CB1E1
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039CB1E1 mov eax, dword ptr fs:[00000030h] 13_2_039CB1E1
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C9100 mov eax, dword ptr fs:[00000030h] 13_2_039C9100
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C9100 mov eax, dword ptr fs:[00000030h] 13_2_039C9100
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C9100 mov eax, dword ptr fs:[00000030h] 13_2_039C9100
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F513A mov eax, dword ptr fs:[00000030h] 13_2_039F513A
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F513A mov eax, dword ptr fs:[00000030h] 13_2_039F513A
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039E4120 mov eax, dword ptr fs:[00000030h] 13_2_039E4120
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039E4120 mov eax, dword ptr fs:[00000030h] 13_2_039E4120
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039E4120 mov eax, dword ptr fs:[00000030h] 13_2_039E4120
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039E4120 mov eax, dword ptr fs:[00000030h] 13_2_039E4120
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039E4120 mov ecx, dword ptr fs:[00000030h] 13_2_039E4120
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039EB944 mov eax, dword ptr fs:[00000030h] 13_2_039EB944
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039EB944 mov eax, dword ptr fs:[00000030h] 13_2_039EB944
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039CB171 mov eax, dword ptr fs:[00000030h] 13_2_039CB171
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039CB171 mov eax, dword ptr fs:[00000030h] 13_2_039CB171
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039CC962 mov eax, dword ptr fs:[00000030h] 13_2_039CC962
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A090AF mov eax, dword ptr fs:[00000030h] 13_2_03A090AF
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C9080 mov eax, dword ptr fs:[00000030h] 13_2_039C9080
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039FF0BF mov ecx, dword ptr fs:[00000030h] 13_2_039FF0BF
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039FF0BF mov eax, dword ptr fs:[00000030h] 13_2_039FF0BF
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039FF0BF mov eax, dword ptr fs:[00000030h] 13_2_039FF0BF
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A43884 mov eax, dword ptr fs:[00000030h] 13_2_03A43884
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A43884 mov eax, dword ptr fs:[00000030h] 13_2_03A43884
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F20A0 mov eax, dword ptr fs:[00000030h] 13_2_039F20A0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F20A0 mov eax, dword ptr fs:[00000030h] 13_2_039F20A0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F20A0 mov eax, dword ptr fs:[00000030h] 13_2_039F20A0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F20A0 mov eax, dword ptr fs:[00000030h] 13_2_039F20A0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F20A0 mov eax, dword ptr fs:[00000030h] 13_2_039F20A0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F20A0 mov eax, dword ptr fs:[00000030h] 13_2_039F20A0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C58EC mov eax, dword ptr fs:[00000030h] 13_2_039C58EC
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A5B8D0 mov eax, dword ptr fs:[00000030h] 13_2_03A5B8D0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A5B8D0 mov ecx, dword ptr fs:[00000030h] 13_2_03A5B8D0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A5B8D0 mov eax, dword ptr fs:[00000030h] 13_2_03A5B8D0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A5B8D0 mov eax, dword ptr fs:[00000030h] 13_2_03A5B8D0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A5B8D0 mov eax, dword ptr fs:[00000030h] 13_2_03A5B8D0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A5B8D0 mov eax, dword ptr fs:[00000030h] 13_2_03A5B8D0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A47016 mov eax, dword ptr fs:[00000030h] 13_2_03A47016
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A47016 mov eax, dword ptr fs:[00000030h] 13_2_03A47016
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A47016 mov eax, dword ptr fs:[00000030h] 13_2_03A47016
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F002D mov eax, dword ptr fs:[00000030h] 13_2_039F002D
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F002D mov eax, dword ptr fs:[00000030h] 13_2_039F002D
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F002D mov eax, dword ptr fs:[00000030h] 13_2_039F002D
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F002D mov eax, dword ptr fs:[00000030h] 13_2_039F002D
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F002D mov eax, dword ptr fs:[00000030h] 13_2_039F002D
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039DB02A mov eax, dword ptr fs:[00000030h] 13_2_039DB02A
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039DB02A mov eax, dword ptr fs:[00000030h] 13_2_039DB02A
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039DB02A mov eax, dword ptr fs:[00000030h] 13_2_039DB02A
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039DB02A mov eax, dword ptr fs:[00000030h] 13_2_039DB02A
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A94015 mov eax, dword ptr fs:[00000030h] 13_2_03A94015
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A94015 mov eax, dword ptr fs:[00000030h] 13_2_03A94015
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039E0050 mov eax, dword ptr fs:[00000030h] 13_2_039E0050
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039E0050 mov eax, dword ptr fs:[00000030h] 13_2_039E0050
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A82073 mov eax, dword ptr fs:[00000030h] 13_2_03A82073
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A91074 mov eax, dword ptr fs:[00000030h] 13_2_03A91074
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D8794 mov eax, dword ptr fs:[00000030h] 13_2_039D8794
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A47794 mov eax, dword ptr fs:[00000030h] 13_2_03A47794
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A47794 mov eax, dword ptr fs:[00000030h] 13_2_03A47794
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A47794 mov eax, dword ptr fs:[00000030h] 13_2_03A47794
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A037F5 mov eax, dword ptr fs:[00000030h] 13_2_03A037F5
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039EF716 mov eax, dword ptr fs:[00000030h] 13_2_039EF716
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039FA70E mov eax, dword ptr fs:[00000030h] 13_2_039FA70E
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039FA70E mov eax, dword ptr fs:[00000030h] 13_2_039FA70E
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A9070D mov eax, dword ptr fs:[00000030h] 13_2_03A9070D
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A9070D mov eax, dword ptr fs:[00000030h] 13_2_03A9070D
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039FE730 mov eax, dword ptr fs:[00000030h] 13_2_039FE730
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C4F2E mov eax, dword ptr fs:[00000030h] 13_2_039C4F2E
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C4F2E mov eax, dword ptr fs:[00000030h] 13_2_039C4F2E
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A5FF10 mov eax, dword ptr fs:[00000030h] 13_2_03A5FF10
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A5FF10 mov eax, dword ptr fs:[00000030h] 13_2_03A5FF10
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A98F6A mov eax, dword ptr fs:[00000030h] 13_2_03A98F6A
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039DEF40 mov eax, dword ptr fs:[00000030h] 13_2_039DEF40
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039DFF60 mov eax, dword ptr fs:[00000030h] 13_2_039DFF60
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A446A7 mov eax, dword ptr fs:[00000030h] 13_2_03A446A7
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A90EA5 mov eax, dword ptr fs:[00000030h] 13_2_03A90EA5
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A90EA5 mov eax, dword ptr fs:[00000030h] 13_2_03A90EA5
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A90EA5 mov eax, dword ptr fs:[00000030h] 13_2_03A90EA5
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A5FE87 mov eax, dword ptr fs:[00000030h] 13_2_03A5FE87
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F36CC mov eax, dword ptr fs:[00000030h] 13_2_039F36CC
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A7FEC0 mov eax, dword ptr fs:[00000030h] 13_2_03A7FEC0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A08EC7 mov eax, dword ptr fs:[00000030h] 13_2_03A08EC7
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D76E2 mov eax, dword ptr fs:[00000030h] 13_2_039D76E2
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A98ED6 mov eax, dword ptr fs:[00000030h] 13_2_03A98ED6
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F16E0 mov ecx, dword ptr fs:[00000030h] 13_2_039F16E0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039FA61C mov eax, dword ptr fs:[00000030h] 13_2_039FA61C
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039FA61C mov eax, dword ptr fs:[00000030h] 13_2_039FA61C
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A7FE3F mov eax, dword ptr fs:[00000030h] 13_2_03A7FE3F
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039CC600 mov eax, dword ptr fs:[00000030h] 13_2_039CC600
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039CC600 mov eax, dword ptr fs:[00000030h] 13_2_039CC600
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039CC600 mov eax, dword ptr fs:[00000030h] 13_2_039CC600
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F8E00 mov eax, dword ptr fs:[00000030h] 13_2_039F8E00
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A81608 mov eax, dword ptr fs:[00000030h] 13_2_03A81608
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039CE620 mov eax, dword ptr fs:[00000030h] 13_2_039CE620
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D7E41 mov eax, dword ptr fs:[00000030h] 13_2_039D7E41
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D7E41 mov eax, dword ptr fs:[00000030h] 13_2_039D7E41
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D7E41 mov eax, dword ptr fs:[00000030h] 13_2_039D7E41
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D7E41 mov eax, dword ptr fs:[00000030h] 13_2_039D7E41
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D7E41 mov eax, dword ptr fs:[00000030h] 13_2_039D7E41
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D7E41 mov eax, dword ptr fs:[00000030h] 13_2_039D7E41
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A8AE44 mov eax, dword ptr fs:[00000030h] 13_2_03A8AE44
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A8AE44 mov eax, dword ptr fs:[00000030h] 13_2_03A8AE44
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039EAE73 mov eax, dword ptr fs:[00000030h] 13_2_039EAE73
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039EAE73 mov eax, dword ptr fs:[00000030h] 13_2_039EAE73
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039EAE73 mov eax, dword ptr fs:[00000030h] 13_2_039EAE73
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039EAE73 mov eax, dword ptr fs:[00000030h] 13_2_039EAE73
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039EAE73 mov eax, dword ptr fs:[00000030h] 13_2_039EAE73
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D766D mov eax, dword ptr fs:[00000030h] 13_2_039D766D
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039FFD9B mov eax, dword ptr fs:[00000030h] 13_2_039FFD9B
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039FFD9B mov eax, dword ptr fs:[00000030h] 13_2_039FFD9B
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A905AC mov eax, dword ptr fs:[00000030h] 13_2_03A905AC
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A905AC mov eax, dword ptr fs:[00000030h] 13_2_03A905AC
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C2D8A mov eax, dword ptr fs:[00000030h] 13_2_039C2D8A
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C2D8A mov eax, dword ptr fs:[00000030h] 13_2_039C2D8A
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C2D8A mov eax, dword ptr fs:[00000030h] 13_2_039C2D8A
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C2D8A mov eax, dword ptr fs:[00000030h] 13_2_039C2D8A
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039C2D8A mov eax, dword ptr fs:[00000030h] 13_2_039C2D8A
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F2581 mov eax, dword ptr fs:[00000030h] 13_2_039F2581
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F2581 mov eax, dword ptr fs:[00000030h] 13_2_039F2581
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F2581 mov eax, dword ptr fs:[00000030h] 13_2_039F2581
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F2581 mov eax, dword ptr fs:[00000030h] 13_2_039F2581
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F1DB5 mov eax, dword ptr fs:[00000030h] 13_2_039F1DB5
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F1DB5 mov eax, dword ptr fs:[00000030h] 13_2_039F1DB5
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F1DB5 mov eax, dword ptr fs:[00000030h] 13_2_039F1DB5
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F35A1 mov eax, dword ptr fs:[00000030h] 13_2_039F35A1
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A8FDE2 mov eax, dword ptr fs:[00000030h] 13_2_03A8FDE2
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A8FDE2 mov eax, dword ptr fs:[00000030h] 13_2_03A8FDE2
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A8FDE2 mov eax, dword ptr fs:[00000030h] 13_2_03A8FDE2
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A8FDE2 mov eax, dword ptr fs:[00000030h] 13_2_03A8FDE2
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A78DF1 mov eax, dword ptr fs:[00000030h] 13_2_03A78DF1
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A46DC9 mov eax, dword ptr fs:[00000030h] 13_2_03A46DC9
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A46DC9 mov eax, dword ptr fs:[00000030h] 13_2_03A46DC9
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A46DC9 mov eax, dword ptr fs:[00000030h] 13_2_03A46DC9
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A46DC9 mov ecx, dword ptr fs:[00000030h] 13_2_03A46DC9
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A46DC9 mov eax, dword ptr fs:[00000030h] 13_2_03A46DC9
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A46DC9 mov eax, dword ptr fs:[00000030h] 13_2_03A46DC9
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039DD5E0 mov eax, dword ptr fs:[00000030h] 13_2_039DD5E0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039DD5E0 mov eax, dword ptr fs:[00000030h] 13_2_039DD5E0
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A8E539 mov eax, dword ptr fs:[00000030h] 13_2_03A8E539
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A4A537 mov eax, dword ptr fs:[00000030h] 13_2_03A4A537
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_03A98D34 mov eax, dword ptr fs:[00000030h] 13_2_03A98D34
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F4D3B mov eax, dword ptr fs:[00000030h] 13_2_039F4D3B
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F4D3B mov eax, dword ptr fs:[00000030h] 13_2_039F4D3B
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039F4D3B mov eax, dword ptr fs:[00000030h] 13_2_039F4D3B
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h] 13_2_039D3D34
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h] 13_2_039D3D34
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h] 13_2_039D3D34
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h] 13_2_039D3D34
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h] 13_2_039D3D34
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h] 13_2_039D3D34
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h] 13_2_039D3D34
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h] 13_2_039D3D34
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h] 13_2_039D3D34
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h] 13_2_039D3D34
Source: C:\Windows\SysWOW64\help.exe Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h] 13_2_039D3D34
Enables debug privileges
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 104.21.65.7 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.hiddenwholesale.com
Source: C:\Windows\explorer.exe Domain query: www.cleanxcare.com
Source: C:\Windows\explorer.exe Domain query: www.biztekno.com
Source: C:\Windows\explorer.exe Domain query: www.centergolosinas.com
Source: C:\Windows\explorer.exe Network Connect: 44.227.65.245 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 192.169.223.13 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 198.185.159.144 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 151.106.118.75 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.69-1hn7uc.net
Source: C:\Windows\explorer.exe Domain query: www.cyrilgraze.com
Source: C:\Windows\explorer.exe Domain query: www.anewdistraction.com
Source: C:\Windows\explorer.exe Network Connect: 163.43.122.119 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 78.31.67.91 80 Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Memory written: C:\Users\user\Desktop\SKlGhwkzTi.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Section loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Section loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Thread register set: target process: 3424 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Section unmapped: C:\Windows\SysWOW64\help.exe base address: F90000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process created: C:\Users\user\Desktop\SKlGhwkzTi.exe C:\Users\user\Desktop\SKlGhwkzTi.exe Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Process created: C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\help.exe Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\SKlGhwkzTi.exe' Jump to behavior
Source: explorer.exe, 00000006.00000000.714835455.0000000000AD8000.00000004.00000020.sdmp Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000006.00000000.715332585.0000000001080000.00000002.00000001.sdmp, help.exe, 0000000D.00000002.919752559.00000000060F0000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000006.00000000.715332585.0000000001080000.00000002.00000001.sdmp, help.exe, 0000000D.00000002.919752559.00000000060F0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.715332585.0000000001080000.00000002.00000001.sdmp, help.exe, 0000000D.00000002.919752559.00000000060F0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000006.00000000.715332585.0000000001080000.00000002.00000001.sdmp, help.exe, 0000000D.00000002.919752559.00000000060F0000.00000002.00000001.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000006.00000000.704737422.000000000A716000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWnd5D

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Users\user\Desktop\SKlGhwkzTi.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.SKlGhwkzTi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.SKlGhwkzTi.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SKlGhwkzTi.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SKlGhwkzTi.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SKlGhwkzTi.exe.3de9930.1.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.SKlGhwkzTi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.SKlGhwkzTi.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SKlGhwkzTi.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SKlGhwkzTi.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SKlGhwkzTi.exe.3de9930.1.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 432735 Sample: SKlGhwkzTi Startdate: 10/06/2021 Architecture: WINDOWS Score: 100 29 www.adultpeace.com 2->29 31 adultpeace.com 2->31 47 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->47 49 Multi AV Scanner detection for domain / URL 2->49 51 Found malware configuration 2->51 53 6 other signatures 2->53 10 SKlGhwkzTi.exe 3 2->10         started        signatures3 process4 file5 27 C:\Users\user\AppData\...\SKlGhwkzTi.exe.log, ASCII 10->27 dropped 55 Tries to detect virtualization through RDTSC time measurements 10->55 57 Injects a PE file into a foreign processes 10->57 14 SKlGhwkzTi.exe 10->14         started        signatures6 process7 signatures8 59 Modifies the context of a thread in another process (thread injection) 14->59 61 Maps a DLL or memory area into another process 14->61 63 Sample uses process hollowing technique 14->63 65 Queues an APC in another process (thread injection) 14->65 17 help.exe 14->17         started        20 explorer.exe 14->20 injected process9 dnsIp10 39 Modifies the context of a thread in another process (thread injection) 17->39 41 Maps a DLL or memory area into another process 17->41 43 Tries to detect virtualization through RDTSC time measurements 17->43 23 cmd.exe 1 17->23         started        33 www.69-1hn7uc.net 163.43.122.119, 49769, 80 SAKURA-BSAKURAInternetIncJP Japan 20->33 35 biztekno.com 151.106.118.75, 49768, 80 PLUSSERVER-ASN1DE Germany 20->35 37 10 other IPs or domains 20->37 45 System process connects to network (likely due to code injection or exploit) 20->45 signatures11 process12 process13 25 conhost.exe 23->25         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.21.65.7
 www.cyrilgraze.com United States
13335 CLOUDFLARENETUS true
198.185.159.144
 ext-sq.squarespace.com United States
53831 SQUARESPACEUS false
151.106.118.75
 biztekno.com Germany
61157 PLUSSERVER-ASN1DE true
163.43.122.119
 www.69-1hn7uc.net Japan 9370 SAKURA-BSAKURAInternetIncJP true
44.227.65.245
 pixie.porkbun.com United States
16509 AMAZON-02US false
78.31.67.91
 cleanxcare.com Germany
24961 MYLOC-ASIPBackboneofmyLocmanagedITAGDE true
192.169.223.13
 centergolosinas.com United States
26496 AS-26496-GO-DADDY-COM-LLCUS true

Contacted Domains

Name IP Active
biztekno.com 151.106.118.75 true
adultpeace.com 163.44.239.73 true
www.69-1hn7uc.net 163.43.122.119 true
www.cyrilgraze.com 104.21.65.7 true
cleanxcare.com 78.31.67.91 true
centergolosinas.com 192.169.223.13 true
pixie.porkbun.com 44.227.65.245 true
ext-sq.squarespace.com 198.185.159.144 true
www.hiddenwholesale.com unknown unknown
www.cleanxcare.com unknown unknown
www.anewdistraction.com unknown unknown
www.biztekno.com unknown unknown
www.centergolosinas.com unknown unknown
www.adultpeace.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.biztekno.com/p2io/?xN6x=IctutJlD1KzdQk/q9eJAOxuhjWEnlD6jXMe1IpO47rzJ4yHlcjfL6JMqKvIaYl5lDyXZ&YluDM=Ofc4YV0pThsp true
  • Avira URL Cloud: safe
 unknown
http://www.cyrilgraze.com/p2io/?xN6x=PONkgH6MO5ViG+zjbj4YyU3gBn/U0y1OFStIgCLmvXYcYHdxqE5/6Lr2O25ts36CozLG&YluDM=Ofc4YV0pThsp true
  • Avira URL Cloud: safe
 unknown
www.adultpeace.com/p2io/ true
  • URL Reputation: safe
  • URL Reputation: safe
  • URL Reputation: safe
 low
http://www.hiddenwholesale.com/p2io/?xN6x=es7Y2j6d/8vbylETtmEK+cycNhd4T49F/A456A8m/a4HPEjAATL8KRpgCeYlIlfO3VWH&YluDM=Ofc4YV0pThsp true
  • Avira URL Cloud: safe
 unknown
http://www.cleanxcare.com/p2io/?xN6x=pxlxKDN0Rvw8YUTnsB4Bv4ohCC0AYWvU81fxb+r9dLiNjjqdMXiyL1Lf04YLJeQ+Gz7y&YluDM=Ofc4YV0pThsp true
  • Avira URL Cloud: safe
 unknown
http://www.anewdistraction.com/p2io/?xN6x=ia0dgIkdnBZILDuo3zp8eo0tNiPxoXJfkPpt6P05AAGh3ZPzSagLTNX+xDwAHOv6iOkY&YluDM=Ofc4YV0pThsp true
  • Avira URL Cloud: safe
 unknown