Analysis Report lTAPQJikGw

Overview

General Information

Sample Name: lTAPQJikGw (renamed file extension from none to exe)
Analysis ID: 432746
MD5: 16657fa097cd334973a5489eeff8bafe
SHA1: b6db5e9cc112155b7285f0a415cf4889ff1bf7ef
SHA256: 2589143d02f6aef252b5b704f6b98723ae131d3279bcf36d57ee26318bc0741f
Tags: exetrojan
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected AntiVM3
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: http://www.cmannouncements.com/p2io/?CFQHg=wzEdtbrCY4VKdG4P/h093gtD2EzP1yO8zPZJPXBkhd23ZEiSfiVlmlbiUjAoERCVF5eV&Pr980v=G2MtWNVHS Avira URL Cloud: Label: malware
Source: http://www.balloon-artists.com/p2io/?CFQHg=/DMwn9vTy70wY8Gt9syYwdBt6sFcRXVvValBDdDX8KtazsYeLKsYeQz2+d78EfQIVSnp&Pr980v=G2MtWNVHS Avira URL Cloud: Label: malware
Source: http://www.boogerstv.com/p2io/?CFQHg=fW2NkW2j278wyrs6d/m+egXTc5dWq8qtohQAL+tQrXSmfdetyJ3HBVVg7gxxicKRFJwM&Pr980v=G2MtWNVHS Avira URL Cloud: Label: malware
Source: http://www.dreamcashbuyers.com/p2io/?CFQHg=H0m9fF/5FM7UqIICC4653EpAABAppk+gPAvqYefbAICNl1a1FFJvvx6E9HTJL6Hcfv3l&Pr980v=G2MtWNVHS Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000000.00000002.658248909.0000000004349000.00000004.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.adultpeace.com/p2io/"], "decoy": ["essentiallyourscandles.com", "cleanxcare.com", "bigplatesmallwallet.com", "iotcloud.technology", "dmgt4m2g8y2uh.net", "malcorinmobiliaria.com", "thriveglucose.com", "fuhaitongxin.com", "magetu.info", "pyithuhluttaw.net", "myfavbutik.com", "xzklrhy.com", "anewdistraction.com", "mercuryaid.net", "thesoulrevitalist.com", "swayam-moj.com", "liminaltechnology.com", "lucytime.com", "alfenas.info", "carmelodesign.com", "newmopeds.com", "cyrilgraze.com", "ruhexuangou.com", "trendbold.com", "centergolosinas.com", "leonardocarrillo.com", "advancedaccessapplications.com", "aideliveryrobot.com", "defenestration.world", "zgcbw.net", "shopihy.com", "3cheer.com", "untylservice.com", "totally-seo.com", "cmannouncements.com", "tpcgzwlpyggm.mobi", "hfjxhs.com", "balloon-artists.com", "vectoroutlines.com", "boogerstv.com", "procircleacademy.com", "tricqr.com", "hazard-protection.com", "buylocalclub.info", "m678.xyz", "hiddenwholesale.com", "ololmychartlogin.com", "redudiban.com", "brunoecatarina.com", "69-1hn7uc.net", "zmzcrossrt.xyz", "dreamcashbuyers.com", "yunlimall.com", "jonathan-mandt.com", "painhut.com", "pandemisorgugirisi-tr.com", "sonderbach.net", "kce0728com.net", "austinpavingcompany.com", "biztekno.com", "rodriggi.com", "micheldrake.com", "foxwaybrasil.com", "a3i7ufz4pt3.net"]}
Multi AV Scanner detection for submitted file
Source: lTAPQJikGw.exe Virustotal: Detection: 44% Perma Link
Source: lTAPQJikGw.exe ReversingLabs: Detection: 43%
Yara detected FormBook
Source: Yara match File source: 00000002.00000002.730022102.0000000001810000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.727807565.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.658248909.0000000004349000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.916418172.0000000000DA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.656408527.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.916260841.0000000000930000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.916447629.0000000000DD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.729969001.00000000017E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 2.0.lTAPQJikGw.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.lTAPQJikGw.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.lTAPQJikGw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.lTAPQJikGw.exe.4349930.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.lTAPQJikGw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Machine Learning detection for sample
Source: lTAPQJikGw.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 2.0.lTAPQJikGw.exe.400000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.2.lTAPQJikGw.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: lTAPQJikGw.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: lTAPQJikGw.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000003.00000000.697776172.0000000005A00000.00000002.00000001.sdmp
Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\xxwqcHkmba\src\obj\Debug\CryptoConfig.pdb source: lTAPQJikGw.exe
Source: Binary string: control.pdb source: lTAPQJikGw.exe, 00000002.00000002.730162331.0000000001970000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: lTAPQJikGw.exe, 00000002.00000002.729531949.00000000015CF000.00000040.00000001.sdmp, control.exe, 00000007.00000002.917101037.0000000004B60000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: lTAPQJikGw.exe, control.exe
Source: Binary string: control.pdbUGP source: lTAPQJikGw.exe, 00000002.00000002.730162331.0000000001970000.00000040.00000001.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 00000003.00000000.697776172.0000000005A00000.00000002.00000001.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_01870448
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_01870751
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_01870760
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 4x nop then pop edi 2_2_00416282
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 4x nop then pop ebx 2_2_00406A94
Source: C:\Windows\SysWOW64\control.exe Code function: 4x nop then pop ebx 7_2_00936A95
Source: C:\Windows\SysWOW64\control.exe Code function: 4x nop then pop edi 7_2_00946282

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49765 -> 74.220.199.8:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49765 -> 74.220.199.8:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49765 -> 74.220.199.8:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49768 -> 199.195.117.147:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49768 -> 199.195.117.147:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49768 -> 199.195.117.147:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49776 -> 104.21.15.16:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49776 -> 104.21.15.16:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49776 -> 104.21.15.16:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.adultpeace.com/p2io/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=/DMwn9vTy70wY8Gt9syYwdBt6sFcRXVvValBDdDX8KtazsYeLKsYeQz2+d78EfQIVSnp&Pr980v=G2MtWNVHS HTTP/1.1Host: www.balloon-artists.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=4oufm6g5t6Bqg3y0mDBWoA8I6Q2bNaX51tGc9mj7mZf0wZ/j7IpC3Y+it5NkyKMHKzCR&Pr980v=G2MtWNVHS HTTP/1.1Host: www.adultpeace.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=wzEdtbrCY4VKdG4P/h093gtD2EzP1yO8zPZJPXBkhd23ZEiSfiVlmlbiUjAoERCVF5eV&Pr980v=G2MtWNVHS HTTP/1.1Host: www.cmannouncements.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=wzEdtbrCY4VKdG4P/h093gtD2EzP1yO8zPZJPXBkhd23ZEiSfiVlmlbiUjAoERCVF5eV&Pr980v=G2MtWNVHS HTTP/1.1Host: www.cmannouncements.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=Z8FkwwkqwMcbR63JqM/eMJCTIQtJD+6S4GLVkEvBdcKRRdmUAPmyd56itTHHstyDZ3vx&Pr980v=G2MtWNVHS HTTP/1.1Host: www.leonardocarrillo.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=H0m9fF/5FM7UqIICC4653EpAABAppk+gPAvqYefbAICNl1a1FFJvvx6E9HTJL6Hcfv3l&Pr980v=G2MtWNVHS HTTP/1.1Host: www.dreamcashbuyers.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=0YkKA47wwnQsSd2I7kPMKR9IRaKfA7HvmAjNs5nkCsbL4/Nj4Thso/t2FfIp2mnBj9Pa&Pr980v=G2MtWNVHS HTTP/1.1Host: www.swayam-moj.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=DTtQlm+bkwamRHt6VrobrkMYYvpq+NlfspH3ROyN3o99G08d4+CoiJMc5PUrO1w4I+TP&Pr980v=G2MtWNVHS HTTP/1.1Host: www.hfjxhs.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=lrOqxb+RJFhwpubsYZ1tkMjkgx31NOkXgmE0j6vPa760pj23uu3lC+ndsaG2+azAf30S&Pr980v=G2MtWNVHS HTTP/1.1Host: www.defenestration.worldConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=fW2NkW2j278wyrs6d/m+egXTc5dWq8qtohQAL+tQrXSmfdetyJ3HBVVg7gxxicKRFJwM&Pr980v=G2MtWNVHS HTTP/1.1Host: www.boogerstv.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=TySV6YYzJGXnavbEwOCoDLKT5SC+Z4HfI/S6WoKTLKp4rrhaLWxPw3pQ7MooJpxvMOcw&Pr980v=G2MtWNVHS HTTP/1.1Host: www.totally-seo.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=pxlxKDN0Rvw8YUTnsB4Bv4ohCC0AYWvU81fxb+r9dLiNjjqdMXiyL1Lf04YLJeQ+Gz7y&Pr980v=G2MtWNVHS HTTP/1.1Host: www.cleanxcare.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 147.255.162.204 147.255.162.204
Source: Joe Sandbox View IP Address: 198.185.159.144 198.185.159.144
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: LEASEWEB-USA-SFO-12US LEASEWEB-USA-SFO-12US
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=/DMwn9vTy70wY8Gt9syYwdBt6sFcRXVvValBDdDX8KtazsYeLKsYeQz2+d78EfQIVSnp&Pr980v=G2MtWNVHS HTTP/1.1Host: www.balloon-artists.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=4oufm6g5t6Bqg3y0mDBWoA8I6Q2bNaX51tGc9mj7mZf0wZ/j7IpC3Y+it5NkyKMHKzCR&Pr980v=G2MtWNVHS HTTP/1.1Host: www.adultpeace.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=wzEdtbrCY4VKdG4P/h093gtD2EzP1yO8zPZJPXBkhd23ZEiSfiVlmlbiUjAoERCVF5eV&Pr980v=G2MtWNVHS HTTP/1.1Host: www.cmannouncements.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=wzEdtbrCY4VKdG4P/h093gtD2EzP1yO8zPZJPXBkhd23ZEiSfiVlmlbiUjAoERCVF5eV&Pr980v=G2MtWNVHS HTTP/1.1Host: www.cmannouncements.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=Z8FkwwkqwMcbR63JqM/eMJCTIQtJD+6S4GLVkEvBdcKRRdmUAPmyd56itTHHstyDZ3vx&Pr980v=G2MtWNVHS HTTP/1.1Host: www.leonardocarrillo.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=H0m9fF/5FM7UqIICC4653EpAABAppk+gPAvqYefbAICNl1a1FFJvvx6E9HTJL6Hcfv3l&Pr980v=G2MtWNVHS HTTP/1.1Host: www.dreamcashbuyers.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=0YkKA47wwnQsSd2I7kPMKR9IRaKfA7HvmAjNs5nkCsbL4/Nj4Thso/t2FfIp2mnBj9Pa&Pr980v=G2MtWNVHS HTTP/1.1Host: www.swayam-moj.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=DTtQlm+bkwamRHt6VrobrkMYYvpq+NlfspH3ROyN3o99G08d4+CoiJMc5PUrO1w4I+TP&Pr980v=G2MtWNVHS HTTP/1.1Host: www.hfjxhs.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=lrOqxb+RJFhwpubsYZ1tkMjkgx31NOkXgmE0j6vPa760pj23uu3lC+ndsaG2+azAf30S&Pr980v=G2MtWNVHS HTTP/1.1Host: www.defenestration.worldConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=fW2NkW2j278wyrs6d/m+egXTc5dWq8qtohQAL+tQrXSmfdetyJ3HBVVg7gxxicKRFJwM&Pr980v=G2MtWNVHS HTTP/1.1Host: www.boogerstv.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=TySV6YYzJGXnavbEwOCoDLKT5SC+Z4HfI/S6WoKTLKp4rrhaLWxPw3pQ7MooJpxvMOcw&Pr980v=G2MtWNVHS HTTP/1.1Host: www.totally-seo.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /p2io/?CFQHg=pxlxKDN0Rvw8YUTnsB4Bv4ohCC0AYWvU81fxb+r9dLiNjjqdMXiyL1Lf04YLJeQ+Gz7y&Pr980v=G2MtWNVHS HTTP/1.1Host: www.cleanxcare.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.balloon-artists.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Jun 2021 16:08:23 GMTServer: Apache/2.4.48 (cPanel) OpenSSL/1.1.1k mod_bwlimited/1.4Content-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: lTAPQJikGw.exe, 00000000.00000002.657793972.0000000003341000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 00000003.00000000.688234599.0000000002B50000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000003.00000000.678260797.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: lTAPQJikGw.exe, 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: control.exe, 00000007.00000002.917583197.0000000005212000.00000004.00000001.sdmp String found in binary or memory: https://www.cleanxcare.com/p2io/?CFQHg=pxlxKDN0Rvw8YUTnsB4Bv4ohCC0AYWvU81fxb

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000002.00000002.730022102.0000000001810000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.727807565.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.658248909.0000000004349000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.916418172.0000000000DA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.656408527.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.916260841.0000000000930000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.916447629.0000000000DD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.729969001.00000000017E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 2.0.lTAPQJikGw.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.lTAPQJikGw.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.lTAPQJikGw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.lTAPQJikGw.exe.4349930.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.lTAPQJikGw.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000002.00000002.730022102.0000000001810000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.730022102.0000000001810000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.727807565.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.727807565.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.658248909.0000000004349000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.658248909.0000000004349000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.916418172.0000000000DA0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.916418172.0000000000DA0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000000.656408527.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000000.656408527.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.916260841.0000000000930000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.916260841.0000000000930000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.916447629.0000000000DD0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.916447629.0000000000DD0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.729969001.00000000017E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.729969001.00000000017E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.0.lTAPQJikGw.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.lTAPQJikGw.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.0.lTAPQJikGw.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.lTAPQJikGw.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.lTAPQJikGw.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.lTAPQJikGw.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.lTAPQJikGw.exe.4349930.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.lTAPQJikGw.exe.4349930.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.lTAPQJikGw.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.lTAPQJikGw.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Contains functionality to call native functions
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_004181B0 NtCreateFile, 2_2_004181B0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_00418260 NtReadFile, 2_2_00418260
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_004182E0 NtClose, 2_2_004182E0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_00418390 NtAllocateVirtualMemory, 2_2_00418390
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_004182AC NtReadFile, 2_2_004182AC
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0041838B NtAllocateVirtualMemory, 2_2_0041838B
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519910 NtAdjustPrivilegesToken,LdrInitializeThunk, 2_2_01519910
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015199A0 NtCreateSection,LdrInitializeThunk, 2_2_015199A0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519840 NtDelayExecution,LdrInitializeThunk, 2_2_01519840
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519860 NtQuerySystemInformation,LdrInitializeThunk, 2_2_01519860
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015198F0 NtReadVirtualMemory,LdrInitializeThunk, 2_2_015198F0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519A50 NtCreateFile,LdrInitializeThunk, 2_2_01519A50
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519A00 NtProtectVirtualMemory,LdrInitializeThunk, 2_2_01519A00
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519A20 NtResumeThread,LdrInitializeThunk, 2_2_01519A20
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519540 NtReadFile,LdrInitializeThunk, 2_2_01519540
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015195D0 NtClose,LdrInitializeThunk, 2_2_015195D0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519710 NtQueryInformationToken,LdrInitializeThunk, 2_2_01519710
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519FE0 NtCreateMutant,LdrInitializeThunk, 2_2_01519FE0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519780 NtMapViewOfSection,LdrInitializeThunk, 2_2_01519780
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015197A0 NtUnmapViewOfSection,LdrInitializeThunk, 2_2_015197A0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519660 NtAllocateVirtualMemory,LdrInitializeThunk, 2_2_01519660
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015196E0 NtFreeVirtualMemory,LdrInitializeThunk, 2_2_015196E0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519950 NtQueueApcThread, 2_2_01519950
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015199D0 NtCreateProcessEx, 2_2_015199D0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0151B040 NtSuspendThread, 2_2_0151B040
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519820 NtEnumerateKey, 2_2_01519820
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015198A0 NtWriteVirtualMemory, 2_2_015198A0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519B00 NtSetValueKey, 2_2_01519B00
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0151A3B0 NtGetContextThread, 2_2_0151A3B0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519A10 NtQuerySection, 2_2_01519A10
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519A80 NtOpenDirectoryObject, 2_2_01519A80
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519560 NtWriteFile, 2_2_01519560
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0151AD30 NtSetContextThread, 2_2_0151AD30
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519520 NtWaitForSingleObject, 2_2_01519520
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015195F0 NtQueryInformationFile, 2_2_015195F0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0151A770 NtOpenThread, 2_2_0151A770
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519770 NtSetInformationFile, 2_2_01519770
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519760 NtOpenProcess, 2_2_01519760
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0151A710 NtOpenProcessToken, 2_2_0151A710
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519730 NtQueryVirtualMemory, 2_2_01519730
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519650 NtQueryValueKey, 2_2_01519650
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519670 NtQueryInformationProcess, 2_2_01519670
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01519610 NtEnumerateValueKey, 2_2_01519610
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015196D0 NtCreateKey, 2_2_015196D0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9860 NtQuerySystemInformation,LdrInitializeThunk, 7_2_04BC9860
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9840 NtDelayExecution,LdrInitializeThunk, 7_2_04BC9840
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC99A0 NtCreateSection,LdrInitializeThunk, 7_2_04BC99A0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC95D0 NtClose,LdrInitializeThunk, 7_2_04BC95D0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 7_2_04BC9910
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9540 NtReadFile,LdrInitializeThunk, 7_2_04BC9540
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC96E0 NtFreeVirtualMemory,LdrInitializeThunk, 7_2_04BC96E0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC96D0 NtCreateKey,LdrInitializeThunk, 7_2_04BC96D0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9660 NtAllocateVirtualMemory,LdrInitializeThunk, 7_2_04BC9660
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9A50 NtCreateFile,LdrInitializeThunk, 7_2_04BC9A50
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9650 NtQueryValueKey,LdrInitializeThunk, 7_2_04BC9650
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9780 NtMapViewOfSection,LdrInitializeThunk, 7_2_04BC9780
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9FE0 NtCreateMutant,LdrInitializeThunk, 7_2_04BC9FE0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9710 NtQueryInformationToken,LdrInitializeThunk, 7_2_04BC9710
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC98A0 NtWriteVirtualMemory, 7_2_04BC98A0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC98F0 NtReadVirtualMemory, 7_2_04BC98F0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9820 NtEnumerateKey, 7_2_04BC9820
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BCB040 NtSuspendThread, 7_2_04BCB040
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC95F0 NtQueryInformationFile, 7_2_04BC95F0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC99D0 NtCreateProcessEx, 7_2_04BC99D0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BCAD30 NtSetContextThread, 7_2_04BCAD30
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9520 NtWaitForSingleObject, 7_2_04BC9520
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9560 NtWriteFile, 7_2_04BC9560
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9950 NtQueueApcThread, 7_2_04BC9950
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9A80 NtOpenDirectoryObject, 7_2_04BC9A80
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9A20 NtResumeThread, 7_2_04BC9A20
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9610 NtEnumerateValueKey, 7_2_04BC9610
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9A10 NtQuerySection, 7_2_04BC9A10
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9A00 NtProtectVirtualMemory, 7_2_04BC9A00
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9670 NtQueryInformationProcess, 7_2_04BC9670
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BCA3B0 NtGetContextThread, 7_2_04BCA3B0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC97A0 NtUnmapViewOfSection, 7_2_04BC97A0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9730 NtQueryVirtualMemory, 7_2_04BC9730
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BCA710 NtOpenProcessToken, 7_2_04BCA710
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9B00 NtSetValueKey, 7_2_04BC9B00
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9770 NtSetInformationFile, 7_2_04BC9770
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BCA770 NtOpenThread, 7_2_04BCA770
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC9760 NtOpenProcess, 7_2_04BC9760
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_009481B0 NtCreateFile, 7_2_009481B0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_009482E0 NtClose, 7_2_009482E0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_00948260 NtReadFile, 7_2_00948260
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_00948390 NtAllocateVirtualMemory, 7_2_00948390
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_009482AC NtReadFile, 7_2_009482AC
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_0094838B NtAllocateVirtualMemory, 7_2_0094838B
Detected potential crypto function
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 0_2_00ECB7D5 0_2_00ECB7D5
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 0_2_01870D80 0_2_01870D80
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 0_2_01B3B264 0_2_01B3B264
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 0_2_01B3DF50 0_2_01B3DF50
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 0_2_01B3C2B0 0_2_01B3C2B0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 0_2_01B39990 0_2_01B39990
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 0_2_0581D0C0 0_2_0581D0C0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 0_2_05812160 0_2_05812160
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 0_2_05812170 0_2_05812170
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 0_2_0581D0B0 0_2_0581D0B0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 0_2_058123B1 0_2_058123B1
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 0_2_058123C0 0_2_058123C0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 0_2_00ECC915 0_2_00ECC915
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_00401030 2_2_00401030
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0041B8B1 2_2_0041B8B1
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0041B963 2_2_0041B963
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_00408C4B 2_2_00408C4B
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_00408C50 2_2_00408C50
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0041B493 2_2_0041B493
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0041B496 2_2_0041B496
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0041C539 2_2_0041C539
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_00402D89 2_2_00402D89
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_00402D90 2_2_00402D90
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0041CE85 2_2_0041CE85
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0041BF12 2_2_0041BF12
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0041C795 2_2_0041C795
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_00402FB0 2_2_00402FB0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_00A5B7D5 2_2_00A5B7D5
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014DF900 2_2_014DF900
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014F4120 2_2_014F4120
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01591002 2_2_01591002
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015AE824 2_2_015AE824
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A28EC 2_2_015A28EC
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014EB090 2_2_014EB090
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015020A0 2_2_015020A0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A20A8 2_2_015A20A8
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FAB40 2_2_014FAB40
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A2B28 2_2_015A2B28
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015903DA 2_2_015903DA
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0159DBD2 2_2_0159DBD2
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150EBB0 2_2_0150EBB0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0158FA2B 2_2_0158FA2B
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A22AE 2_2_015A22AE
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A1D55 2_2_015A1D55
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A2D07 2_2_015A2D07
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D0D20 2_2_014D0D20
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A25DD 2_2_015A25DD
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014ED5E0 2_2_014ED5E0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01502581 2_2_01502581
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0159D466 2_2_0159D466
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E841F 2_2_014E841F
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015ADFCE 2_2_015ADFCE
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A1FF1 2_2_015A1FF1
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0159D616 2_2_0159D616
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014F6E30 2_2_014F6E30
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A2EF7 2_2_015A2EF7
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_00A5C915 2_2_00A5C915
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB20A0 7_2_04BB20A0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B9B090 7_2_04B9B090
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C520A8 7_2_04C520A8
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B9841F 7_2_04B9841F
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C41002 7_2_04C41002
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB2581 7_2_04BB2581
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B9D5E0 7_2_04B9D5E0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C51D55 7_2_04C51D55
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B80D20 7_2_04B80D20
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BA4120 7_2_04BA4120
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B8F900 7_2_04B8F900
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C52D07 7_2_04C52D07
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C52EF7 7_2_04C52EF7
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C522AE 7_2_04C522AE
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BA6E30 7_2_04BA6E30
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BBEBB0 7_2_04BBEBB0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C51FF1 7_2_04C51FF1
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C52B28 7_2_04C52B28
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_0094B8B1 7_2_0094B8B1
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_0094B954 7_2_0094B954
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_0094B496 7_2_0094B496
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_0094B493 7_2_0094B493
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_00938C50 7_2_00938C50
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_00938C4B 7_2_00938C4B
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_00932D90 7_2_00932D90
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_00932D89 7_2_00932D89
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_0094C539 7_2_0094C539
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_0094CE85 7_2_0094CE85
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_0094C795 7_2_0094C795
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_00932FB0 7_2_00932FB0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_0094BF12 7_2_0094BF12
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\control.exe Code function: String function: 04B8B150 appears 35 times
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: String function: 014DB150 appears 48 times
PE file contains strange resources
Source: lTAPQJikGw.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: lTAPQJikGw.exe Binary or memory string: OriginalFilename vs lTAPQJikGw.exe
Source: lTAPQJikGw.exe, 00000000.00000002.658248909.0000000004349000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameKygo.dll* vs lTAPQJikGw.exe
Source: lTAPQJikGw.exe, 00000000.00000002.658248909.0000000004349000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameDSASignature.dll@ vs lTAPQJikGw.exe
Source: lTAPQJikGw.exe, 00000000.00000002.656995303.0000000000EC2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameCryptoConfig.exeH vs lTAPQJikGw.exe
Source: lTAPQJikGw.exe Binary or memory string: OriginalFilename vs lTAPQJikGw.exe
Source: lTAPQJikGw.exe, 00000002.00000000.656432676.0000000000A52000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameCryptoConfig.exeH vs lTAPQJikGw.exe
Source: lTAPQJikGw.exe, 00000002.00000002.729531949.00000000015CF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs lTAPQJikGw.exe
Source: lTAPQJikGw.exe, 00000002.00000002.730181194.0000000001975000.00000040.00000001.sdmp Binary or memory string: OriginalFilenameCONTROL.EXEj% vs lTAPQJikGw.exe
Source: lTAPQJikGw.exe Binary or memory string: OriginalFilenameCryptoConfig.exeH vs lTAPQJikGw.exe
Uses 32bit PE files
Source: lTAPQJikGw.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 00000002.00000002.730022102.0000000001810000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.730022102.0000000001810000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.727807565.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.727807565.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.658248909.0000000004349000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.658248909.0000000004349000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.916418172.0000000000DA0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.916418172.0000000000DA0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000000.656408527.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000000.656408527.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.916260841.0000000000930000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.916260841.0000000000930000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.916447629.0000000000DD0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.916447629.0000000000DD0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.729969001.00000000017E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.729969001.00000000017E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.0.lTAPQJikGw.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.lTAPQJikGw.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.0.lTAPQJikGw.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.lTAPQJikGw.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.lTAPQJikGw.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.lTAPQJikGw.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.lTAPQJikGw.exe.4349930.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.lTAPQJikGw.exe.4349930.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.lTAPQJikGw.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.lTAPQJikGw.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: lTAPQJikGw.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.troj.evad.winEXE@8/1@12/11
Source: C:\Users\user\Desktop\lTAPQJikGw.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lTAPQJikGw.exe.log Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6936:120:WilError_01
Source: lTAPQJikGw.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: lTAPQJikGw.exe, 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: lTAPQJikGw.exe, 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: lTAPQJikGw.exe, 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: lTAPQJikGw.exe, 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: lTAPQJikGw.exe, 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: lTAPQJikGw.exe, 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: lTAPQJikGw.exe, 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: lTAPQJikGw.exe, 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: lTAPQJikGw.exe, 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType*Erro ao listar Banco sql-SecurityLogonType,Select * from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)
Source: lTAPQJikGw.exe Virustotal: Detection: 44%
Source: lTAPQJikGw.exe ReversingLabs: Detection: 43%
Source: unknown Process created: C:\Users\user\Desktop\lTAPQJikGw.exe 'C:\Users\user\Desktop\lTAPQJikGw.exe'
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process created: C:\Users\user\Desktop\lTAPQJikGw.exe C:\Users\user\Desktop\lTAPQJikGw.exe
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process created: C:\Windows\SysWOW64\control.exe C:\Windows\SysWOW64\control.exe
Source: C:\Windows\SysWOW64\control.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\lTAPQJikGw.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process created: C:\Users\user\Desktop\lTAPQJikGw.exe C:\Users\user\Desktop\lTAPQJikGw.exe Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process created: C:\Windows\SysWOW64\control.exe C:\Windows\SysWOW64\control.exe Jump to behavior
Source: C:\Windows\SysWOW64\control.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\lTAPQJikGw.exe' Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: lTAPQJikGw.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: lTAPQJikGw.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: lTAPQJikGw.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000003.00000000.697776172.0000000005A00000.00000002.00000001.sdmp
Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\xxwqcHkmba\src\obj\Debug\CryptoConfig.pdb source: lTAPQJikGw.exe
Source: Binary string: control.pdb source: lTAPQJikGw.exe, 00000002.00000002.730162331.0000000001970000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: lTAPQJikGw.exe, 00000002.00000002.729531949.00000000015CF000.00000040.00000001.sdmp, control.exe, 00000007.00000002.917101037.0000000004B60000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: lTAPQJikGw.exe, control.exe
Source: Binary string: control.pdbUGP source: lTAPQJikGw.exe, 00000002.00000002.730162331.0000000001970000.00000040.00000001.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 00000003.00000000.697776172.0000000005A00000.00000002.00000001.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 0_2_00EC5A3D push es; retf 0000h 0_2_00EC5CE2
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0041B2A2 push cs; ret 2_2_0041B2A3
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0041B3F2 push eax; ret 2_2_0041B3F8
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0041B3FB push eax; ret 2_2_0041B462
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0041B3A5 push eax; ret 2_2_0041B3F8
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0041B45C push eax; ret 2_2_0041B462
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_00415414 push esp; ret 2_2_00415416
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_00414F46 push cs; ret 2_2_00414F47
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0041BF12 push dword ptr [8427D5C5h]; ret 2_2_0041C1FF
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_00415FC5 push ebp; ret 2_2_00415FC6
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_00A55A3D push es; retf 0000h 2_2_00A55CE2
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0152D0D1 push ecx; ret 2_2_0152D0E4
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BDD0D1 push ecx; ret 7_2_04BDD0E4
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_0094B2A2 push cs; ret 7_2_0094B2A3
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_0094B3A5 push eax; ret 7_2_0094B3F8
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_0094B3F2 push eax; ret 7_2_0094B3F8
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_0094B3FB push eax; ret 7_2_0094B462
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_00945414 push esp; ret 7_2_00945416
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_0094B45C push eax; ret 7_2_0094B462
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_00945FC5 push ebp; ret 7_2_00945FC6
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_0094BF12 push dword ptr [8427D5C5h]; ret 7_2_0094C1FF
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_00944F46 push cs; ret 7_2_00944F47
Source: initial sample Static PE information: section name: .text entropy: 7.73125493594
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\control.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: lTAPQJikGw.exe PID: 7056, type: MEMORY
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: lTAPQJikGw.exe, 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: lTAPQJikGw.exe, 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\lTAPQJikGw.exe RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\lTAPQJikGw.exe RDTSC instruction interceptor: First address: 000000000040896E second address: 0000000000408974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\control.exe RDTSC instruction interceptor: First address: 00000000009385E4 second address: 00000000009385EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\control.exe RDTSC instruction interceptor: First address: 000000000093896E second address: 0000000000938974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_004088A0 rdtsc 2_2_004088A0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\lTAPQJikGw.exe TID: 7060 Thread sleep time: -99171s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe TID: 7092 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 6088 Thread sleep time: -50000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\control.exe TID: 6800 Thread sleep time: -48000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\control.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\control.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Thread delayed: delay time: 99171 Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 00000003.00000000.676441692.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.697628647.00000000058C0000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: lTAPQJikGw.exe, 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp Binary or memory string: vmware
Source: lTAPQJikGw.exe, 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: lTAPQJikGw.exe, 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000003.00000000.697993865.0000000006650000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.676441692.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: lTAPQJikGw.exe, 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: lTAPQJikGw.exe, 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: explorer.exe, 00000003.00000000.677401262.000000000A9A0000.00000004.00000001.sdmp Binary or memory string: War&Prod_VMware_SATA#
Source: lTAPQJikGw.exe, 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000003.00000000.695466749.0000000004710000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000003.00000000.676552486.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000003.00000000.697628647.00000000058C0000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000003.00000000.697628647.00000000058C0000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: lTAPQJikGw.exe, 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: lTAPQJikGw.exe, 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: explorer.exe, 00000003.00000000.676624021.000000000A784000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: lTAPQJikGw.exe, 00000000.00000002.657825890.0000000003382000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 00000003.00000000.677443197.000000000A9E1000.00000004.00000001.sdmp Binary or memory string: _VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Vir
Source: explorer.exe, 00000003.00000000.697628647.00000000058C0000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\control.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_004088A0 rdtsc 2_2_004088A0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_00409B10 LdrLoadDll, 2_2_00409B10
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FB944 mov eax, dword ptr fs:[00000030h] 2_2_014FB944
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FB944 mov eax, dword ptr fs:[00000030h] 2_2_014FB944
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014DC962 mov eax, dword ptr fs:[00000030h] 2_2_014DC962
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014DB171 mov eax, dword ptr fs:[00000030h] 2_2_014DB171
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014DB171 mov eax, dword ptr fs:[00000030h] 2_2_014DB171
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D9100 mov eax, dword ptr fs:[00000030h] 2_2_014D9100
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D9100 mov eax, dword ptr fs:[00000030h] 2_2_014D9100
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D9100 mov eax, dword ptr fs:[00000030h] 2_2_014D9100
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150513A mov eax, dword ptr fs:[00000030h] 2_2_0150513A
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150513A mov eax, dword ptr fs:[00000030h] 2_2_0150513A
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014F4120 mov eax, dword ptr fs:[00000030h] 2_2_014F4120
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014F4120 mov eax, dword ptr fs:[00000030h] 2_2_014F4120
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014F4120 mov eax, dword ptr fs:[00000030h] 2_2_014F4120
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014F4120 mov eax, dword ptr fs:[00000030h] 2_2_014F4120
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014F4120 mov ecx, dword ptr fs:[00000030h] 2_2_014F4120
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014DB1E1 mov eax, dword ptr fs:[00000030h] 2_2_014DB1E1
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014DB1E1 mov eax, dword ptr fs:[00000030h] 2_2_014DB1E1
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014DB1E1 mov eax, dword ptr fs:[00000030h] 2_2_014DB1E1
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015641E8 mov eax, dword ptr fs:[00000030h] 2_2_015641E8
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01502990 mov eax, dword ptr fs:[00000030h] 2_2_01502990
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FC182 mov eax, dword ptr fs:[00000030h] 2_2_014FC182
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150A185 mov eax, dword ptr fs:[00000030h] 2_2_0150A185
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015551BE mov eax, dword ptr fs:[00000030h] 2_2_015551BE
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015551BE mov eax, dword ptr fs:[00000030h] 2_2_015551BE
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015551BE mov eax, dword ptr fs:[00000030h] 2_2_015551BE
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015551BE mov eax, dword ptr fs:[00000030h] 2_2_015551BE
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015061A0 mov eax, dword ptr fs:[00000030h] 2_2_015061A0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015061A0 mov eax, dword ptr fs:[00000030h] 2_2_015061A0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015569A6 mov eax, dword ptr fs:[00000030h] 2_2_015569A6
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015949A4 mov eax, dword ptr fs:[00000030h] 2_2_015949A4
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015949A4 mov eax, dword ptr fs:[00000030h] 2_2_015949A4
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015949A4 mov eax, dword ptr fs:[00000030h] 2_2_015949A4
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015949A4 mov eax, dword ptr fs:[00000030h] 2_2_015949A4
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014F0050 mov eax, dword ptr fs:[00000030h] 2_2_014F0050
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014F0050 mov eax, dword ptr fs:[00000030h] 2_2_014F0050
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01592073 mov eax, dword ptr fs:[00000030h] 2_2_01592073
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A1074 mov eax, dword ptr fs:[00000030h] 2_2_015A1074
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01557016 mov eax, dword ptr fs:[00000030h] 2_2_01557016
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01557016 mov eax, dword ptr fs:[00000030h] 2_2_01557016
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01557016 mov eax, dword ptr fs:[00000030h] 2_2_01557016
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A4015 mov eax, dword ptr fs:[00000030h] 2_2_015A4015
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A4015 mov eax, dword ptr fs:[00000030h] 2_2_015A4015
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014EB02A mov eax, dword ptr fs:[00000030h] 2_2_014EB02A
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014EB02A mov eax, dword ptr fs:[00000030h] 2_2_014EB02A
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014EB02A mov eax, dword ptr fs:[00000030h] 2_2_014EB02A
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014EB02A mov eax, dword ptr fs:[00000030h] 2_2_014EB02A
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150002D mov eax, dword ptr fs:[00000030h] 2_2_0150002D
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150002D mov eax, dword ptr fs:[00000030h] 2_2_0150002D
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150002D mov eax, dword ptr fs:[00000030h] 2_2_0150002D
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150002D mov eax, dword ptr fs:[00000030h] 2_2_0150002D
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150002D mov eax, dword ptr fs:[00000030h] 2_2_0150002D
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0156B8D0 mov eax, dword ptr fs:[00000030h] 2_2_0156B8D0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0156B8D0 mov ecx, dword ptr fs:[00000030h] 2_2_0156B8D0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0156B8D0 mov eax, dword ptr fs:[00000030h] 2_2_0156B8D0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0156B8D0 mov eax, dword ptr fs:[00000030h] 2_2_0156B8D0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0156B8D0 mov eax, dword ptr fs:[00000030h] 2_2_0156B8D0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0156B8D0 mov eax, dword ptr fs:[00000030h] 2_2_0156B8D0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D58EC mov eax, dword ptr fs:[00000030h] 2_2_014D58EC
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D40E1 mov eax, dword ptr fs:[00000030h] 2_2_014D40E1
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D40E1 mov eax, dword ptr fs:[00000030h] 2_2_014D40E1
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D40E1 mov eax, dword ptr fs:[00000030h] 2_2_014D40E1
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D9080 mov eax, dword ptr fs:[00000030h] 2_2_014D9080
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01553884 mov eax, dword ptr fs:[00000030h] 2_2_01553884
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01553884 mov eax, dword ptr fs:[00000030h] 2_2_01553884
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150F0BF mov ecx, dword ptr fs:[00000030h] 2_2_0150F0BF
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150F0BF mov eax, dword ptr fs:[00000030h] 2_2_0150F0BF
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150F0BF mov eax, dword ptr fs:[00000030h] 2_2_0150F0BF
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015020A0 mov eax, dword ptr fs:[00000030h] 2_2_015020A0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015020A0 mov eax, dword ptr fs:[00000030h] 2_2_015020A0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015020A0 mov eax, dword ptr fs:[00000030h] 2_2_015020A0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015020A0 mov eax, dword ptr fs:[00000030h] 2_2_015020A0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015020A0 mov eax, dword ptr fs:[00000030h] 2_2_015020A0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015020A0 mov eax, dword ptr fs:[00000030h] 2_2_015020A0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015190AF mov eax, dword ptr fs:[00000030h] 2_2_015190AF
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A8B58 mov eax, dword ptr fs:[00000030h] 2_2_015A8B58
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014DDB40 mov eax, dword ptr fs:[00000030h] 2_2_014DDB40
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014DF358 mov eax, dword ptr fs:[00000030h] 2_2_014DF358
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01503B7A mov eax, dword ptr fs:[00000030h] 2_2_01503B7A
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01503B7A mov eax, dword ptr fs:[00000030h] 2_2_01503B7A
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014DDB60 mov ecx, dword ptr fs:[00000030h] 2_2_014DDB60
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0159131B mov eax, dword ptr fs:[00000030h] 2_2_0159131B
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015553CA mov eax, dword ptr fs:[00000030h] 2_2_015553CA
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015553CA mov eax, dword ptr fs:[00000030h] 2_2_015553CA
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FDBE9 mov eax, dword ptr fs:[00000030h] 2_2_014FDBE9
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015003E2 mov eax, dword ptr fs:[00000030h] 2_2_015003E2
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015003E2 mov eax, dword ptr fs:[00000030h] 2_2_015003E2
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015003E2 mov eax, dword ptr fs:[00000030h] 2_2_015003E2
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015003E2 mov eax, dword ptr fs:[00000030h] 2_2_015003E2
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015003E2 mov eax, dword ptr fs:[00000030h] 2_2_015003E2
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015003E2 mov eax, dword ptr fs:[00000030h] 2_2_015003E2
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150B390 mov eax, dword ptr fs:[00000030h] 2_2_0150B390
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E1B8F mov eax, dword ptr fs:[00000030h] 2_2_014E1B8F
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E1B8F mov eax, dword ptr fs:[00000030h] 2_2_014E1B8F
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01502397 mov eax, dword ptr fs:[00000030h] 2_2_01502397
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0159138A mov eax, dword ptr fs:[00000030h] 2_2_0159138A
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0158D380 mov ecx, dword ptr fs:[00000030h] 2_2_0158D380
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01504BAD mov eax, dword ptr fs:[00000030h] 2_2_01504BAD
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01504BAD mov eax, dword ptr fs:[00000030h] 2_2_01504BAD
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01504BAD mov eax, dword ptr fs:[00000030h] 2_2_01504BAD
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A5BA5 mov eax, dword ptr fs:[00000030h] 2_2_015A5BA5
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01564257 mov eax, dword ptr fs:[00000030h] 2_2_01564257
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0159EA55 mov eax, dword ptr fs:[00000030h] 2_2_0159EA55
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D9240 mov eax, dword ptr fs:[00000030h] 2_2_014D9240
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D9240 mov eax, dword ptr fs:[00000030h] 2_2_014D9240
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D9240 mov eax, dword ptr fs:[00000030h] 2_2_014D9240
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D9240 mov eax, dword ptr fs:[00000030h] 2_2_014D9240
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0151927A mov eax, dword ptr fs:[00000030h] 2_2_0151927A
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0158B260 mov eax, dword ptr fs:[00000030h] 2_2_0158B260
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0158B260 mov eax, dword ptr fs:[00000030h] 2_2_0158B260
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A8A62 mov eax, dword ptr fs:[00000030h] 2_2_015A8A62
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E8A0A mov eax, dword ptr fs:[00000030h] 2_2_014E8A0A
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0159AA16 mov eax, dword ptr fs:[00000030h] 2_2_0159AA16
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0159AA16 mov eax, dword ptr fs:[00000030h] 2_2_0159AA16
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014F3A1C mov eax, dword ptr fs:[00000030h] 2_2_014F3A1C
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014DAA16 mov eax, dword ptr fs:[00000030h] 2_2_014DAA16
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014DAA16 mov eax, dword ptr fs:[00000030h] 2_2_014DAA16
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D5210 mov eax, dword ptr fs:[00000030h] 2_2_014D5210
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D5210 mov ecx, dword ptr fs:[00000030h] 2_2_014D5210
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D5210 mov eax, dword ptr fs:[00000030h] 2_2_014D5210
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D5210 mov eax, dword ptr fs:[00000030h] 2_2_014D5210
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FA229 mov eax, dword ptr fs:[00000030h] 2_2_014FA229
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FA229 mov eax, dword ptr fs:[00000030h] 2_2_014FA229
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FA229 mov eax, dword ptr fs:[00000030h] 2_2_014FA229
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FA229 mov eax, dword ptr fs:[00000030h] 2_2_014FA229
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FA229 mov eax, dword ptr fs:[00000030h] 2_2_014FA229
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FA229 mov eax, dword ptr fs:[00000030h] 2_2_014FA229
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FA229 mov eax, dword ptr fs:[00000030h] 2_2_014FA229
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FA229 mov eax, dword ptr fs:[00000030h] 2_2_014FA229
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FA229 mov eax, dword ptr fs:[00000030h] 2_2_014FA229
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01514A2C mov eax, dword ptr fs:[00000030h] 2_2_01514A2C
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01514A2C mov eax, dword ptr fs:[00000030h] 2_2_01514A2C
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01502ACB mov eax, dword ptr fs:[00000030h] 2_2_01502ACB
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01502AE4 mov eax, dword ptr fs:[00000030h] 2_2_01502AE4
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150D294 mov eax, dword ptr fs:[00000030h] 2_2_0150D294
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150D294 mov eax, dword ptr fs:[00000030h] 2_2_0150D294
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150FAB0 mov eax, dword ptr fs:[00000030h] 2_2_0150FAB0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D52A5 mov eax, dword ptr fs:[00000030h] 2_2_014D52A5
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D52A5 mov eax, dword ptr fs:[00000030h] 2_2_014D52A5
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D52A5 mov eax, dword ptr fs:[00000030h] 2_2_014D52A5
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D52A5 mov eax, dword ptr fs:[00000030h] 2_2_014D52A5
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D52A5 mov eax, dword ptr fs:[00000030h] 2_2_014D52A5
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014EAAB0 mov eax, dword ptr fs:[00000030h] 2_2_014EAAB0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014EAAB0 mov eax, dword ptr fs:[00000030h] 2_2_014EAAB0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01513D43 mov eax, dword ptr fs:[00000030h] 2_2_01513D43
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01553540 mov eax, dword ptr fs:[00000030h] 2_2_01553540
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01583D40 mov eax, dword ptr fs:[00000030h] 2_2_01583D40
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014F7D50 mov eax, dword ptr fs:[00000030h] 2_2_014F7D50
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FC577 mov eax, dword ptr fs:[00000030h] 2_2_014FC577
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FC577 mov eax, dword ptr fs:[00000030h] 2_2_014FC577
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0159E539 mov eax, dword ptr fs:[00000030h] 2_2_0159E539
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0155A537 mov eax, dword ptr fs:[00000030h] 2_2_0155A537
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01504D3B mov eax, dword ptr fs:[00000030h] 2_2_01504D3B
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01504D3B mov eax, dword ptr fs:[00000030h] 2_2_01504D3B
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01504D3B mov eax, dword ptr fs:[00000030h] 2_2_01504D3B
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A8D34 mov eax, dword ptr fs:[00000030h] 2_2_015A8D34
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E3D34 mov eax, dword ptr fs:[00000030h] 2_2_014E3D34
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E3D34 mov eax, dword ptr fs:[00000030h] 2_2_014E3D34
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E3D34 mov eax, dword ptr fs:[00000030h] 2_2_014E3D34
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E3D34 mov eax, dword ptr fs:[00000030h] 2_2_014E3D34
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E3D34 mov eax, dword ptr fs:[00000030h] 2_2_014E3D34
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E3D34 mov eax, dword ptr fs:[00000030h] 2_2_014E3D34
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E3D34 mov eax, dword ptr fs:[00000030h] 2_2_014E3D34
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E3D34 mov eax, dword ptr fs:[00000030h] 2_2_014E3D34
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E3D34 mov eax, dword ptr fs:[00000030h] 2_2_014E3D34
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E3D34 mov eax, dword ptr fs:[00000030h] 2_2_014E3D34
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E3D34 mov eax, dword ptr fs:[00000030h] 2_2_014E3D34
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E3D34 mov eax, dword ptr fs:[00000030h] 2_2_014E3D34
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E3D34 mov eax, dword ptr fs:[00000030h] 2_2_014E3D34
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014DAD30 mov eax, dword ptr fs:[00000030h] 2_2_014DAD30
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01556DC9 mov eax, dword ptr fs:[00000030h] 2_2_01556DC9
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01556DC9 mov eax, dword ptr fs:[00000030h] 2_2_01556DC9
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01556DC9 mov eax, dword ptr fs:[00000030h] 2_2_01556DC9
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01556DC9 mov ecx, dword ptr fs:[00000030h] 2_2_01556DC9
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01556DC9 mov eax, dword ptr fs:[00000030h] 2_2_01556DC9
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01556DC9 mov eax, dword ptr fs:[00000030h] 2_2_01556DC9
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01588DF1 mov eax, dword ptr fs:[00000030h] 2_2_01588DF1
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014ED5E0 mov eax, dword ptr fs:[00000030h] 2_2_014ED5E0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014ED5E0 mov eax, dword ptr fs:[00000030h] 2_2_014ED5E0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0159FDE2 mov eax, dword ptr fs:[00000030h] 2_2_0159FDE2
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0159FDE2 mov eax, dword ptr fs:[00000030h] 2_2_0159FDE2
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0159FDE2 mov eax, dword ptr fs:[00000030h] 2_2_0159FDE2
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0159FDE2 mov eax, dword ptr fs:[00000030h] 2_2_0159FDE2
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D2D8A mov eax, dword ptr fs:[00000030h] 2_2_014D2D8A
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D2D8A mov eax, dword ptr fs:[00000030h] 2_2_014D2D8A
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D2D8A mov eax, dword ptr fs:[00000030h] 2_2_014D2D8A
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D2D8A mov eax, dword ptr fs:[00000030h] 2_2_014D2D8A
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D2D8A mov eax, dword ptr fs:[00000030h] 2_2_014D2D8A
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150FD9B mov eax, dword ptr fs:[00000030h] 2_2_0150FD9B
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150FD9B mov eax, dword ptr fs:[00000030h] 2_2_0150FD9B
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01502581 mov eax, dword ptr fs:[00000030h] 2_2_01502581
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01502581 mov eax, dword ptr fs:[00000030h] 2_2_01502581
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01502581 mov eax, dword ptr fs:[00000030h] 2_2_01502581
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01502581 mov eax, dword ptr fs:[00000030h] 2_2_01502581
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01501DB5 mov eax, dword ptr fs:[00000030h] 2_2_01501DB5
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01501DB5 mov eax, dword ptr fs:[00000030h] 2_2_01501DB5
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01501DB5 mov eax, dword ptr fs:[00000030h] 2_2_01501DB5
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015035A1 mov eax, dword ptr fs:[00000030h] 2_2_015035A1
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A05AC mov eax, dword ptr fs:[00000030h] 2_2_015A05AC
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A05AC mov eax, dword ptr fs:[00000030h] 2_2_015A05AC
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0156C450 mov eax, dword ptr fs:[00000030h] 2_2_0156C450
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0156C450 mov eax, dword ptr fs:[00000030h] 2_2_0156C450
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150A44B mov eax, dword ptr fs:[00000030h] 2_2_0150A44B
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014F746D mov eax, dword ptr fs:[00000030h] 2_2_014F746D
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A740D mov eax, dword ptr fs:[00000030h] 2_2_015A740D
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A740D mov eax, dword ptr fs:[00000030h] 2_2_015A740D
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A740D mov eax, dword ptr fs:[00000030h] 2_2_015A740D
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01591C06 mov eax, dword ptr fs:[00000030h] 2_2_01591C06
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01591C06 mov eax, dword ptr fs:[00000030h] 2_2_01591C06
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01591C06 mov eax, dword ptr fs:[00000030h] 2_2_01591C06
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01591C06 mov eax, dword ptr fs:[00000030h] 2_2_01591C06
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01591C06 mov eax, dword ptr fs:[00000030h] 2_2_01591C06
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01591C06 mov eax, dword ptr fs:[00000030h] 2_2_01591C06
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01591C06 mov eax, dword ptr fs:[00000030h] 2_2_01591C06
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01591C06 mov eax, dword ptr fs:[00000030h] 2_2_01591C06
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01591C06 mov eax, dword ptr fs:[00000030h] 2_2_01591C06
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01591C06 mov eax, dword ptr fs:[00000030h] 2_2_01591C06
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01591C06 mov eax, dword ptr fs:[00000030h] 2_2_01591C06
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01591C06 mov eax, dword ptr fs:[00000030h] 2_2_01591C06
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01591C06 mov eax, dword ptr fs:[00000030h] 2_2_01591C06
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01591C06 mov eax, dword ptr fs:[00000030h] 2_2_01591C06
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01556C0A mov eax, dword ptr fs:[00000030h] 2_2_01556C0A
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01556C0A mov eax, dword ptr fs:[00000030h] 2_2_01556C0A
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01556C0A mov eax, dword ptr fs:[00000030h] 2_2_01556C0A
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01556C0A mov eax, dword ptr fs:[00000030h] 2_2_01556C0A
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150BC2C mov eax, dword ptr fs:[00000030h] 2_2_0150BC2C
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A8CD6 mov eax, dword ptr fs:[00000030h] 2_2_015A8CD6
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015914FB mov eax, dword ptr fs:[00000030h] 2_2_015914FB
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01556CF0 mov eax, dword ptr fs:[00000030h] 2_2_01556CF0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01556CF0 mov eax, dword ptr fs:[00000030h] 2_2_01556CF0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01556CF0 mov eax, dword ptr fs:[00000030h] 2_2_01556CF0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E849B mov eax, dword ptr fs:[00000030h] 2_2_014E849B
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014EEF40 mov eax, dword ptr fs:[00000030h] 2_2_014EEF40
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014EFF60 mov eax, dword ptr fs:[00000030h] 2_2_014EFF60
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A8F6A mov eax, dword ptr fs:[00000030h] 2_2_015A8F6A
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0156FF10 mov eax, dword ptr fs:[00000030h] 2_2_0156FF10
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0156FF10 mov eax, dword ptr fs:[00000030h] 2_2_0156FF10
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A070D mov eax, dword ptr fs:[00000030h] 2_2_015A070D
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A070D mov eax, dword ptr fs:[00000030h] 2_2_015A070D
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FF716 mov eax, dword ptr fs:[00000030h] 2_2_014FF716
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150A70E mov eax, dword ptr fs:[00000030h] 2_2_0150A70E
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150A70E mov eax, dword ptr fs:[00000030h] 2_2_0150A70E
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150E730 mov eax, dword ptr fs:[00000030h] 2_2_0150E730
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D4F2E mov eax, dword ptr fs:[00000030h] 2_2_014D4F2E
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014D4F2E mov eax, dword ptr fs:[00000030h] 2_2_014D4F2E
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015137F5 mov eax, dword ptr fs:[00000030h] 2_2_015137F5
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01557794 mov eax, dword ptr fs:[00000030h] 2_2_01557794
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01557794 mov eax, dword ptr fs:[00000030h] 2_2_01557794
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01557794 mov eax, dword ptr fs:[00000030h] 2_2_01557794
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E8794 mov eax, dword ptr fs:[00000030h] 2_2_014E8794
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E7E41 mov eax, dword ptr fs:[00000030h] 2_2_014E7E41
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E7E41 mov eax, dword ptr fs:[00000030h] 2_2_014E7E41
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E7E41 mov eax, dword ptr fs:[00000030h] 2_2_014E7E41
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E7E41 mov eax, dword ptr fs:[00000030h] 2_2_014E7E41
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E7E41 mov eax, dword ptr fs:[00000030h] 2_2_014E7E41
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E7E41 mov eax, dword ptr fs:[00000030h] 2_2_014E7E41
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0159AE44 mov eax, dword ptr fs:[00000030h] 2_2_0159AE44
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0159AE44 mov eax, dword ptr fs:[00000030h] 2_2_0159AE44
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E766D mov eax, dword ptr fs:[00000030h] 2_2_014E766D
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FAE73 mov eax, dword ptr fs:[00000030h] 2_2_014FAE73
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FAE73 mov eax, dword ptr fs:[00000030h] 2_2_014FAE73
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FAE73 mov eax, dword ptr fs:[00000030h] 2_2_014FAE73
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FAE73 mov eax, dword ptr fs:[00000030h] 2_2_014FAE73
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014FAE73 mov eax, dword ptr fs:[00000030h] 2_2_014FAE73
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150A61C mov eax, dword ptr fs:[00000030h] 2_2_0150A61C
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0150A61C mov eax, dword ptr fs:[00000030h] 2_2_0150A61C
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014DC600 mov eax, dword ptr fs:[00000030h] 2_2_014DC600
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014DC600 mov eax, dword ptr fs:[00000030h] 2_2_014DC600
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014DC600 mov eax, dword ptr fs:[00000030h] 2_2_014DC600
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01508E00 mov eax, dword ptr fs:[00000030h] 2_2_01508E00
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01591608 mov eax, dword ptr fs:[00000030h] 2_2_01591608
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0158FE3F mov eax, dword ptr fs:[00000030h] 2_2_0158FE3F
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014DE620 mov eax, dword ptr fs:[00000030h] 2_2_014DE620
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A8ED6 mov eax, dword ptr fs:[00000030h] 2_2_015A8ED6
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_01518EC7 mov eax, dword ptr fs:[00000030h] 2_2_01518EC7
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0158FEC0 mov eax, dword ptr fs:[00000030h] 2_2_0158FEC0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015036CC mov eax, dword ptr fs:[00000030h] 2_2_015036CC
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_014E76E2 mov eax, dword ptr fs:[00000030h] 2_2_014E76E2
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015016E0 mov ecx, dword ptr fs:[00000030h] 2_2_015016E0
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_0156FE87 mov eax, dword ptr fs:[00000030h] 2_2_0156FE87
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015546A7 mov eax, dword ptr fs:[00000030h] 2_2_015546A7
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A0EA5 mov eax, dword ptr fs:[00000030h] 2_2_015A0EA5
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A0EA5 mov eax, dword ptr fs:[00000030h] 2_2_015A0EA5
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Code function: 2_2_015A0EA5 mov eax, dword ptr fs:[00000030h] 2_2_015A0EA5
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BBF0BF mov ecx, dword ptr fs:[00000030h] 7_2_04BBF0BF
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BBF0BF mov eax, dword ptr fs:[00000030h] 7_2_04BBF0BF
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BBF0BF mov eax, dword ptr fs:[00000030h] 7_2_04BBF0BF
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C1B8D0 mov eax, dword ptr fs:[00000030h] 7_2_04C1B8D0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C1B8D0 mov ecx, dword ptr fs:[00000030h] 7_2_04C1B8D0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C1B8D0 mov eax, dword ptr fs:[00000030h] 7_2_04C1B8D0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C1B8D0 mov eax, dword ptr fs:[00000030h] 7_2_04C1B8D0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C1B8D0 mov eax, dword ptr fs:[00000030h] 7_2_04C1B8D0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C1B8D0 mov eax, dword ptr fs:[00000030h] 7_2_04C1B8D0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C58CD6 mov eax, dword ptr fs:[00000030h] 7_2_04C58CD6
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC90AF mov eax, dword ptr fs:[00000030h] 7_2_04BC90AF
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB20A0 mov eax, dword ptr fs:[00000030h] 7_2_04BB20A0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB20A0 mov eax, dword ptr fs:[00000030h] 7_2_04BB20A0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB20A0 mov eax, dword ptr fs:[00000030h] 7_2_04BB20A0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB20A0 mov eax, dword ptr fs:[00000030h] 7_2_04BB20A0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB20A0 mov eax, dword ptr fs:[00000030h] 7_2_04BB20A0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB20A0 mov eax, dword ptr fs:[00000030h] 7_2_04BB20A0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B9849B mov eax, dword ptr fs:[00000030h] 7_2_04B9849B
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C06CF0 mov eax, dword ptr fs:[00000030h] 7_2_04C06CF0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C06CF0 mov eax, dword ptr fs:[00000030h] 7_2_04C06CF0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C06CF0 mov eax, dword ptr fs:[00000030h] 7_2_04C06CF0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B89080 mov eax, dword ptr fs:[00000030h] 7_2_04B89080
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C414FB mov eax, dword ptr fs:[00000030h] 7_2_04C414FB
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C03884 mov eax, dword ptr fs:[00000030h] 7_2_04C03884
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C03884 mov eax, dword ptr fs:[00000030h] 7_2_04C03884
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B858EC mov eax, dword ptr fs:[00000030h] 7_2_04B858EC
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C1C450 mov eax, dword ptr fs:[00000030h] 7_2_04C1C450
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C1C450 mov eax, dword ptr fs:[00000030h] 7_2_04C1C450
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B9B02A mov eax, dword ptr fs:[00000030h] 7_2_04B9B02A
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B9B02A mov eax, dword ptr fs:[00000030h] 7_2_04B9B02A
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B9B02A mov eax, dword ptr fs:[00000030h] 7_2_04B9B02A
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B9B02A mov eax, dword ptr fs:[00000030h] 7_2_04B9B02A
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB002D mov eax, dword ptr fs:[00000030h] 7_2_04BB002D
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB002D mov eax, dword ptr fs:[00000030h] 7_2_04BB002D
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB002D mov eax, dword ptr fs:[00000030h] 7_2_04BB002D
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB002D mov eax, dword ptr fs:[00000030h] 7_2_04BB002D
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB002D mov eax, dword ptr fs:[00000030h] 7_2_04BB002D
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BBBC2C mov eax, dword ptr fs:[00000030h] 7_2_04BBBC2C
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C51074 mov eax, dword ptr fs:[00000030h] 7_2_04C51074
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C42073 mov eax, dword ptr fs:[00000030h] 7_2_04C42073
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C41C06 mov eax, dword ptr fs:[00000030h] 7_2_04C41C06
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C41C06 mov eax, dword ptr fs:[00000030h] 7_2_04C41C06
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C41C06 mov eax, dword ptr fs:[00000030h] 7_2_04C41C06
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C41C06 mov eax, dword ptr fs:[00000030h] 7_2_04C41C06
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C41C06 mov eax, dword ptr fs:[00000030h] 7_2_04C41C06
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C41C06 mov eax, dword ptr fs:[00000030h] 7_2_04C41C06
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C41C06 mov eax, dword ptr fs:[00000030h] 7_2_04C41C06
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C41C06 mov eax, dword ptr fs:[00000030h] 7_2_04C41C06
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C41C06 mov eax, dword ptr fs:[00000030h] 7_2_04C41C06
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C41C06 mov eax, dword ptr fs:[00000030h] 7_2_04C41C06
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C41C06 mov eax, dword ptr fs:[00000030h] 7_2_04C41C06
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C41C06 mov eax, dword ptr fs:[00000030h] 7_2_04C41C06
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C41C06 mov eax, dword ptr fs:[00000030h] 7_2_04C41C06
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C41C06 mov eax, dword ptr fs:[00000030h] 7_2_04C41C06
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C5740D mov eax, dword ptr fs:[00000030h] 7_2_04C5740D
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C5740D mov eax, dword ptr fs:[00000030h] 7_2_04C5740D
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C5740D mov eax, dword ptr fs:[00000030h] 7_2_04C5740D
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C06C0A mov eax, dword ptr fs:[00000030h] 7_2_04C06C0A
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C06C0A mov eax, dword ptr fs:[00000030h] 7_2_04C06C0A
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C06C0A mov eax, dword ptr fs:[00000030h] 7_2_04C06C0A
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C06C0A mov eax, dword ptr fs:[00000030h] 7_2_04C06C0A
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C54015 mov eax, dword ptr fs:[00000030h] 7_2_04C54015
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C54015 mov eax, dword ptr fs:[00000030h] 7_2_04C54015
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C07016 mov eax, dword ptr fs:[00000030h] 7_2_04C07016
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C07016 mov eax, dword ptr fs:[00000030h] 7_2_04C07016
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C07016 mov eax, dword ptr fs:[00000030h] 7_2_04C07016
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BA746D mov eax, dword ptr fs:[00000030h] 7_2_04BA746D
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BA0050 mov eax, dword ptr fs:[00000030h] 7_2_04BA0050
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BA0050 mov eax, dword ptr fs:[00000030h] 7_2_04BA0050
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BBA44B mov eax, dword ptr fs:[00000030h] 7_2_04BBA44B
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C06DC9 mov eax, dword ptr fs:[00000030h] 7_2_04C06DC9
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C06DC9 mov eax, dword ptr fs:[00000030h] 7_2_04C06DC9
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C06DC9 mov eax, dword ptr fs:[00000030h] 7_2_04C06DC9
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C06DC9 mov ecx, dword ptr fs:[00000030h] 7_2_04C06DC9
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C06DC9 mov eax, dword ptr fs:[00000030h] 7_2_04C06DC9
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C06DC9 mov eax, dword ptr fs:[00000030h] 7_2_04C06DC9
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB1DB5 mov eax, dword ptr fs:[00000030h] 7_2_04BB1DB5
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB1DB5 mov eax, dword ptr fs:[00000030h] 7_2_04BB1DB5
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB1DB5 mov eax, dword ptr fs:[00000030h] 7_2_04BB1DB5
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB35A1 mov eax, dword ptr fs:[00000030h] 7_2_04BB35A1
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB61A0 mov eax, dword ptr fs:[00000030h] 7_2_04BB61A0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB61A0 mov eax, dword ptr fs:[00000030h] 7_2_04BB61A0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BBFD9B mov eax, dword ptr fs:[00000030h] 7_2_04BBFD9B
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BBFD9B mov eax, dword ptr fs:[00000030h] 7_2_04BBFD9B
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C141E8 mov eax, dword ptr fs:[00000030h] 7_2_04C141E8
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB2990 mov eax, dword ptr fs:[00000030h] 7_2_04BB2990
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C38DF1 mov eax, dword ptr fs:[00000030h] 7_2_04C38DF1
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B82D8A mov eax, dword ptr fs:[00000030h] 7_2_04B82D8A
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B82D8A mov eax, dword ptr fs:[00000030h] 7_2_04B82D8A
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B82D8A mov eax, dword ptr fs:[00000030h] 7_2_04B82D8A
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B82D8A mov eax, dword ptr fs:[00000030h] 7_2_04B82D8A
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B82D8A mov eax, dword ptr fs:[00000030h] 7_2_04B82D8A
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BAC182 mov eax, dword ptr fs:[00000030h] 7_2_04BAC182
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB2581 mov eax, dword ptr fs:[00000030h] 7_2_04BB2581
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB2581 mov eax, dword ptr fs:[00000030h] 7_2_04BB2581
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB2581 mov eax, dword ptr fs:[00000030h] 7_2_04BB2581
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB2581 mov eax, dword ptr fs:[00000030h] 7_2_04BB2581
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BBA185 mov eax, dword ptr fs:[00000030h] 7_2_04BBA185
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B8B1E1 mov eax, dword ptr fs:[00000030h] 7_2_04B8B1E1
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B8B1E1 mov eax, dword ptr fs:[00000030h] 7_2_04B8B1E1
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B8B1E1 mov eax, dword ptr fs:[00000030h] 7_2_04B8B1E1
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B9D5E0 mov eax, dword ptr fs:[00000030h] 7_2_04B9D5E0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B9D5E0 mov eax, dword ptr fs:[00000030h] 7_2_04B9D5E0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C069A6 mov eax, dword ptr fs:[00000030h] 7_2_04C069A6
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C505AC mov eax, dword ptr fs:[00000030h] 7_2_04C505AC
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C505AC mov eax, dword ptr fs:[00000030h] 7_2_04C505AC
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C051BE mov eax, dword ptr fs:[00000030h] 7_2_04C051BE
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C051BE mov eax, dword ptr fs:[00000030h] 7_2_04C051BE
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C051BE mov eax, dword ptr fs:[00000030h] 7_2_04C051BE
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C051BE mov eax, dword ptr fs:[00000030h] 7_2_04C051BE
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB4D3B mov eax, dword ptr fs:[00000030h] 7_2_04BB4D3B
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB4D3B mov eax, dword ptr fs:[00000030h] 7_2_04BB4D3B
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB4D3B mov eax, dword ptr fs:[00000030h] 7_2_04BB4D3B
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C03540 mov eax, dword ptr fs:[00000030h] 7_2_04C03540
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB513A mov eax, dword ptr fs:[00000030h] 7_2_04BB513A
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB513A mov eax, dword ptr fs:[00000030h] 7_2_04BB513A
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B8AD30 mov eax, dword ptr fs:[00000030h] 7_2_04B8AD30
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B93D34 mov eax, dword ptr fs:[00000030h] 7_2_04B93D34
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B93D34 mov eax, dword ptr fs:[00000030h] 7_2_04B93D34
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B93D34 mov eax, dword ptr fs:[00000030h] 7_2_04B93D34
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B93D34 mov eax, dword ptr fs:[00000030h] 7_2_04B93D34
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B93D34 mov eax, dword ptr fs:[00000030h] 7_2_04B93D34
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B93D34 mov eax, dword ptr fs:[00000030h] 7_2_04B93D34
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B93D34 mov eax, dword ptr fs:[00000030h] 7_2_04B93D34
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B93D34 mov eax, dword ptr fs:[00000030h] 7_2_04B93D34
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B93D34 mov eax, dword ptr fs:[00000030h] 7_2_04B93D34
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B93D34 mov eax, dword ptr fs:[00000030h] 7_2_04B93D34
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B93D34 mov eax, dword ptr fs:[00000030h] 7_2_04B93D34
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B93D34 mov eax, dword ptr fs:[00000030h] 7_2_04B93D34
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B93D34 mov eax, dword ptr fs:[00000030h] 7_2_04B93D34
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BA4120 mov eax, dword ptr fs:[00000030h] 7_2_04BA4120
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BA4120 mov eax, dword ptr fs:[00000030h] 7_2_04BA4120
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BA4120 mov eax, dword ptr fs:[00000030h] 7_2_04BA4120
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BA4120 mov eax, dword ptr fs:[00000030h] 7_2_04BA4120
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BA4120 mov ecx, dword ptr fs:[00000030h] 7_2_04BA4120
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B89100 mov eax, dword ptr fs:[00000030h] 7_2_04B89100
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B89100 mov eax, dword ptr fs:[00000030h] 7_2_04B89100
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B89100 mov eax, dword ptr fs:[00000030h] 7_2_04B89100
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B8B171 mov eax, dword ptr fs:[00000030h] 7_2_04B8B171
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B8B171 mov eax, dword ptr fs:[00000030h] 7_2_04B8B171
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BAC577 mov eax, dword ptr fs:[00000030h] 7_2_04BAC577
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BAC577 mov eax, dword ptr fs:[00000030h] 7_2_04BAC577
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B8C962 mov eax, dword ptr fs:[00000030h] 7_2_04B8C962
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BA7D50 mov eax, dword ptr fs:[00000030h] 7_2_04BA7D50
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C58D34 mov eax, dword ptr fs:[00000030h] 7_2_04C58D34
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C0A537 mov eax, dword ptr fs:[00000030h] 7_2_04C0A537
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BAB944 mov eax, dword ptr fs:[00000030h] 7_2_04BAB944
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BAB944 mov eax, dword ptr fs:[00000030h] 7_2_04BAB944
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC3D43 mov eax, dword ptr fs:[00000030h] 7_2_04BC3D43
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C3FEC0 mov eax, dword ptr fs:[00000030h] 7_2_04C3FEC0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B9AAB0 mov eax, dword ptr fs:[00000030h] 7_2_04B9AAB0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B9AAB0 mov eax, dword ptr fs:[00000030h] 7_2_04B9AAB0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BBFAB0 mov eax, dword ptr fs:[00000030h] 7_2_04BBFAB0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C58ED6 mov eax, dword ptr fs:[00000030h] 7_2_04C58ED6
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B852A5 mov eax, dword ptr fs:[00000030h] 7_2_04B852A5
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B852A5 mov eax, dword ptr fs:[00000030h] 7_2_04B852A5
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B852A5 mov eax, dword ptr fs:[00000030h] 7_2_04B852A5
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B852A5 mov eax, dword ptr fs:[00000030h] 7_2_04B852A5
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B852A5 mov eax, dword ptr fs:[00000030h] 7_2_04B852A5
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BBD294 mov eax, dword ptr fs:[00000030h] 7_2_04BBD294
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BBD294 mov eax, dword ptr fs:[00000030h] 7_2_04BBD294
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C1FE87 mov eax, dword ptr fs:[00000030h] 7_2_04C1FE87
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB16E0 mov ecx, dword ptr fs:[00000030h] 7_2_04BB16E0
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B976E2 mov eax, dword ptr fs:[00000030h] 7_2_04B976E2
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB2AE4 mov eax, dword ptr fs:[00000030h] 7_2_04BB2AE4
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C50EA5 mov eax, dword ptr fs:[00000030h] 7_2_04C50EA5
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C50EA5 mov eax, dword ptr fs:[00000030h] 7_2_04C50EA5
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C50EA5 mov eax, dword ptr fs:[00000030h] 7_2_04C50EA5
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C046A7 mov eax, dword ptr fs:[00000030h] 7_2_04C046A7
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB2ACB mov eax, dword ptr fs:[00000030h] 7_2_04BB2ACB
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB36CC mov eax, dword ptr fs:[00000030h] 7_2_04BB36CC
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC8EC7 mov eax, dword ptr fs:[00000030h] 7_2_04BC8EC7
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC4A2C mov eax, dword ptr fs:[00000030h] 7_2_04BC4A2C
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC4A2C mov eax, dword ptr fs:[00000030h] 7_2_04BC4A2C
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C14257 mov eax, dword ptr fs:[00000030h] 7_2_04C14257
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B8E620 mov eax, dword ptr fs:[00000030h] 7_2_04B8E620
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C3B260 mov eax, dword ptr fs:[00000030h] 7_2_04C3B260
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C3B260 mov eax, dword ptr fs:[00000030h] 7_2_04C3B260
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BA3A1C mov eax, dword ptr fs:[00000030h] 7_2_04BA3A1C
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C58A62 mov eax, dword ptr fs:[00000030h] 7_2_04C58A62
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BBA61C mov eax, dword ptr fs:[00000030h] 7_2_04BBA61C
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BBA61C mov eax, dword ptr fs:[00000030h] 7_2_04BBA61C
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B85210 mov eax, dword ptr fs:[00000030h] 7_2_04B85210
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B85210 mov ecx, dword ptr fs:[00000030h] 7_2_04B85210
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B85210 mov eax, dword ptr fs:[00000030h] 7_2_04B85210
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B85210 mov eax, dword ptr fs:[00000030h] 7_2_04B85210
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B8AA16 mov eax, dword ptr fs:[00000030h] 7_2_04B8AA16
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B8AA16 mov eax, dword ptr fs:[00000030h] 7_2_04B8AA16
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B98A0A mov eax, dword ptr fs:[00000030h] 7_2_04B98A0A
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B8C600 mov eax, dword ptr fs:[00000030h] 7_2_04B8C600
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B8C600 mov eax, dword ptr fs:[00000030h] 7_2_04B8C600
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B8C600 mov eax, dword ptr fs:[00000030h] 7_2_04B8C600
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB8E00 mov eax, dword ptr fs:[00000030h] 7_2_04BB8E00
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BC927A mov eax, dword ptr fs:[00000030h] 7_2_04BC927A
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BAAE73 mov eax, dword ptr fs:[00000030h] 7_2_04BAAE73
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BAAE73 mov eax, dword ptr fs:[00000030h] 7_2_04BAAE73
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BAAE73 mov eax, dword ptr fs:[00000030h] 7_2_04BAAE73
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BAAE73 mov eax, dword ptr fs:[00000030h] 7_2_04BAAE73
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BAAE73 mov eax, dword ptr fs:[00000030h] 7_2_04BAAE73
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C41608 mov eax, dword ptr fs:[00000030h] 7_2_04C41608
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B9766D mov eax, dword ptr fs:[00000030h] 7_2_04B9766D
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B89240 mov eax, dword ptr fs:[00000030h] 7_2_04B89240
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B89240 mov eax, dword ptr fs:[00000030h] 7_2_04B89240
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B89240 mov eax, dword ptr fs:[00000030h] 7_2_04B89240
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B89240 mov eax, dword ptr fs:[00000030h] 7_2_04B89240
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B97E41 mov eax, dword ptr fs:[00000030h] 7_2_04B97E41
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B97E41 mov eax, dword ptr fs:[00000030h] 7_2_04B97E41
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B97E41 mov eax, dword ptr fs:[00000030h] 7_2_04B97E41
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B97E41 mov eax, dword ptr fs:[00000030h] 7_2_04B97E41
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B97E41 mov eax, dword ptr fs:[00000030h] 7_2_04B97E41
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04B97E41 mov eax, dword ptr fs:[00000030h] 7_2_04B97E41
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C3FE3F mov eax, dword ptr fs:[00000030h] 7_2_04C3FE3F
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C053CA mov eax, dword ptr fs:[00000030h] 7_2_04C053CA
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04C053CA mov eax, dword ptr fs:[00000030h] 7_2_04C053CA
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB4BAD mov eax, dword ptr fs:[00000030h] 7_2_04BB4BAD
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB4BAD mov eax, dword ptr fs:[00000030h] 7_2_04BB4BAD
Source: C:\Windows\SysWOW64\control.exe Code function: 7_2_04BB4BAD mov eax, dword ptr fs:[00000030h] 7_2_04BB4BAD
Enables debug privileges
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\control.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.boogerstv.com
Source: C:\Windows\explorer.exe Network Connect: 156.241.53.161 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.cleanxcare.com
Source: C:\Windows\explorer.exe Network Connect: 172.107.55.6 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 163.44.239.73 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 74.220.199.8 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.totally-seo.com
Source: C:\Windows\explorer.exe Domain query: www.dreamcashbuyers.com
Source: C:\Windows\explorer.exe Domain query: www.swayam-moj.com
Source: C:\Windows\explorer.exe Network Connect: 147.255.162.204 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 198.185.159.144 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.hfjxhs.com
Source: C:\Windows\explorer.exe Domain query: www.cmannouncements.com
Source: C:\Windows\explorer.exe Network Connect: 54.69.66.227 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.leonardocarrillo.com
Source: C:\Windows\explorer.exe Network Connect: 199.195.117.147 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 99.83.154.118 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.balloon-artists.com
Source: C:\Windows\explorer.exe Domain query: www.adultpeace.com
Source: C:\Windows\explorer.exe Domain query: www.defenestration.world
Source: C:\Windows\explorer.exe Network Connect: 198.54.117.216 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 78.31.67.91 80 Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Memory written: C:\Users\user\Desktop\lTAPQJikGw.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Section loaded: unknown target: C:\Windows\SysWOW64\control.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Section loaded: unknown target: C:\Windows\SysWOW64\control.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\control.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\control.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\control.exe Thread register set: target process: 3424 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Section unmapped: C:\Windows\SysWOW64\control.exe base address: E00000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process created: C:\Users\user\Desktop\lTAPQJikGw.exe C:\Users\user\Desktop\lTAPQJikGw.exe Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Process created: C:\Windows\SysWOW64\control.exe C:\Windows\SysWOW64\control.exe Jump to behavior
Source: C:\Windows\SysWOW64\control.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\lTAPQJikGw.exe' Jump to behavior
Source: explorer.exe, 00000003.00000000.687115510.0000000000AD8000.00000004.00000020.sdmp Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000003.00000000.687455118.0000000001080000.00000002.00000001.sdmp, control.exe, 00000007.00000002.916888031.0000000003410000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000003.00000000.687455118.0000000001080000.00000002.00000001.sdmp, control.exe, 00000007.00000002.916888031.0000000003410000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000000.687455118.0000000001080000.00000002.00000001.sdmp, control.exe, 00000007.00000002.916888031.0000000003410000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000003.00000000.687455118.0000000001080000.00000002.00000001.sdmp, control.exe, 00000007.00000002.916888031.0000000003410000.00000002.00000001.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000003.00000000.676552486.000000000A716000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWnd5D

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Queries volume information: C:\Users\user\Desktop\lTAPQJikGw.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lTAPQJikGw.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000002.00000002.730022102.0000000001810000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.727807565.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.658248909.0000000004349000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.916418172.0000000000DA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.656408527.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.916260841.0000000000930000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.916447629.0000000000DD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.729969001.00000000017E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 2.0.lTAPQJikGw.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.lTAPQJikGw.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.lTAPQJikGw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.lTAPQJikGw.exe.4349930.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.lTAPQJikGw.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000002.00000002.730022102.0000000001810000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.727807565.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.658248909.0000000004349000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.916418172.0000000000DA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.656408527.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.916260841.0000000000930000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.916447629.0000000000DD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.729969001.00000000017E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 2.0.lTAPQJikGw.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.lTAPQJikGw.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.lTAPQJikGw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.lTAPQJikGw.exe.4349930.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.lTAPQJikGw.exe.400000.0.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 432746 Sample: lTAPQJikGw Startdate: 10/06/2021 Architecture: WINDOWS Score: 100 29 www.myfavbutik.com 2->29 45 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->45 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 7 other signatures 2->51 10 lTAPQJikGw.exe 3 2->10         started        signatures3 process4 file5 27 C:\Users\user\AppData\...\lTAPQJikGw.exe.log, ASCII 10->27 dropped 53 Tries to detect virtualization through RDTSC time measurements 10->53 55 Injects a PE file into a foreign processes 10->55 14 lTAPQJikGw.exe 10->14         started        signatures6 process7 signatures8 57 Modifies the context of a thread in another process (thread injection) 14->57 59 Maps a DLL or memory area into another process 14->59 61 Sample uses process hollowing technique 14->61 63 Queues an APC in another process (thread injection) 14->63 17 control.exe 14->17         started        20 explorer.exe 14->20 injected process9 dnsIp10 37 Modifies the context of a thread in another process (thread injection) 17->37 39 Maps a DLL or memory area into another process 17->39 41 Tries to detect virtualization through RDTSC time measurements 17->41 23 cmd.exe 1 17->23         started        31 www.hfjxhs.com 156.241.53.161, 49769, 80 XIAOZHIYUN1-AS-APICIDCNETWORKUS Seychelles 20->31 33 www.cmannouncements.com 74.220.199.8, 49765, 80 UNIFIEDLAYER-AS-1US United States 20->33 35 16 other IPs or domains 20->35 43 System process connects to network (likely due to code injection or exploit) 20->43 signatures11 process12 process13 25 conhost.exe 23->25         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
147.255.162.204
 www.balloon-artists.com United States
7203 LEASEWEB-USA-SFO-12US true
198.185.159.144
 ext-sq.squarespace.com United States
53831 SQUARESPACEUS false
54.69.66.227
 sites-external-prod-ebc852aa8146fe7f.elb.us-west-2.amazonaws.com United States
16509 AMAZON-02US false
156.241.53.161
 www.hfjxhs.com Seychelles
136800 XIAOZHIYUN1-AS-APICIDCNETWORKUS true
172.107.55.6
 www.leonardocarrillo.com United States
40676 AS40676US true
199.195.117.147
 swayam-moj.com United States
55293 A2HOSTINGUS true
99.83.154.118
 www.defenestration.world United States
16509 AMAZON-02US true
163.44.239.73
 adultpeace.com Japan 7506 INTERQGMOInternetIncJP true
74.220.199.8
 www.cmannouncements.com United States
46606 UNIFIEDLAYER-AS-1US true
198.54.117.216
 parkingpage.namecheap.com United States
22612 NAMECHEAP-NETUS false
78.31.67.91
 cleanxcare.com Germany
24961 MYLOC-ASIPBackboneofmyLocmanagedITAGDE true

Contacted Domains

Name IP Active
www.myfavbutik.com 104.21.15.16 true
adultpeace.com 163.44.239.73 true
www.hfjxhs.com 156.241.53.161 true
www.cmannouncements.com 74.220.199.8 true
parkingpage.namecheap.com 198.54.117.216 true
www.leonardocarrillo.com 172.107.55.6 true
cleanxcare.com 78.31.67.91 true
www.balloon-artists.com 147.255.162.204 true
sites-external-prod-ebc852aa8146fe7f.elb.us-west-2.amazonaws.com 54.69.66.227 true
www.defenestration.world 99.83.154.118 true
ext-sq.squarespace.com 198.185.159.144 true
swayam-moj.com 199.195.117.147 true
www.swayam-moj.com unknown unknown
www.boogerstv.com unknown unknown
www.cleanxcare.com unknown unknown
www.adultpeace.com unknown unknown
www.totally-seo.com unknown unknown
www.dreamcashbuyers.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.cmannouncements.com/p2io/?CFQHg=wzEdtbrCY4VKdG4P/h093gtD2EzP1yO8zPZJPXBkhd23ZEiSfiVlmlbiUjAoERCVF5eV&Pr980v=G2MtWNVHS true
  • Avira URL Cloud: malware
 unknown
http://www.hfjxhs.com/p2io/?CFQHg=DTtQlm+bkwamRHt6VrobrkMYYvpq+NlfspH3ROyN3o99G08d4+CoiJMc5PUrO1w4I+TP&Pr980v=G2MtWNVHS true
  • Avira URL Cloud: safe
 unknown
http://www.balloon-artists.com/p2io/?CFQHg=/DMwn9vTy70wY8Gt9syYwdBt6sFcRXVvValBDdDX8KtazsYeLKsYeQz2+d78EfQIVSnp&Pr980v=G2MtWNVHS true
  • Avira URL Cloud: malware
 unknown
http://www.boogerstv.com/p2io/?CFQHg=fW2NkW2j278wyrs6d/m+egXTc5dWq8qtohQAL+tQrXSmfdetyJ3HBVVg7gxxicKRFJwM&Pr980v=G2MtWNVHS true
  • Avira URL Cloud: malware
 unknown
www.adultpeace.com/p2io/ true
  • URL Reputation: safe
  • URL Reputation: safe
  • URL Reputation: safe
 low
http://www.leonardocarrillo.com/p2io/?CFQHg=Z8FkwwkqwMcbR63JqM/eMJCTIQtJD+6S4GLVkEvBdcKRRdmUAPmyd56itTHHstyDZ3vx&Pr980v=G2MtWNVHS true
  • Avira URL Cloud: safe
 unknown
http://www.swayam-moj.com/p2io/?CFQHg=0YkKA47wwnQsSd2I7kPMKR9IRaKfA7HvmAjNs5nkCsbL4/Nj4Thso/t2FfIp2mnBj9Pa&Pr980v=G2MtWNVHS true
  • Avira URL Cloud: safe
 unknown
http://www.cleanxcare.com/p2io/?CFQHg=pxlxKDN0Rvw8YUTnsB4Bv4ohCC0AYWvU81fxb+r9dLiNjjqdMXiyL1Lf04YLJeQ+Gz7y&Pr980v=G2MtWNVHS true
  • Avira URL Cloud: safe
 unknown
http://www.dreamcashbuyers.com/p2io/?CFQHg=H0m9fF/5FM7UqIICC4653EpAABAppk+gPAvqYefbAICNl1a1FFJvvx6E9HTJL6Hcfv3l&Pr980v=G2MtWNVHS true
  • Avira URL Cloud: malware
 unknown
http://www.defenestration.world/p2io/?CFQHg=lrOqxb+RJFhwpubsYZ1tkMjkgx31NOkXgmE0j6vPa760pj23uu3lC+ndsaG2+azAf30S&Pr980v=G2MtWNVHS true
  • Avira URL Cloud: safe
 unknown
http://www.adultpeace.com/p2io/?CFQHg=4oufm6g5t6Bqg3y0mDBWoA8I6Q2bNaX51tGc9mj7mZf0wZ/j7IpC3Y+it5NkyKMHKzCR&Pr980v=G2MtWNVHS true
  • Avira URL Cloud: safe
 unknown