Windows Analysis Report Form_TT_EUR57,890.exe

Overview

General Information

Sample Name: Form_TT_EUR57,890.exe
Analysis ID: 458655
MD5: 811ea41e60760a97b5f28973618728fe
SHA1: ec072cb8cb67785ca7fba45d36c6264b7eed65cd
SHA256: e6bd5f8475731bcca5f6b74327a68ee4b7fa5b0662521feff1d92424da149151
Tags: exe
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Injects a PE file into a foreign processes
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Execution from Suspicious Folder
Sigma detected: Suspicious Process Start Without DLL
Sigma detected: Suspicious Rundll32 Without Any CommandLine Params
Tries to detect virtualization through RDTSC time measurements
Uses netstat to query active network connections and open ports
Writes to foreign memory regions
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Yara detected Keylogger Generic
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: http://www.mylifeinpark.com/6mam/?wbYpSP=djxA7LmI8yOR5lrxItMqg4jKcWhO49sHA38/CyXgFoUCakRbVREb3j6xA5Z01WfJADXfd3zybw==&PJEt=HRR0_XgHGBD8 Avira URL Cloud: Label: malware
Source: http://www.mobiessence.com/6mam/?wbYpSP=KE8gpfUEuqRqMBWGFV5goIwNmc44LE6Oi+PTcRo4vEp3RirjZlcD1GLbPH2NA5fTW+Y3K/xiNw==&PJEt=HRR0_XgHGBD8 Avira URL Cloud: Label: malware
Source: http://www.trendyheld.com/6mam/?wbYpSP=E0pe+Y2tlTeS/nkCAz5H/oSd7jolrcEyLM5+sA5RPKgWYHOxmsRP4IrVmGJTeseGmyQ7XT1Vgg==&PJEt=HRR0_XgHGBD8 Avira URL Cloud: Label: malware
Multi AV Scanner detection for dropped file
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe ReversingLabs: Detection: 19%
Multi AV Scanner detection for submitted file
Source: Form_TT_EUR57,890.exe ReversingLabs: Detection: 19%
Yara detected FormBook
Source: Yara match File source: 4.0.logagent.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.logagent.exe.10410000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.secinit.exe.10410000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.0.mshta.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.logagent.exe.10410000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.mshta.exe.10410000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.0.secinit.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.0.mshta.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.0.secinit.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.secinit.exe.10410000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.mshta.exe.10410000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.logagent.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001D.00000000.493724351.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.861918517.0000000000B80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.495868043.0000000002910000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.496343429.0000000002C80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.863420934.0000000002DD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000000.467594845.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.505021347.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.513499123.0000000004600000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.862165299.0000000000CB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.497909086.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.512339844.0000000002940000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.380848795.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.512824544.0000000002B50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.515478166.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Antivirus or Machine Learning detection for unpacked file
Source: 4.0.logagent.exe.10410000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 4.2.logagent.exe.10410000.5.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 29.2.secinit.exe.10410000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 26.2.mshta.exe.10410000.5.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 26.0.mshta.exe.10410000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 29.0.secinit.exe.10410000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: Form_TT_EUR57,890.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000008.00000000.411546423.0000000007BA0000.00000002.00000001.sdmp
Source: Binary string: mshta.pdbGCTL source: rundll32.exe, 0000001C.00000002.865904880.00000000051C7000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: logagent.exe, 00000004.00000002.513978427.0000000004A5F000.00000040.00000001.sdmp, mshta.exe, 0000001A.00000003.468583820.0000000002D50000.00000004.00000001.sdmp, rundll32.exe, 0000001C.00000002.863838057.0000000004C90000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: logagent.exe, mshta.exe, rundll32.exe, 0000001C.00000002.863838057.0000000004C90000.00000040.00000001.sdmp
Source: Binary string: rundll32.pdb source: mshta.exe, 0000001A.00000002.496580927.0000000002D00000.00000040.00000001.sdmp
Source: Binary string: rundll32.pdbGCTL source: mshta.exe, 0000001A.00000002.496580927.0000000002D00000.00000040.00000001.sdmp
Source: Binary string: mshta.pdb source: rundll32.exe, 0000001C.00000002.865904880.00000000051C7000.00000004.00000001.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 00000008.00000000.411546423.0000000007BA0000.00000002.00000001.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [ebp-0Ch] 1_3_02C8EA30
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [ebp+08h] 1_3_02C8EA30
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov edx, dword ptr [eax] 1_3_02C8EBDC
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov ebx, dword ptr [ecx] 1_3_02C8EBDC
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then xor ecx, ecx 1_3_02C8EB88
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then xor edx, edx 1_3_02C8EB00
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then test eax, 80000000h 1_3_02C8EB00
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then or edx, 00000080h 1_3_02C8EB00
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then test eax, 80000000h 1_3_02C8EB00
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then or edx, 02h 1_3_02C8EB00
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then or edx, 01h 1_3_02C8EB00
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [ebp-04h] 1_3_02C8E99C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then lea edx, dword ptr [ebp-08h] 1_3_02C8E944
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [esi] 1_3_02C8EE2C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [edi] 1_3_02C8EE2C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [edi] 1_3_02C8EE2C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [004199DCh] 1_3_02C8EE2C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then push 00000004h 1_3_02C8EE2C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [004199D4h] 1_3_02C8EE2C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [esi] 1_3_02C8EE2C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [004199C0h] 1_3_02C8EE2C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then push 00000000h 1_3_02C8EE2C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [004199C8h] 1_3_02C8EE2C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [004199C8h] 1_3_02C8EE2C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [004199C8h] 1_3_02C8EE2C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then push 004199E0h 1_3_02C8EE2C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then xor eax, eax 1_3_02C8EE2C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [esi] 1_3_02C8EE24
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [edi] 1_3_02C8EE24
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [edi] 1_3_02C8EE24
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [004199DCh] 1_3_02C8EE24
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then push 00000004h 1_3_02C8EE24
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [004199D4h] 1_3_02C8EE24
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [esi] 1_3_02C8EE24
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [004199C0h] 1_3_02C8EE24
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then push 00000000h 1_3_02C8EE24
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [004199C8h] 1_3_02C8EE24
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [004199C8h] 1_3_02C8EE24
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [004199C8h] 1_3_02C8EE24
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then push 004199E0h 1_3_02C8EE24
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then xor eax, eax 1_3_02C8EE24
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then test eax, 15000000h 1_3_02C8EC84
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [00419A0Ch] 1_3_02C8EC94
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [004199ECh] 1_3_02C8EC94
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [00419A0Ch] 1_3_02C8EC94
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [00419A0Ch] 1_3_02C8EC94
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 4x nop then mov eax, dword ptr [ebx] 1_3_02C8EC94
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [ebp-0Ch] 16_3_02CAEA30
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [ebp+08h] 16_3_02CAEA30
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov edx, dword ptr [eax] 16_3_02CAEBDC
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov ebx, dword ptr [ecx] 16_3_02CAEBDC
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then xor ecx, ecx 16_3_02CAEB88
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then xor edx, edx 16_3_02CAEB00
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then test eax, 80000000h 16_3_02CAEB00
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then or edx, 00000080h 16_3_02CAEB00
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then test eax, 80000000h 16_3_02CAEB00
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then or edx, 02h 16_3_02CAEB00
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then or edx, 01h 16_3_02CAEB00
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [ebp-04h] 16_3_02CAE99C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then lea edx, dword ptr [ebp-08h] 16_3_02CAE944
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [esi] 16_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [edi] 16_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [edi] 16_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199DCh] 16_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then push 00000004h 16_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199D4h] 16_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [esi] 16_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199C0h] 16_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then push 00000000h 16_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199C8h] 16_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199C8h] 16_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199C8h] 16_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then push 004199E0h 16_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then xor eax, eax 16_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [esi] 16_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [edi] 16_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [edi] 16_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199DCh] 16_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then push 00000004h 16_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199D4h] 16_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [esi] 16_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199C0h] 16_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then push 00000000h 16_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199C8h] 16_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199C8h] 16_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199C8h] 16_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then push 004199E0h 16_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then xor eax, eax 16_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then test eax, 15000000h 16_3_02CAEC84
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [00419A0Ch] 16_3_02CAEC94
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199ECh] 16_3_02CAEC94
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [00419A0Ch] 16_3_02CAEC94
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [00419A0Ch] 16_3_02CAEC94
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [ebx] 16_3_02CAEC94
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [ebp-0Ch] 19_3_02CAEA30
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [ebp+08h] 19_3_02CAEA30
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov edx, dword ptr [eax] 19_3_02CAEBDC
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov ebx, dword ptr [ecx] 19_3_02CAEBDC
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then xor ecx, ecx 19_3_02CAEB88
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then xor edx, edx 19_3_02CAEB00
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then test eax, 80000000h 19_3_02CAEB00
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then or edx, 00000080h 19_3_02CAEB00
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then test eax, 80000000h 19_3_02CAEB00
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then or edx, 02h 19_3_02CAEB00
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then or edx, 01h 19_3_02CAEB00
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [ebp-04h] 19_3_02CAE99C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then lea edx, dword ptr [ebp-08h] 19_3_02CAE944
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [esi] 19_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [edi] 19_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [edi] 19_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199DCh] 19_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then push 00000004h 19_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199D4h] 19_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [esi] 19_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199C0h] 19_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then push 00000000h 19_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199C8h] 19_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199C8h] 19_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199C8h] 19_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then push 004199E0h 19_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then xor eax, eax 19_3_02CAEE2C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [esi] 19_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [edi] 19_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [edi] 19_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199DCh] 19_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then push 00000004h 19_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199D4h] 19_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [esi] 19_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199C0h] 19_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then push 00000000h 19_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199C8h] 19_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199C8h] 19_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199C8h] 19_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then push 004199E0h 19_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then xor eax, eax 19_3_02CAEE24
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then test eax, 15000000h 19_3_02CAEC84
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [00419A0Ch] 19_3_02CAEC94
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199ECh] 19_3_02CAEC94
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [00419A0Ch] 19_3_02CAEC94
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [00419A0Ch] 19_3_02CAEC94
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [ebx] 19_3_02CAEC94
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [00419A0Ch] 19_3_02D78AF4
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199ECh] 19_3_02D78AF4
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [00419A0Ch] 19_3_02D78AF4
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [00419A0Ch] 19_3_02D78AF4
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [ebx] 19_3_02D78AF4
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then test eax, 15000000h 19_3_02D78AE4
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov edx, dword ptr [eax] 19_3_02D78A3C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov ebx, dword ptr [ecx] 19_3_02D78A3C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [ebp-0Ch] 19_3_02D78890
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [ebp+08h] 19_3_02D78890
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then xor ecx, ecx 19_3_02D789E8
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then xor edx, edx 19_3_02D78960
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then test eax, 80000000h 19_3_02D78960
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then or edx, 00000080h 19_3_02D78960
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then test eax, 80000000h 19_3_02D78960
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then or edx, 02h 19_3_02D78960
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then or edx, 01h 19_3_02D78960
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [ebp-04h] 19_3_02D787FC
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then lea edx, dword ptr [ebp-08h] 19_3_02D787A4
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [esi] 19_3_02D78C8C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [edi] 19_3_02D78C8C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [edi] 19_3_02D78C8C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199DCh] 19_3_02D78C8C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then push 00000004h 19_3_02D78C8C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199D4h] 19_3_02D78C8C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [esi] 19_3_02D78C8C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199C0h] 19_3_02D78C8C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then push 00000000h 19_3_02D78C8C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199C8h] 19_3_02D78C8C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199C8h] 19_3_02D78C8C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then mov eax, dword ptr [004199C8h] 19_3_02D78C8C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then push 004199E0h 19_3_02D78C8C
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 4x nop then xor eax, eax 19_3_02D78C8C
Source: C:\Windows\SysWOW64\mshta.exe Code function: 4x nop then pop edi 26_2_104261B2
Source: C:\Windows\SysWOW64\mshta.exe Code function: 4x nop then pop edi 26_2_10426213
Source: C:\Windows\SysWOW64\mshta.exe Code function: 4x nop then pop edi 26_2_1041C3C2

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49759 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49759 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49759 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49760 -> 23.27.129.115:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49760 -> 23.27.129.115:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49760 -> 23.27.129.115:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49762 -> 86.105.245.69:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49762 -> 86.105.245.69:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49762 -> 86.105.245.69:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49763 -> 35.186.238.101:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49763 -> 35.186.238.101:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49763 -> 35.186.238.101:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49765 -> 64.190.62.111:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49765 -> 64.190.62.111:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49765 -> 64.190.62.111:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49771 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49771 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49771 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49772 -> 23.27.129.115:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49772 -> 23.27.129.115:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49772 -> 23.27.129.115:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49774 -> 86.105.245.69:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49774 -> 86.105.245.69:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49774 -> 86.105.245.69:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49775 -> 35.186.238.101:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49775 -> 35.186.238.101:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49775 -> 35.186.238.101:80
Performs DNS queries to domains with low reputation
Source: C:\Windows\explorer.exe DNS query: www.f9fui8.xyz
Source: C:\Windows\explorer.exe DNS query: www.f9fui8.xyz
Source: C:\Windows\explorer.exe DNS query: www.f9fui8.xyz
Source: C:\Windows\explorer.exe DNS query: www.f9fui8.xyz
Source: C:\Windows\explorer.exe DNS query: www.f9fui8.xyz
Source: C:\Windows\explorer.exe DNS query: www.f9fui8.xyz
Source: C:\Windows\explorer.exe DNS query: www.f9fui8.xyz
Source: C:\Windows\explorer.exe DNS query: www.f9fui8.xyz
Uses netstat to query active network connections and open ports
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\NETSTAT.EXE
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=KE8gpfUEuqRqMBWGFV5goIwNmc44LE6Oi+PTcRo4vEp3RirjZlcD1GLbPH2NA5fTW+Y3K/xiNw==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.mobiessence.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=E0pe+Y2tlTeS/nkCAz5H/oSd7jolrcEyLM5+sA5RPKgWYHOxmsRP4IrVmGJTeseGmyQ7XT1Vgg==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.trendyheld.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=oQhTdcG1kNI9/Lmcc2Ae/5c2EVHHJUmgpucHXQ4UdnJs0zjkXV1wGSuIEzpJIo84TCfrKzWPPA==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.beastninjas.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=2ekFb54j3d1mky1ioMZXLX6Zs25on60VYd2MbHSx0a3rFw0M4/d2RTsPPkjiG9H4TZ6139bXkw==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.importexportasia.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=YkvzQHb0u0mjzgqcdkfc2nlAC0Yzm929bCO8fEJzAgzkJ6Iw6dVqaRJYZU+TtwSY8fdaCDocnA==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.kilbyrnefarm.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=5npnSCZ0ck9LfxTaUtRZHwWauGngCjsEHbJTec35d6ZUl1gSnMY6WOunSeDfnMtC3HJRIA/gUg==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.dragonshipping.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=djxA7LmI8yOR5lrxItMqg4jKcWhO49sHA38/CyXgFoUCakRbVREb3j6xA5Z01WfJADXfd3zybw==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.mylifeinpark.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=Dhv3NEq4M+QwROw+dIik/SqBuvIY1/ydOcQwMfpHsV2StOMLf1p+AXWBQfK1e2Gy8MhXWnKhDQ==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.delhibudokankarate.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=L6FmBYjymbItbbnnjd7yzq8hOevfuspHLpHNfkA4yzrvipy3lucWli1gmvwrFafR77bKFMYeeA==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.vavasoo.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=44unMI1Q/kB3N4iH8WCIjTNIPpmavX0UQR770OieCBmDyTCieL+ZZdhYfwuEfVyDA+gWGsSDYQ==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.schoolfrontoffice.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=U4etKMGlduRHKY34/y2VHJ3U/bl1CG9JeeGxs20P+eoGUQdkn77fFsSN2SlAgFKwyO8ri7IQTA==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.mypursuitpodcast.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=G66iPt+zysOdT87cMSNY3jIG1auw/RAx4PjK5prA1jAGCtavWTKfmUTffyE+Nzacke4pg1lsTg==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.besport24.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=KE8gpfUEuqRqMBWGFV5goIwNmc44LE6Oi+PTcRo4vEp3RirjZlcD1GLbPH2NA5fTW+Y3K/xiNw==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.mobiessence.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=E0pe+Y2tlTeS/nkCAz5H/oSd7jolrcEyLM5+sA5RPKgWYHOxmsRP4IrVmGJTeseGmyQ7XT1Vgg==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.trendyheld.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=oQhTdcG1kNI9/Lmcc2Ae/5c2EVHHJUmgpucHXQ4UdnJs0zjkXV1wGSuIEzpJIo84TCfrKzWPPA==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.beastninjas.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=2ekFb54j3d1mky1ioMZXLX6Zs25on60VYd2MbHSx0a3rFw0M4/d2RTsPPkjiG9H4TZ6139bXkw==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.importexportasia.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=YkvzQHb0u0mjzgqcdkfc2nlAC0Yzm929bCO8fEJzAgzkJ6Iw6dVqaRJYZU+TtwSY8fdaCDocnA==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.kilbyrnefarm.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=5npnSCZ0ck9LfxTaUtRZHwWauGngCjsEHbJTec35d6ZUl1gSnMY6WOunSeDfnMtC3HJRIA/gUg==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.dragonshipping.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=djxA7LmI8yOR5lrxItMqg4jKcWhO49sHA38/CyXgFoUCakRbVREb3j6xA5Z01WfJADXfd3zybw==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.mylifeinpark.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=Dhv3NEq4M+QwROw+dIik/SqBuvIY1/ydOcQwMfpHsV2StOMLf1p+AXWBQfK1e2Gy8MhXWnKhDQ==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.delhibudokankarate.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=KE8gpfUEuqRqMBWGFV5goIwNmc44LE6Oi+PTcRo4vEp3RirjZlcD1GLbPH2NA5fTW+Y3K/xiNw==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.mobiessence.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=E0pe+Y2tlTeS/nkCAz5H/oSd7jolrcEyLM5+sA5RPKgWYHOxmsRP4IrVmGJTeseGmyQ7XT1Vgg==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.trendyheld.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=oQhTdcG1kNI9/Lmcc2Ae/5c2EVHHJUmgpucHXQ4UdnJs0zjkXV1wGSuIEzpJIo84TCfrKzWPPA==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.beastninjas.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=2ekFb54j3d1mky1ioMZXLX6Zs25on60VYd2MbHSx0a3rFw0M4/d2RTsPPkjiG9H4TZ6139bXkw==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.importexportasia.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=YkvzQHb0u0mjzgqcdkfc2nlAC0Yzm929bCO8fEJzAgzkJ6Iw6dVqaRJYZU+TtwSY8fdaCDocnA==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.kilbyrnefarm.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=5npnSCZ0ck9LfxTaUtRZHwWauGngCjsEHbJTec35d6ZUl1gSnMY6WOunSeDfnMtC3HJRIA/gUg==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.dragonshipping.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=djxA7LmI8yOR5lrxItMqg4jKcWhO49sHA38/CyXgFoUCakRbVREb3j6xA5Z01WfJADXfd3zybw==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.mylifeinpark.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=Dhv3NEq4M+QwROw+dIik/SqBuvIY1/ydOcQwMfpHsV2StOMLf1p+AXWBQfK1e2Gy8MhXWnKhDQ==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.delhibudokankarate.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=L6FmBYjymbItbbnnjd7yzq8hOevfuspHLpHNfkA4yzrvipy3lucWli1gmvwrFafR77bKFMYeeA==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.vavasoo.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=44unMI1Q/kB3N4iH8WCIjTNIPpmavX0UQR770OieCBmDyTCieL+ZZdhYfwuEfVyDA+gWGsSDYQ==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.schoolfrontoffice.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=U4etKMGlduRHKY34/y2VHJ3U/bl1CG9JeeGxs20P+eoGUQdkn77fFsSN2SlAgFKwyO8ri7IQTA==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.mypursuitpodcast.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=G66iPt+zysOdT87cMSNY3jIG1auw/RAx4PjK5prA1jAGCtavWTKfmUTffyE+Nzacke4pg1lsTg==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.besport24.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=KE8gpfUEuqRqMBWGFV5goIwNmc44LE6Oi+PTcRo4vEp3RirjZlcD1GLbPH2NA5fTW+Y3K/xiNw==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.mobiessence.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=E0pe+Y2tlTeS/nkCAz5H/oSd7jolrcEyLM5+sA5RPKgWYHOxmsRP4IrVmGJTeseGmyQ7XT1Vgg==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.trendyheld.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=oQhTdcG1kNI9/Lmcc2Ae/5c2EVHHJUmgpucHXQ4UdnJs0zjkXV1wGSuIEzpJIo84TCfrKzWPPA==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.beastninjas.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=2ekFb54j3d1mky1ioMZXLX6Zs25on60VYd2MbHSx0a3rFw0M4/d2RTsPPkjiG9H4TZ6139bXkw==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.importexportasia.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=YkvzQHb0u0mjzgqcdkfc2nlAC0Yzm929bCO8fEJzAgzkJ6Iw6dVqaRJYZU+TtwSY8fdaCDocnA==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.kilbyrnefarm.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=5npnSCZ0ck9LfxTaUtRZHwWauGngCjsEHbJTec35d6ZUl1gSnMY6WOunSeDfnMtC3HJRIA/gUg==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.dragonshipping.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=djxA7LmI8yOR5lrxItMqg4jKcWhO49sHA38/CyXgFoUCakRbVREb3j6xA5Z01WfJADXfd3zybw==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.mylifeinpark.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /6mam/?wbYpSP=Dhv3NEq4M+QwROw+dIik/SqBuvIY1/ydOcQwMfpHsV2StOMLf1p+AXWBQfK1e2Gy8MhXWnKhDQ==&PJEt=HRR0_XgHGBD8 HTTP/1.1Host: www.delhibudokankarate.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: onedrive.live.com
Source: Form_TT_EUR57,890.exe, 00000001.00000003.341319212.00000000007A2000.00000004.00000001.sdmp, Fdhlajk.exe, 00000010.00000003.400962283.00000000008A4000.00000004.00000001.sdmp String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: Form_TT_EUR57,890.exe, 00000001.00000003.341319212.00000000007A2000.00000004.00000001.sdmp, Fdhlajk.exe, 00000010.00000003.400962283.00000000008A4000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.digicert.com0:
Source: Fdhlajk.exe, 00000010.00000003.400923077.0000000000899000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.msocsp.com0
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000008.00000000.468015221.000000000095C000.00000004.00000020.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000008.00000000.418360546.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: Fdhlajk.exe, 00000010.00000003.400962283.00000000008A4000.00000004.00000001.sdmp String found in binary or memory: https://pxqklq.sn.files.1drv.com/y4mAqf93vESEsLAwmv3Js3T3TVTVs9n9BMjWgdbjboex1CPBHIn5H8wAnTdclH8voCt
Source: rundll32.exe, 0000001C.00000002.865949851.0000000005342000.00000004.00000001.sdmp String found in binary or memory: https://www.cdnbest.com/?code=404

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Yara detected Keylogger Generic
Source: Yara match File source: Process Memory Space: Form_TT_EUR57,890.exe PID: 6840, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Fdhlajk.exe PID: 6148, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Fdhlajk.exe PID: 6496, type: MEMORYSTR

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 4.0.logagent.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.logagent.exe.10410000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.secinit.exe.10410000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.0.mshta.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.logagent.exe.10410000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.mshta.exe.10410000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.0.secinit.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.0.mshta.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.0.secinit.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.secinit.exe.10410000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.mshta.exe.10410000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.logagent.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001D.00000000.493724351.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.861918517.0000000000B80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.495868043.0000000002910000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.496343429.0000000002C80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.863420934.0000000002DD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000000.467594845.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.505021347.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.513499123.0000000004600000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.862165299.0000000000CB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.497909086.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.512339844.0000000002940000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.380848795.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.512824544.0000000002B50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.515478166.0000000010410000.00000040.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 4.0.logagent.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.0.logagent.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.logagent.exe.10410000.5.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.logagent.exe.10410000.5.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 29.2.secinit.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 29.2.secinit.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 26.0.mshta.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 26.0.mshta.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.logagent.exe.10410000.5.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.logagent.exe.10410000.5.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 26.2.mshta.exe.10410000.5.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 26.2.mshta.exe.10410000.5.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 29.0.secinit.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 29.0.secinit.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 26.0.mshta.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 26.0.mshta.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 29.0.secinit.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 29.0.secinit.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 29.2.secinit.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 29.2.secinit.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 26.2.mshta.exe.10410000.5.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 26.2.mshta.exe.10410000.5.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.0.logagent.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.0.logagent.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001D.00000000.493724351.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001D.00000000.493724351.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001C.00000002.861918517.0000000000B80000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001C.00000002.861918517.0000000000B80000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001A.00000002.495868043.0000000002910000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001A.00000002.495868043.0000000002910000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001A.00000002.496343429.0000000002C80000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001A.00000002.496343429.0000000002C80000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001C.00000002.863420934.0000000002DD0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001C.00000002.863420934.0000000002DD0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001A.00000000.467594845.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001A.00000000.467594845.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001D.00000002.505021347.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001D.00000002.505021347.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.513499123.0000000004600000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.513499123.0000000004600000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001C.00000002.862165299.0000000000CB0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001C.00000002.862165299.0000000000CB0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001A.00000002.497909086.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001A.00000002.497909086.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000023.00000002.512339844.0000000002940000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000023.00000002.512339844.0000000002940000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000000.380848795.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000000.380848795.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.512824544.0000000002B50000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.512824544.0000000002B50000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.515478166.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.515478166.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A98F0 NtReadVirtualMemory,LdrInitializeThunk, 4_2_049A98F0
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9840 NtDelayExecution,LdrInitializeThunk, 4_2_049A9840
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9860 NtQuerySystemInformation,LdrInitializeThunk, 4_2_049A9860
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A99A0 NtCreateSection,LdrInitializeThunk, 4_2_049A99A0
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A95D0 NtClose,LdrInitializeThunk, 4_2_049A95D0
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 4_2_049A9910
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9540 NtReadFile,LdrInitializeThunk, 4_2_049A9540
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A96E0 NtFreeVirtualMemory,LdrInitializeThunk, 4_2_049A96E0
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9A00 NtProtectVirtualMemory,LdrInitializeThunk, 4_2_049A9A00
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9A20 NtResumeThread,LdrInitializeThunk, 4_2_049A9A20
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9A50 NtCreateFile,LdrInitializeThunk, 4_2_049A9A50
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9660 NtAllocateVirtualMemory,LdrInitializeThunk, 4_2_049A9660
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9780 NtMapViewOfSection,LdrInitializeThunk, 4_2_049A9780
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A97A0 NtUnmapViewOfSection,LdrInitializeThunk, 4_2_049A97A0
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9FE0 NtCreateMutant,LdrInitializeThunk, 4_2_049A9FE0
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9710 NtQueryInformationToken,LdrInitializeThunk, 4_2_049A9710
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A98A0 NtWriteVirtualMemory, 4_2_049A98A0
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9820 NtEnumerateKey, 4_2_049A9820
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049AB040 NtSuspendThread, 4_2_049AB040
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A99D0 NtCreateProcessEx, 4_2_049A99D0
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A95F0 NtQueryInformationFile, 4_2_049A95F0
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049AAD30 NtSetContextThread, 4_2_049AAD30
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9520 NtWaitForSingleObject, 4_2_049A9520
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9950 NtQueueApcThread, 4_2_049A9950
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9560 NtWriteFile, 4_2_049A9560
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9A80 NtOpenDirectoryObject, 4_2_049A9A80
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A96D0 NtCreateKey, 4_2_049A96D0
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9610 NtEnumerateValueKey, 4_2_049A9610
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9A10 NtQuerySection, 4_2_049A9A10
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9650 NtQueryValueKey, 4_2_049A9650
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9670 NtQueryInformationProcess, 4_2_049A9670
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049AA3B0 NtGetContextThread, 4_2_049AA3B0
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049AA710 NtOpenProcessToken, 4_2_049AA710
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9B00 NtSetValueKey, 4_2_049A9B00
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9730 NtQueryVirtualMemory, 4_2_049A9730
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9770 NtSetInformationFile, 4_2_049A9770
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049AA770 NtOpenThread, 4_2_049AA770
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A9760 NtOpenProcess, 4_2_049A9760
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9710 NtQueryInformationToken,LdrInitializeThunk, 26_2_030E9710
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9780 NtMapViewOfSection,LdrInitializeThunk, 26_2_030E9780
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E97A0 NtUnmapViewOfSection,LdrInitializeThunk, 26_2_030E97A0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9FE0 NtCreateMutant,LdrInitializeThunk, 26_2_030E9FE0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9A00 NtProtectVirtualMemory,LdrInitializeThunk, 26_2_030E9A00
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9A20 NtResumeThread,LdrInitializeThunk, 26_2_030E9A20
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9A50 NtCreateFile,LdrInitializeThunk, 26_2_030E9A50
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9660 NtAllocateVirtualMemory,LdrInitializeThunk, 26_2_030E9660
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E96E0 NtFreeVirtualMemory,LdrInitializeThunk, 26_2_030E96E0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 26_2_030E9910
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9540 NtReadFile,LdrInitializeThunk, 26_2_030E9540
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E99A0 NtCreateSection,LdrInitializeThunk, 26_2_030E99A0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E95D0 NtClose,LdrInitializeThunk, 26_2_030E95D0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9840 NtDelayExecution,LdrInitializeThunk, 26_2_030E9840
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9860 NtQuerySystemInformation,LdrInitializeThunk, 26_2_030E9860
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E98F0 NtReadVirtualMemory,LdrInitializeThunk, 26_2_030E98F0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9B00 NtSetValueKey, 26_2_030E9B00
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030EA710 NtOpenProcessToken, 26_2_030EA710
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9730 NtQueryVirtualMemory, 26_2_030E9730
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9760 NtOpenProcess, 26_2_030E9760
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9770 NtSetInformationFile, 26_2_030E9770
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030EA770 NtOpenThread, 26_2_030EA770
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030EA3B0 NtGetContextThread, 26_2_030EA3B0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9610 NtEnumerateValueKey, 26_2_030E9610
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9A10 NtQuerySection, 26_2_030E9A10
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9650 NtQueryValueKey, 26_2_030E9650
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9670 NtQueryInformationProcess, 26_2_030E9670
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9A80 NtOpenDirectoryObject, 26_2_030E9A80
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E96D0 NtCreateKey, 26_2_030E96D0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9520 NtWaitForSingleObject, 26_2_030E9520
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030EAD30 NtSetContextThread, 26_2_030EAD30
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9950 NtQueueApcThread, 26_2_030E9950
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9560 NtWriteFile, 26_2_030E9560
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E99D0 NtCreateProcessEx, 26_2_030E99D0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E95F0 NtQueryInformationFile, 26_2_030E95F0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E9820 NtEnumerateKey, 26_2_030E9820
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030EB040 NtSuspendThread, 26_2_030EB040
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E98A0 NtWriteVirtualMemory, 26_2_030E98A0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_104281C0 NtCreateFile, 26_2_104281C0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_10428270 NtReadFile, 26_2_10428270
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_104282F0 NtClose, 26_2_104282F0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_104283A0 NtAllocateVirtualMemory, 26_2_104283A0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_104281BA NtCreateFile, 26_2_104281BA
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_1042826B NtReadFile, 26_2_1042826B
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_104282EA NtClose, 26_2_104282EA
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_1042839C NtAllocateVirtualMemory, 26_2_1042839C
Detected potential crypto function
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C9237F 1_3_02C9237F
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C92075 1_3_02C92075
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C921F8 1_3_02C921F8
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C92627 1_3_02C92627
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0497B090 4_2_0497B090
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0497841F 4_2_0497841F
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A21002 4_2_04A21002
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0496F900 4_2_0496F900
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04960D20 4_2_04960D20
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04984120 4_2_04984120
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A31D55 4_2_04A31D55
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04986E30 4_2_04986E30
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0499EBB0 4_2_0499EBB0
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 16_3_02CB237F 16_3_02CB237F
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 16_3_02CB2075 16_3_02CB2075
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 16_3_02CB21F8 16_3_02CB21F8
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 16_3_02CB2627 16_3_02CB2627
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 19_3_02CB237F 19_3_02CB237F
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 19_3_02CB2075 19_3_02CB2075
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 19_3_02CB21F8 19_3_02CB21F8
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 19_3_02CB2627 19_3_02CB2627
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03172B28 26_2_03172B28
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030DEBB0 26_2_030DEBB0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0316DBD2 26_2_0316DBD2
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03171FF1 26_2_03171FF1
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030C6E30 26_2_030C6E30
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_031722AE 26_2_031722AE
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03172EF7 26_2_03172EF7
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030AF900 26_2_030AF900
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03172D07 26_2_03172D07
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A0D20 26_2_030A0D20
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030C4120 26_2_030C4120
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03171D55 26_2_03171D55
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D2581 26_2_030D2581
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_031725DD 26_2_031725DD
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030BD5E0 26_2_030BD5E0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03161002 26_2_03161002
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B841F 26_2_030B841F
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030BB090 26_2_030BB090
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D20A0 26_2_030D20A0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_031720A8 26_2_031720A8
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_031728EC 26_2_031728EC
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_10411030 26_2_10411030
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_1042B889 26_2_1042B889
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_10418C60 26_2_10418C60
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_1042CCAE 26_2_1042CCAE
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_1042C55C 26_2_1042C55C
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_1042BD2F 26_2_1042BD2F
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_10412D87 26_2_10412D87
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_10412D90 26_2_10412D90
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_10412FB0 26_2_10412FB0
Found potential string decryption / allocating functions
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: String function: 02CA0668 appears 40 times
Source: C:\Windows\SysWOW64\mshta.exe Code function: String function: 030AB150 appears 35 times
PE file contains strange resources
Source: Form_TT_EUR57,890.exe Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Form_TT_EUR57,890.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Fdhlajk.exe.1.dr Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Fdhlajk.exe.1.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Tries to load missing DLLs
Source: C:\Windows\explorer.exe Section loaded: netapi32.dll Jump to behavior
Uses 32bit PE files
Source: Form_TT_EUR57,890.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
Uses reg.exe to modify the Windows registry
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete hkcu\Environment /v windir /f
Yara signature match
Source: 4.0.logagent.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.0.logagent.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.logagent.exe.10410000.5.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.logagent.exe.10410000.5.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 29.2.secinit.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 29.2.secinit.exe.10410000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 26.0.mshta.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 26.0.mshta.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.logagent.exe.10410000.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.logagent.exe.10410000.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 26.2.mshta.exe.10410000.5.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 26.2.mshta.exe.10410000.5.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 29.0.secinit.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 29.0.secinit.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 26.0.mshta.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 26.0.mshta.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 29.0.secinit.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 29.0.secinit.exe.10410000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 29.2.secinit.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 29.2.secinit.exe.10410000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 26.2.mshta.exe.10410000.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 26.2.mshta.exe.10410000.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.0.logagent.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.0.logagent.exe.10410000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000003.437045703.0000000002DE4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 0000001D.00000000.493724351.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001D.00000000.493724351.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000001C.00000002.861918517.0000000000B80000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001C.00000002.861918517.0000000000B80000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000003.362637084.0000000002DC4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 0000001A.00000002.495868043.0000000002910000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001A.00000002.495868043.0000000002910000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000001A.00000002.496343429.0000000002C80000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001A.00000002.496343429.0000000002C80000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000001C.00000002.863420934.0000000002DD0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001C.00000002.863420934.0000000002DD0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000003.437534855.0000000002DA8000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 0000001A.00000000.467594845.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001A.00000000.467594845.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000001D.00000002.505021347.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001D.00000002.505021347.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.513499123.0000000004600000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.513499123.0000000004600000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000003.362921408.0000000002D88000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 0000001C.00000002.862165299.0000000000CB0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001C.00000002.862165299.0000000000CB0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000001A.00000002.497909086.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001A.00000002.497909086.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000023.00000002.512339844.0000000002940000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000023.00000002.512339844.0000000002940000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000000.380848795.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000000.380848795.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.512824544.0000000002B50000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.512824544.0000000002B50000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000003.465981030.0000000002DA8000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000004.00000002.515478166.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.515478166.0000000010410000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000003.465812677.0000000002DE4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: C:\Users\Public\Libraries\kjalhdF.url, type: DROPPED Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: classification engine Classification label: mal100.troj.evad.winEXE@32/10@29/10
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90 Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6344:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2424:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6192:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6228:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5768:120:WilError_01
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Trast.bat' '
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
Source: Form_TT_EUR57,890.exe ReversingLabs: Detection: 19%
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe File read: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Form_TT_EUR57,890.exe 'C:\Users\user\Desktop\Form_TT_EUR57,890.exe'
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Process created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Trast.bat' '
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\nest.bat' '
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete hkcu\Environment /v windir /f
Source: C:\Windows\SysWOW64\reg.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe Process created: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe 'C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe'
Source: C:\Windows\explorer.exe Process created: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe 'C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe'
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Process created: C:\Windows\SysWOW64\mshta.exe C:\Windows\System32\mshta.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Process created: C:\Windows\SysWOW64\secinit.exe C:\Windows\System32\secinit.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\SysWOW64\mshta.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\NETSTAT.EXE
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Process created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe Jump to behavior
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Trast.bat' ' Jump to behavior
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\nest.bat' ' Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe 'C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe' Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete hkcu\Environment /v windir /f Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Process created: C:\Windows\SysWOW64\mshta.exe C:\Windows\System32\mshta.exe Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Process created: C:\Windows\SysWOW64\secinit.exe C:\Windows\System32\secinit.exe Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\SysWOW64\mshta.exe' Jump to behavior
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000008.00000000.411546423.0000000007BA0000.00000002.00000001.sdmp
Source: Binary string: mshta.pdbGCTL source: rundll32.exe, 0000001C.00000002.865904880.00000000051C7000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: logagent.exe, 00000004.00000002.513978427.0000000004A5F000.00000040.00000001.sdmp, mshta.exe, 0000001A.00000003.468583820.0000000002D50000.00000004.00000001.sdmp, rundll32.exe, 0000001C.00000002.863838057.0000000004C90000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: logagent.exe, mshta.exe, rundll32.exe, 0000001C.00000002.863838057.0000000004C90000.00000040.00000001.sdmp
Source: Binary string: rundll32.pdb source: mshta.exe, 0000001A.00000002.496580927.0000000002D00000.00000040.00000001.sdmp
Source: Binary string: rundll32.pdbGCTL source: mshta.exe, 0000001A.00000002.496580927.0000000002D00000.00000040.00000001.sdmp
Source: Binary string: mshta.pdb source: rundll32.exe, 0000001C.00000002.865904880.00000000051C7000.00000004.00000001.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 00000008.00000000.411546423.0000000007BA0000.00000002.00000001.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C88AAC push 0040FD9Ch; ret 1_3_02C88AD0
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C7C2AC push eax; ret 1_3_02C7C2E8
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C88AA5 push 0040FD9Ch; ret 1_3_02C88AD0
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C88A53 push 0040FD65h; ret 1_3_02C88A99
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C88A54 push 0040FD65h; ret 1_3_02C88A99
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C7F258 push 00406548h; ret 1_3_02C7F27C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C7F21E push 00406510h; ret 1_3_02C7F244
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C7F220 push 00406510h; ret 1_3_02C7F244
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C8D230 push ecx; mov dword ptr [esp], eax 1_3_02C8D233
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C8EBDC push ecx; mov dword ptr [esp], eax 1_3_02C8EBDF
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C8C3FF push 00413707h; ret 1_3_02C8C43B
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C8DB48 push 00414E38h; ret 1_3_02C8DB6C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C8DB46 push 00414E38h; ret 1_3_02C8DB6C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C888DC push 0040FC48h; ret 1_3_02C8897C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C8E8E4 push ecx; mov dword ptr [esp], edx 1_3_02C8E8E9
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C858FE push 0040CBF0h; ret 1_3_02C85924
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C85858 push 0040CB8Bh; ret 1_3_02C858BF
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C85856 push 0040CB8Bh; ret 1_3_02C858BF
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C88864 push 0040FB9Eh; ret 1_3_02C888D2
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C889F0 push 0040FCE0h; ret 1_3_02C88A14
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C88986 push 0040FCE0h; ret 1_3_02C88A14
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C8F168 push 004164BEh; ret 1_3_02C8F1F2
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C85900 push 0040CBF0h; ret 1_3_02C85924
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C85938 push 0040CC28h; ret 1_3_02C8595C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C86138 push 0040D428h; ret 1_3_02C8615C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C856D8 push 0040CB18h; ret 1_3_02C8584C
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C8BE72 push 004131E3h; ret 1_3_02C8BF17
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C8BE74 push 004131E3h; ret 1_3_02C8BF17
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C8BFCF push 004132D7h; ret 1_3_02C8C00B
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C8BFD0 push 004132D7h; ret 1_3_02C8C00B
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C7F7F8 push 00406AE8h; ret 1_3_02C7F81C

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe File created: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Jump to dropped file
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Fdhlajk Jump to behavior
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Fdhlajk Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Windows\SysWOW64\logagent.exe RDTSC instruction interceptor: First address: 00000000104185E4 second address: 00000000104185EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\logagent.exe RDTSC instruction interceptor: First address: 000000001041897E second address: 0000000010418984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mshta.exe RDTSC instruction interceptor: First address: 00000000104185E4 second address: 00000000104185EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mshta.exe RDTSC instruction interceptor: First address: 000000001041897E second address: 0000000010418984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe RDTSC instruction interceptor: First address: 0000000000B885E4 second address: 0000000000B885EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\secinit.exe RDTSC instruction interceptor: First address: 00000000104185E4 second address: 00000000104185EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe RDTSC instruction interceptor: First address: 0000000000B8897E second address: 0000000000B88984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\secinit.exe RDTSC instruction interceptor: First address: 000000001041897E second address: 0000000010418984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\NETSTAT.EXE RDTSC instruction interceptor: First address: 00000000029485E4 second address: 00000000029485EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\NETSTAT.EXE RDTSC instruction interceptor: First address: 000000000294897E second address: 0000000002948984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A6DE6 rdtsc 4_2_049A6DE6
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 6064 Thread sleep time: -95000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: explorer.exe, 00000008.00000000.413574464.00000000083E7000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000008.00000000.413920977.0000000008430000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000008.00000000.400447789.0000000005D50000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000008.00000000.402875441.00000000062E0000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.414996471.0000000008550000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Bk?
Source: explorer.exe, 00000008.00000000.413574464.00000000083E7000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000008.00000000.414996471.0000000008550000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B&9]
Source: explorer.exe, 00000008.00000000.402875441.00000000062E0000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.414955487.0000000008540000.00000004.00000001.sdmp Binary or memory string: Prod_VMware_SATA-
Source: explorer.exe, 00000008.00000000.414996471.0000000008550000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B
Source: explorer.exe, 00000008.00000000.413126588.00000000082E2000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 00000008.00000000.400447789.0000000005D50000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000008.00000000.400447789.0000000005D50000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000008.00000000.413126588.00000000082E2000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000008.00000000.413920977.0000000008430000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: explorer.exe, 00000008.00000000.468015221.000000000095C000.00000004.00000020.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G
Source: explorer.exe, 00000008.00000000.400447789.0000000005D50000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Windows\SysWOW64\logagent.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\logagent.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A6DE6 rdtsc 4_2_049A6DE6
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A98F0 NtReadVirtualMemory,LdrInitializeThunk, 4_2_049A98F0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C8F0F0 push dword ptr fs:[00000030h] 1_3_02C8F0F0
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C8F120 mov eax, dword ptr fs:[00000030h] 1_3_02C8F120
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Code function: 1_3_02C8E480 mov eax, dword ptr fs:[00000030h] 1_3_02C8E480
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04969080 mov eax, dword ptr fs:[00000030h] 4_2_04969080
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049E3884 mov eax, dword ptr fs:[00000030h] 4_2_049E3884
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049E3884 mov eax, dword ptr fs:[00000030h] 4_2_049E3884
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0499F0BF mov ecx, dword ptr fs:[00000030h] 4_2_0499F0BF
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0499F0BF mov eax, dword ptr fs:[00000030h] 4_2_0499F0BF
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0499F0BF mov eax, dword ptr fs:[00000030h] 4_2_0499F0BF
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A90AF mov eax, dword ptr fs:[00000030h] 4_2_049A90AF
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049FB8D0 mov eax, dword ptr fs:[00000030h] 4_2_049FB8D0
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049FB8D0 mov ecx, dword ptr fs:[00000030h] 4_2_049FB8D0
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049FB8D0 mov eax, dword ptr fs:[00000030h] 4_2_049FB8D0
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049FB8D0 mov eax, dword ptr fs:[00000030h] 4_2_049FB8D0
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049FB8D0 mov eax, dword ptr fs:[00000030h] 4_2_049FB8D0
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049FB8D0 mov eax, dword ptr fs:[00000030h] 4_2_049FB8D0
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A214FB mov eax, dword ptr fs:[00000030h] 4_2_04A214FB
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A38CD6 mov eax, dword ptr fs:[00000030h] 4_2_04A38CD6
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049E7016 mov eax, dword ptr fs:[00000030h] 4_2_049E7016
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049E7016 mov eax, dword ptr fs:[00000030h] 4_2_049E7016
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049E7016 mov eax, dword ptr fs:[00000030h] 4_2_049E7016
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049E6C0A mov eax, dword ptr fs:[00000030h] 4_2_049E6C0A
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049E6C0A mov eax, dword ptr fs:[00000030h] 4_2_049E6C0A
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049E6C0A mov eax, dword ptr fs:[00000030h] 4_2_049E6C0A
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049E6C0A mov eax, dword ptr fs:[00000030h] 4_2_049E6C0A
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A21C06 mov eax, dword ptr fs:[00000030h] 4_2_04A21C06
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A21C06 mov eax, dword ptr fs:[00000030h] 4_2_04A21C06
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A21C06 mov eax, dword ptr fs:[00000030h] 4_2_04A21C06
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A21C06 mov eax, dword ptr fs:[00000030h] 4_2_04A21C06
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A21C06 mov eax, dword ptr fs:[00000030h] 4_2_04A21C06
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A21C06 mov eax, dword ptr fs:[00000030h] 4_2_04A21C06
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A21C06 mov eax, dword ptr fs:[00000030h] 4_2_04A21C06
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A21C06 mov eax, dword ptr fs:[00000030h] 4_2_04A21C06
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A21C06 mov eax, dword ptr fs:[00000030h] 4_2_04A21C06
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A21C06 mov eax, dword ptr fs:[00000030h] 4_2_04A21C06
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A21C06 mov eax, dword ptr fs:[00000030h] 4_2_04A21C06
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A21C06 mov eax, dword ptr fs:[00000030h] 4_2_04A21C06
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A21C06 mov eax, dword ptr fs:[00000030h] 4_2_04A21C06
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A21C06 mov eax, dword ptr fs:[00000030h] 4_2_04A21C06
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A3740D mov eax, dword ptr fs:[00000030h] 4_2_04A3740D
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A3740D mov eax, dword ptr fs:[00000030h] 4_2_04A3740D
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A3740D mov eax, dword ptr fs:[00000030h] 4_2_04A3740D
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0499BC2C mov eax, dword ptr fs:[00000030h] 4_2_0499BC2C
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A34015 mov eax, dword ptr fs:[00000030h] 4_2_04A34015
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A34015 mov eax, dword ptr fs:[00000030h] 4_2_04A34015
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0497B02A mov eax, dword ptr fs:[00000030h] 4_2_0497B02A
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0497B02A mov eax, dword ptr fs:[00000030h] 4_2_0497B02A
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0497B02A mov eax, dword ptr fs:[00000030h] 4_2_0497B02A
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0497B02A mov eax, dword ptr fs:[00000030h] 4_2_0497B02A
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04980050 mov eax, dword ptr fs:[00000030h] 4_2_04980050
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04980050 mov eax, dword ptr fs:[00000030h] 4_2_04980050
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049FC450 mov eax, dword ptr fs:[00000030h] 4_2_049FC450
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049FC450 mov eax, dword ptr fs:[00000030h] 4_2_049FC450
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A22073 mov eax, dword ptr fs:[00000030h] 4_2_04A22073
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A31074 mov eax, dword ptr fs:[00000030h] 4_2_04A31074
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0498746D mov eax, dword ptr fs:[00000030h] 4_2_0498746D
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0499FD9B mov eax, dword ptr fs:[00000030h] 4_2_0499FD9B
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0499FD9B mov eax, dword ptr fs:[00000030h] 4_2_0499FD9B
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0498C182 mov eax, dword ptr fs:[00000030h] 4_2_0498C182
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0499A185 mov eax, dword ptr fs:[00000030h] 4_2_0499A185
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04962D8A mov eax, dword ptr fs:[00000030h] 4_2_04962D8A
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04962D8A mov eax, dword ptr fs:[00000030h] 4_2_04962D8A
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04962D8A mov eax, dword ptr fs:[00000030h] 4_2_04962D8A
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04962D8A mov eax, dword ptr fs:[00000030h] 4_2_04962D8A
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04962D8A mov eax, dword ptr fs:[00000030h] 4_2_04962D8A
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049935A1 mov eax, dword ptr fs:[00000030h] 4_2_049935A1
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A18DF1 mov eax, dword ptr fs:[00000030h] 4_2_04A18DF1
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0496B1E1 mov eax, dword ptr fs:[00000030h] 4_2_0496B1E1
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0496B1E1 mov eax, dword ptr fs:[00000030h] 4_2_0496B1E1
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0496B1E1 mov eax, dword ptr fs:[00000030h] 4_2_0496B1E1
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04969100 mov eax, dword ptr fs:[00000030h] 4_2_04969100
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04969100 mov eax, dword ptr fs:[00000030h] 4_2_04969100
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04969100 mov eax, dword ptr fs:[00000030h] 4_2_04969100
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A38D34 mov eax, dword ptr fs:[00000030h] 4_2_04A38D34
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04994D3B mov eax, dword ptr fs:[00000030h] 4_2_04994D3B
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04994D3B mov eax, dword ptr fs:[00000030h] 4_2_04994D3B
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04994D3B mov eax, dword ptr fs:[00000030h] 4_2_04994D3B
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0499513A mov eax, dword ptr fs:[00000030h] 4_2_0499513A
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0499513A mov eax, dword ptr fs:[00000030h] 4_2_0499513A
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04973D34 mov eax, dword ptr fs:[00000030h] 4_2_04973D34
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04973D34 mov eax, dword ptr fs:[00000030h] 4_2_04973D34
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04973D34 mov eax, dword ptr fs:[00000030h] 4_2_04973D34
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04973D34 mov eax, dword ptr fs:[00000030h] 4_2_04973D34
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04973D34 mov eax, dword ptr fs:[00000030h] 4_2_04973D34
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04973D34 mov eax, dword ptr fs:[00000030h] 4_2_04973D34
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04973D34 mov eax, dword ptr fs:[00000030h] 4_2_04973D34
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04973D34 mov eax, dword ptr fs:[00000030h] 4_2_04973D34
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04973D34 mov eax, dword ptr fs:[00000030h] 4_2_04973D34
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04973D34 mov eax, dword ptr fs:[00000030h] 4_2_04973D34
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04973D34 mov eax, dword ptr fs:[00000030h] 4_2_04973D34
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04973D34 mov eax, dword ptr fs:[00000030h] 4_2_04973D34
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04973D34 mov eax, dword ptr fs:[00000030h] 4_2_04973D34
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0496AD30 mov eax, dword ptr fs:[00000030h] 4_2_0496AD30
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04984120 mov eax, dword ptr fs:[00000030h] 4_2_04984120
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04984120 mov eax, dword ptr fs:[00000030h] 4_2_04984120
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04984120 mov eax, dword ptr fs:[00000030h] 4_2_04984120
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04984120 mov eax, dword ptr fs:[00000030h] 4_2_04984120
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04984120 mov ecx, dword ptr fs:[00000030h] 4_2_04984120
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04987D50 mov eax, dword ptr fs:[00000030h] 4_2_04987D50
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A3D43 mov eax, dword ptr fs:[00000030h] 4_2_049A3D43
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0498B944 mov eax, dword ptr fs:[00000030h] 4_2_0498B944
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0498B944 mov eax, dword ptr fs:[00000030h] 4_2_0498B944
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049E3540 mov eax, dword ptr fs:[00000030h] 4_2_049E3540
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0496B171 mov eax, dword ptr fs:[00000030h] 4_2_0496B171
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0496B171 mov eax, dword ptr fs:[00000030h] 4_2_0496B171
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0498C577 mov eax, dword ptr fs:[00000030h] 4_2_0498C577
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0498C577 mov eax, dword ptr fs:[00000030h] 4_2_0498C577
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A30EA5 mov eax, dword ptr fs:[00000030h] 4_2_04A30EA5
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A30EA5 mov eax, dword ptr fs:[00000030h] 4_2_04A30EA5
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A30EA5 mov eax, dword ptr fs:[00000030h] 4_2_04A30EA5
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0499D294 mov eax, dword ptr fs:[00000030h] 4_2_0499D294
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0499D294 mov eax, dword ptr fs:[00000030h] 4_2_0499D294
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049FFE87 mov eax, dword ptr fs:[00000030h] 4_2_049FFE87
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0499FAB0 mov eax, dword ptr fs:[00000030h] 4_2_0499FAB0
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049652A5 mov eax, dword ptr fs:[00000030h] 4_2_049652A5
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049652A5 mov eax, dword ptr fs:[00000030h] 4_2_049652A5
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049652A5 mov eax, dword ptr fs:[00000030h] 4_2_049652A5
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049652A5 mov eax, dword ptr fs:[00000030h] 4_2_049652A5
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049652A5 mov eax, dword ptr fs:[00000030h] 4_2_049652A5
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049E46A7 mov eax, dword ptr fs:[00000030h] 4_2_049E46A7
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049936CC mov eax, dword ptr fs:[00000030h] 4_2_049936CC
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A8EC7 mov eax, dword ptr fs:[00000030h] 4_2_049A8EC7
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A1FEC0 mov eax, dword ptr fs:[00000030h] 4_2_04A1FEC0
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A38ED6 mov eax, dword ptr fs:[00000030h] 4_2_04A38ED6
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049776E2 mov eax, dword ptr fs:[00000030h] 4_2_049776E2
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049916E0 mov ecx, dword ptr fs:[00000030h] 4_2_049916E0
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0496C600 mov eax, dword ptr fs:[00000030h] 4_2_0496C600
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0496C600 mov eax, dword ptr fs:[00000030h] 4_2_0496C600
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0496C600 mov eax, dword ptr fs:[00000030h] 4_2_0496C600
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A1FE3F mov eax, dword ptr fs:[00000030h] 4_2_04A1FE3F
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0496E620 mov eax, dword ptr fs:[00000030h] 4_2_0496E620
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A1B260 mov eax, dword ptr fs:[00000030h] 4_2_04A1B260
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A1B260 mov eax, dword ptr fs:[00000030h] 4_2_04A1B260
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A38A62 mov eax, dword ptr fs:[00000030h] 4_2_04A38A62
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04969240 mov eax, dword ptr fs:[00000030h] 4_2_04969240
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04969240 mov eax, dword ptr fs:[00000030h] 4_2_04969240
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04969240 mov eax, dword ptr fs:[00000030h] 4_2_04969240
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04969240 mov eax, dword ptr fs:[00000030h] 4_2_04969240
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04977E41 mov eax, dword ptr fs:[00000030h] 4_2_04977E41
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04977E41 mov eax, dword ptr fs:[00000030h] 4_2_04977E41
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04977E41 mov eax, dword ptr fs:[00000030h] 4_2_04977E41
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04977E41 mov eax, dword ptr fs:[00000030h] 4_2_04977E41
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04977E41 mov eax, dword ptr fs:[00000030h] 4_2_04977E41
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04977E41 mov eax, dword ptr fs:[00000030h] 4_2_04977E41
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049A927A mov eax, dword ptr fs:[00000030h] 4_2_049A927A
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0498AE73 mov eax, dword ptr fs:[00000030h] 4_2_0498AE73
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0498AE73 mov eax, dword ptr fs:[00000030h] 4_2_0498AE73
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0498AE73 mov eax, dword ptr fs:[00000030h] 4_2_0498AE73
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0498AE73 mov eax, dword ptr fs:[00000030h] 4_2_0498AE73
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0498AE73 mov eax, dword ptr fs:[00000030h] 4_2_0498AE73
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0497766D mov eax, dword ptr fs:[00000030h] 4_2_0497766D
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A35BA5 mov eax, dword ptr fs:[00000030h] 4_2_04A35BA5
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049E7794 mov eax, dword ptr fs:[00000030h] 4_2_049E7794
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049E7794 mov eax, dword ptr fs:[00000030h] 4_2_049E7794
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049E7794 mov eax, dword ptr fs:[00000030h] 4_2_049E7794
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04971B8F mov eax, dword ptr fs:[00000030h] 4_2_04971B8F
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04971B8F mov eax, dword ptr fs:[00000030h] 4_2_04971B8F
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A1D380 mov ecx, dword ptr fs:[00000030h] 4_2_04A1D380
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A2138A mov eax, dword ptr fs:[00000030h] 4_2_04A2138A
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049FFF10 mov eax, dword ptr fs:[00000030h] 4_2_049FFF10
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_049FFF10 mov eax, dword ptr fs:[00000030h] 4_2_049FFF10
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0499E730 mov eax, dword ptr fs:[00000030h] 4_2_0499E730
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A3070D mov eax, dword ptr fs:[00000030h] 4_2_04A3070D
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A3070D mov eax, dword ptr fs:[00000030h] 4_2_04A3070D
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04964F2E mov eax, dword ptr fs:[00000030h] 4_2_04964F2E
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04964F2E mov eax, dword ptr fs:[00000030h] 4_2_04964F2E
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A2131B mov eax, dword ptr fs:[00000030h] 4_2_04A2131B
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A38F6A mov eax, dword ptr fs:[00000030h] 4_2_04A38F6A
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0496F358 mov eax, dword ptr fs:[00000030h] 4_2_0496F358
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0496DB40 mov eax, dword ptr fs:[00000030h] 4_2_0496DB40
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0497EF40 mov eax, dword ptr fs:[00000030h] 4_2_0497EF40
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04993B7A mov eax, dword ptr fs:[00000030h] 4_2_04993B7A
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04993B7A mov eax, dword ptr fs:[00000030h] 4_2_04993B7A
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0496DB60 mov ecx, dword ptr fs:[00000030h] 4_2_0496DB60
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_0497FF60 mov eax, dword ptr fs:[00000030h] 4_2_0497FF60
Source: C:\Windows\SysWOW64\logagent.exe Code function: 4_2_04A38B58 mov eax, dword ptr fs:[00000030h] 4_2_04A38B58
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 16_3_02CAF0F0 push dword ptr fs:[00000030h] 16_3_02CAF0F0
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 16_3_02CAF120 mov eax, dword ptr fs:[00000030h] 16_3_02CAF120
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 16_3_02CAE480 mov eax, dword ptr fs:[00000030h] 16_3_02CAE480
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 19_3_02CAF0F0 push dword ptr fs:[00000030h] 19_3_02CAF0F0
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 19_3_02CAF120 mov eax, dword ptr fs:[00000030h] 19_3_02CAF120
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 19_3_02CAE480 mov eax, dword ptr fs:[00000030h] 19_3_02CAE480
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 19_3_02D782E0 mov eax, dword ptr fs:[00000030h] 19_3_02D782E0
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 19_3_02D78F80 mov eax, dword ptr fs:[00000030h] 19_3_02D78F80
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Code function: 19_3_02D78F50 push dword ptr fs:[00000030h] 19_3_02D78F50
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0313FF10 mov eax, dword ptr fs:[00000030h] 26_2_0313FF10
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0313FF10 mov eax, dword ptr fs:[00000030h] 26_2_0313FF10
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030DA70E mov eax, dword ptr fs:[00000030h] 26_2_030DA70E
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030DA70E mov eax, dword ptr fs:[00000030h] 26_2_030DA70E
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0316131B mov eax, dword ptr fs:[00000030h] 26_2_0316131B
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0317070D mov eax, dword ptr fs:[00000030h] 26_2_0317070D
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0317070D mov eax, dword ptr fs:[00000030h] 26_2_0317070D
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030CF716 mov eax, dword ptr fs:[00000030h] 26_2_030CF716
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A4F2E mov eax, dword ptr fs:[00000030h] 26_2_030A4F2E
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A4F2E mov eax, dword ptr fs:[00000030h] 26_2_030A4F2E
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030DE730 mov eax, dword ptr fs:[00000030h] 26_2_030DE730
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030ADB40 mov eax, dword ptr fs:[00000030h] 26_2_030ADB40
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030BEF40 mov eax, dword ptr fs:[00000030h] 26_2_030BEF40
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03178B58 mov eax, dword ptr fs:[00000030h] 26_2_03178B58
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030AF358 mov eax, dword ptr fs:[00000030h] 26_2_030AF358
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030ADB60 mov ecx, dword ptr fs:[00000030h] 26_2_030ADB60
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030BFF60 mov eax, dword ptr fs:[00000030h] 26_2_030BFF60
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D3B7A mov eax, dword ptr fs:[00000030h] 26_2_030D3B7A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D3B7A mov eax, dword ptr fs:[00000030h] 26_2_030D3B7A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03178F6A mov eax, dword ptr fs:[00000030h] 26_2_03178F6A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B1B8F mov eax, dword ptr fs:[00000030h] 26_2_030B1B8F
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B1B8F mov eax, dword ptr fs:[00000030h] 26_2_030B1B8F
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03127794 mov eax, dword ptr fs:[00000030h] 26_2_03127794
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03127794 mov eax, dword ptr fs:[00000030h] 26_2_03127794
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03127794 mov eax, dword ptr fs:[00000030h] 26_2_03127794
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0315D380 mov ecx, dword ptr fs:[00000030h] 26_2_0315D380
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D2397 mov eax, dword ptr fs:[00000030h] 26_2_030D2397
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0316138A mov eax, dword ptr fs:[00000030h] 26_2_0316138A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030DB390 mov eax, dword ptr fs:[00000030h] 26_2_030DB390
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B8794 mov eax, dword ptr fs:[00000030h] 26_2_030B8794
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D4BAD mov eax, dword ptr fs:[00000030h] 26_2_030D4BAD
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D4BAD mov eax, dword ptr fs:[00000030h] 26_2_030D4BAD
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D4BAD mov eax, dword ptr fs:[00000030h] 26_2_030D4BAD
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03175BA5 mov eax, dword ptr fs:[00000030h] 26_2_03175BA5
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_031253CA mov eax, dword ptr fs:[00000030h] 26_2_031253CA
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_031253CA mov eax, dword ptr fs:[00000030h] 26_2_031253CA
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030CDBE9 mov eax, dword ptr fs:[00000030h] 26_2_030CDBE9
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D03E2 mov eax, dword ptr fs:[00000030h] 26_2_030D03E2
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D03E2 mov eax, dword ptr fs:[00000030h] 26_2_030D03E2
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D03E2 mov eax, dword ptr fs:[00000030h] 26_2_030D03E2
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D03E2 mov eax, dword ptr fs:[00000030h] 26_2_030D03E2
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D03E2 mov eax, dword ptr fs:[00000030h] 26_2_030D03E2
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D03E2 mov eax, dword ptr fs:[00000030h] 26_2_030D03E2
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E37F5 mov eax, dword ptr fs:[00000030h] 26_2_030E37F5
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B8A0A mov eax, dword ptr fs:[00000030h] 26_2_030B8A0A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030AC600 mov eax, dword ptr fs:[00000030h] 26_2_030AC600
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030AC600 mov eax, dword ptr fs:[00000030h] 26_2_030AC600
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030AC600 mov eax, dword ptr fs:[00000030h] 26_2_030AC600
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D8E00 mov eax, dword ptr fs:[00000030h] 26_2_030D8E00
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030C3A1C mov eax, dword ptr fs:[00000030h] 26_2_030C3A1C
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030DA61C mov eax, dword ptr fs:[00000030h] 26_2_030DA61C
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030DA61C mov eax, dword ptr fs:[00000030h] 26_2_030DA61C
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A5210 mov eax, dword ptr fs:[00000030h] 26_2_030A5210
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A5210 mov ecx, dword ptr fs:[00000030h] 26_2_030A5210
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A5210 mov eax, dword ptr fs:[00000030h] 26_2_030A5210
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A5210 mov eax, dword ptr fs:[00000030h] 26_2_030A5210
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030AAA16 mov eax, dword ptr fs:[00000030h] 26_2_030AAA16
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030AAA16 mov eax, dword ptr fs:[00000030h] 26_2_030AAA16
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03161608 mov eax, dword ptr fs:[00000030h] 26_2_03161608
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E4A2C mov eax, dword ptr fs:[00000030h] 26_2_030E4A2C
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E4A2C mov eax, dword ptr fs:[00000030h] 26_2_030E4A2C
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0315FE3F mov eax, dword ptr fs:[00000030h] 26_2_0315FE3F
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030AE620 mov eax, dword ptr fs:[00000030h] 26_2_030AE620
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0316EA55 mov eax, dword ptr fs:[00000030h] 26_2_0316EA55
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03134257 mov eax, dword ptr fs:[00000030h] 26_2_03134257
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A9240 mov eax, dword ptr fs:[00000030h] 26_2_030A9240
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A9240 mov eax, dword ptr fs:[00000030h] 26_2_030A9240
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A9240 mov eax, dword ptr fs:[00000030h] 26_2_030A9240
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A9240 mov eax, dword ptr fs:[00000030h] 26_2_030A9240
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B7E41 mov eax, dword ptr fs:[00000030h] 26_2_030B7E41
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B7E41 mov eax, dword ptr fs:[00000030h] 26_2_030B7E41
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B7E41 mov eax, dword ptr fs:[00000030h] 26_2_030B7E41
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B7E41 mov eax, dword ptr fs:[00000030h] 26_2_030B7E41
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B7E41 mov eax, dword ptr fs:[00000030h] 26_2_030B7E41
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B7E41 mov eax, dword ptr fs:[00000030h] 26_2_030B7E41
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0316AE44 mov eax, dword ptr fs:[00000030h] 26_2_0316AE44
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0316AE44 mov eax, dword ptr fs:[00000030h] 26_2_0316AE44
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B766D mov eax, dword ptr fs:[00000030h] 26_2_030B766D
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E927A mov eax, dword ptr fs:[00000030h] 26_2_030E927A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0315B260 mov eax, dword ptr fs:[00000030h] 26_2_0315B260
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0315B260 mov eax, dword ptr fs:[00000030h] 26_2_0315B260
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03178A62 mov eax, dword ptr fs:[00000030h] 26_2_03178A62
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030CAE73 mov eax, dword ptr fs:[00000030h] 26_2_030CAE73
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030CAE73 mov eax, dword ptr fs:[00000030h] 26_2_030CAE73
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030CAE73 mov eax, dword ptr fs:[00000030h] 26_2_030CAE73
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030CAE73 mov eax, dword ptr fs:[00000030h] 26_2_030CAE73
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030CAE73 mov eax, dword ptr fs:[00000030h] 26_2_030CAE73
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0313FE87 mov eax, dword ptr fs:[00000030h] 26_2_0313FE87
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030DD294 mov eax, dword ptr fs:[00000030h] 26_2_030DD294
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030DD294 mov eax, dword ptr fs:[00000030h] 26_2_030DD294
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A52A5 mov eax, dword ptr fs:[00000030h] 26_2_030A52A5
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A52A5 mov eax, dword ptr fs:[00000030h] 26_2_030A52A5
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A52A5 mov eax, dword ptr fs:[00000030h] 26_2_030A52A5
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A52A5 mov eax, dword ptr fs:[00000030h] 26_2_030A52A5
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A52A5 mov eax, dword ptr fs:[00000030h] 26_2_030A52A5
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03170EA5 mov eax, dword ptr fs:[00000030h] 26_2_03170EA5
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03170EA5 mov eax, dword ptr fs:[00000030h] 26_2_03170EA5
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03170EA5 mov eax, dword ptr fs:[00000030h] 26_2_03170EA5
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_031246A7 mov eax, dword ptr fs:[00000030h] 26_2_031246A7
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030BAAB0 mov eax, dword ptr fs:[00000030h] 26_2_030BAAB0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030BAAB0 mov eax, dword ptr fs:[00000030h] 26_2_030BAAB0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030DFAB0 mov eax, dword ptr fs:[00000030h] 26_2_030DFAB0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03178ED6 mov eax, dword ptr fs:[00000030h] 26_2_03178ED6
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D36CC mov eax, dword ptr fs:[00000030h] 26_2_030D36CC
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D2ACB mov eax, dword ptr fs:[00000030h] 26_2_030D2ACB
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E8EC7 mov eax, dword ptr fs:[00000030h] 26_2_030E8EC7
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0315FEC0 mov eax, dword ptr fs:[00000030h] 26_2_0315FEC0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B76E2 mov eax, dword ptr fs:[00000030h] 26_2_030B76E2
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D2AE4 mov eax, dword ptr fs:[00000030h] 26_2_030D2AE4
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D16E0 mov ecx, dword ptr fs:[00000030h] 26_2_030D16E0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A9100 mov eax, dword ptr fs:[00000030h] 26_2_030A9100
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A9100 mov eax, dword ptr fs:[00000030h] 26_2_030A9100
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A9100 mov eax, dword ptr fs:[00000030h] 26_2_030A9100
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03178D34 mov eax, dword ptr fs:[00000030h] 26_2_03178D34
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0312A537 mov eax, dword ptr fs:[00000030h] 26_2_0312A537
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030C4120 mov eax, dword ptr fs:[00000030h] 26_2_030C4120
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030C4120 mov eax, dword ptr fs:[00000030h] 26_2_030C4120
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030C4120 mov eax, dword ptr fs:[00000030h] 26_2_030C4120
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030C4120 mov eax, dword ptr fs:[00000030h] 26_2_030C4120
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030C4120 mov ecx, dword ptr fs:[00000030h] 26_2_030C4120
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0316E539 mov eax, dword ptr fs:[00000030h] 26_2_0316E539
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D4D3B mov eax, dword ptr fs:[00000030h] 26_2_030D4D3B
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D4D3B mov eax, dword ptr fs:[00000030h] 26_2_030D4D3B
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D4D3B mov eax, dword ptr fs:[00000030h] 26_2_030D4D3B
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D513A mov eax, dword ptr fs:[00000030h] 26_2_030D513A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D513A mov eax, dword ptr fs:[00000030h] 26_2_030D513A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030AAD30 mov eax, dword ptr fs:[00000030h] 26_2_030AAD30
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B3D34 mov eax, dword ptr fs:[00000030h] 26_2_030B3D34
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B3D34 mov eax, dword ptr fs:[00000030h] 26_2_030B3D34
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B3D34 mov eax, dword ptr fs:[00000030h] 26_2_030B3D34
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B3D34 mov eax, dword ptr fs:[00000030h] 26_2_030B3D34
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B3D34 mov eax, dword ptr fs:[00000030h] 26_2_030B3D34
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B3D34 mov eax, dword ptr fs:[00000030h] 26_2_030B3D34
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B3D34 mov eax, dword ptr fs:[00000030h] 26_2_030B3D34
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B3D34 mov eax, dword ptr fs:[00000030h] 26_2_030B3D34
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B3D34 mov eax, dword ptr fs:[00000030h] 26_2_030B3D34
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B3D34 mov eax, dword ptr fs:[00000030h] 26_2_030B3D34
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B3D34 mov eax, dword ptr fs:[00000030h] 26_2_030B3D34
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B3D34 mov eax, dword ptr fs:[00000030h] 26_2_030B3D34
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B3D34 mov eax, dword ptr fs:[00000030h] 26_2_030B3D34
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030CB944 mov eax, dword ptr fs:[00000030h] 26_2_030CB944
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030CB944 mov eax, dword ptr fs:[00000030h] 26_2_030CB944
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E3D43 mov eax, dword ptr fs:[00000030h] 26_2_030E3D43
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03123540 mov eax, dword ptr fs:[00000030h] 26_2_03123540
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030C7D50 mov eax, dword ptr fs:[00000030h] 26_2_030C7D50
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030AC962 mov eax, dword ptr fs:[00000030h] 26_2_030AC962
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030AB171 mov eax, dword ptr fs:[00000030h] 26_2_030AB171
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030AB171 mov eax, dword ptr fs:[00000030h] 26_2_030AB171
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030CC577 mov eax, dword ptr fs:[00000030h] 26_2_030CC577
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030CC577 mov eax, dword ptr fs:[00000030h] 26_2_030CC577
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A2D8A mov eax, dword ptr fs:[00000030h] 26_2_030A2D8A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A2D8A mov eax, dword ptr fs:[00000030h] 26_2_030A2D8A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A2D8A mov eax, dword ptr fs:[00000030h] 26_2_030A2D8A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A2D8A mov eax, dword ptr fs:[00000030h] 26_2_030A2D8A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A2D8A mov eax, dword ptr fs:[00000030h] 26_2_030A2D8A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030DA185 mov eax, dword ptr fs:[00000030h] 26_2_030DA185
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D2581 mov eax, dword ptr fs:[00000030h] 26_2_030D2581
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D2581 mov eax, dword ptr fs:[00000030h] 26_2_030D2581
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D2581 mov eax, dword ptr fs:[00000030h] 26_2_030D2581
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D2581 mov eax, dword ptr fs:[00000030h] 26_2_030D2581
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030CC182 mov eax, dword ptr fs:[00000030h] 26_2_030CC182
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030DFD9B mov eax, dword ptr fs:[00000030h] 26_2_030DFD9B
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030DFD9B mov eax, dword ptr fs:[00000030h] 26_2_030DFD9B
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D2990 mov eax, dword ptr fs:[00000030h] 26_2_030D2990
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D35A1 mov eax, dword ptr fs:[00000030h] 26_2_030D35A1
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_031251BE mov eax, dword ptr fs:[00000030h] 26_2_031251BE
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_031251BE mov eax, dword ptr fs:[00000030h] 26_2_031251BE
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_031251BE mov eax, dword ptr fs:[00000030h] 26_2_031251BE
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_031251BE mov eax, dword ptr fs:[00000030h] 26_2_031251BE
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D61A0 mov eax, dword ptr fs:[00000030h] 26_2_030D61A0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D61A0 mov eax, dword ptr fs:[00000030h] 26_2_030D61A0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_031269A6 mov eax, dword ptr fs:[00000030h] 26_2_031269A6
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D1DB5 mov eax, dword ptr fs:[00000030h] 26_2_030D1DB5
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D1DB5 mov eax, dword ptr fs:[00000030h] 26_2_030D1DB5
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D1DB5 mov eax, dword ptr fs:[00000030h] 26_2_030D1DB5
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_031705AC mov eax, dword ptr fs:[00000030h] 26_2_031705AC
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_031705AC mov eax, dword ptr fs:[00000030h] 26_2_031705AC
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03126DC9 mov eax, dword ptr fs:[00000030h] 26_2_03126DC9
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03126DC9 mov eax, dword ptr fs:[00000030h] 26_2_03126DC9
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03126DC9 mov eax, dword ptr fs:[00000030h] 26_2_03126DC9
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03126DC9 mov ecx, dword ptr fs:[00000030h] 26_2_03126DC9
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03126DC9 mov eax, dword ptr fs:[00000030h] 26_2_03126DC9
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03126DC9 mov eax, dword ptr fs:[00000030h] 26_2_03126DC9
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03158DF1 mov eax, dword ptr fs:[00000030h] 26_2_03158DF1
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030AB1E1 mov eax, dword ptr fs:[00000030h] 26_2_030AB1E1
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030AB1E1 mov eax, dword ptr fs:[00000030h] 26_2_030AB1E1
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030AB1E1 mov eax, dword ptr fs:[00000030h] 26_2_030AB1E1
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030BD5E0 mov eax, dword ptr fs:[00000030h] 26_2_030BD5E0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030BD5E0 mov eax, dword ptr fs:[00000030h] 26_2_030BD5E0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0316FDE2 mov eax, dword ptr fs:[00000030h] 26_2_0316FDE2
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0316FDE2 mov eax, dword ptr fs:[00000030h] 26_2_0316FDE2
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0316FDE2 mov eax, dword ptr fs:[00000030h] 26_2_0316FDE2
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0316FDE2 mov eax, dword ptr fs:[00000030h] 26_2_0316FDE2
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_031341E8 mov eax, dword ptr fs:[00000030h] 26_2_031341E8
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03174015 mov eax, dword ptr fs:[00000030h] 26_2_03174015
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03174015 mov eax, dword ptr fs:[00000030h] 26_2_03174015
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03127016 mov eax, dword ptr fs:[00000030h] 26_2_03127016
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03127016 mov eax, dword ptr fs:[00000030h] 26_2_03127016
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03127016 mov eax, dword ptr fs:[00000030h] 26_2_03127016
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03161C06 mov eax, dword ptr fs:[00000030h] 26_2_03161C06
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03161C06 mov eax, dword ptr fs:[00000030h] 26_2_03161C06
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03161C06 mov eax, dword ptr fs:[00000030h] 26_2_03161C06
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03161C06 mov eax, dword ptr fs:[00000030h] 26_2_03161C06
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03161C06 mov eax, dword ptr fs:[00000030h] 26_2_03161C06
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03161C06 mov eax, dword ptr fs:[00000030h] 26_2_03161C06
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03161C06 mov eax, dword ptr fs:[00000030h] 26_2_03161C06
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03161C06 mov eax, dword ptr fs:[00000030h] 26_2_03161C06
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03161C06 mov eax, dword ptr fs:[00000030h] 26_2_03161C06
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03161C06 mov eax, dword ptr fs:[00000030h] 26_2_03161C06
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03161C06 mov eax, dword ptr fs:[00000030h] 26_2_03161C06
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03161C06 mov eax, dword ptr fs:[00000030h] 26_2_03161C06
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03161C06 mov eax, dword ptr fs:[00000030h] 26_2_03161C06
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03161C06 mov eax, dword ptr fs:[00000030h] 26_2_03161C06
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03126C0A mov eax, dword ptr fs:[00000030h] 26_2_03126C0A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03126C0A mov eax, dword ptr fs:[00000030h] 26_2_03126C0A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03126C0A mov eax, dword ptr fs:[00000030h] 26_2_03126C0A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03126C0A mov eax, dword ptr fs:[00000030h] 26_2_03126C0A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0317740D mov eax, dword ptr fs:[00000030h] 26_2_0317740D
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0317740D mov eax, dword ptr fs:[00000030h] 26_2_0317740D
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0317740D mov eax, dword ptr fs:[00000030h] 26_2_0317740D
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D002D mov eax, dword ptr fs:[00000030h] 26_2_030D002D
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D002D mov eax, dword ptr fs:[00000030h] 26_2_030D002D
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D002D mov eax, dword ptr fs:[00000030h] 26_2_030D002D
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D002D mov eax, dword ptr fs:[00000030h] 26_2_030D002D
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D002D mov eax, dword ptr fs:[00000030h] 26_2_030D002D
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030BB02A mov eax, dword ptr fs:[00000030h] 26_2_030BB02A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030BB02A mov eax, dword ptr fs:[00000030h] 26_2_030BB02A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030BB02A mov eax, dword ptr fs:[00000030h] 26_2_030BB02A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030BB02A mov eax, dword ptr fs:[00000030h] 26_2_030BB02A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030DBC2C mov eax, dword ptr fs:[00000030h] 26_2_030DBC2C
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0313C450 mov eax, dword ptr fs:[00000030h] 26_2_0313C450
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0313C450 mov eax, dword ptr fs:[00000030h] 26_2_0313C450
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030DA44B mov eax, dword ptr fs:[00000030h] 26_2_030DA44B
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030C0050 mov eax, dword ptr fs:[00000030h] 26_2_030C0050
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030C0050 mov eax, dword ptr fs:[00000030h] 26_2_030C0050
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030C746D mov eax, dword ptr fs:[00000030h] 26_2_030C746D
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03171074 mov eax, dword ptr fs:[00000030h] 26_2_03171074
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03162073 mov eax, dword ptr fs:[00000030h] 26_2_03162073
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A9080 mov eax, dword ptr fs:[00000030h] 26_2_030A9080
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030B849B mov eax, dword ptr fs:[00000030h] 26_2_030B849B
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03123884 mov eax, dword ptr fs:[00000030h] 26_2_03123884
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03123884 mov eax, dword ptr fs:[00000030h] 26_2_03123884
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030E90AF mov eax, dword ptr fs:[00000030h] 26_2_030E90AF
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D20A0 mov eax, dword ptr fs:[00000030h] 26_2_030D20A0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D20A0 mov eax, dword ptr fs:[00000030h] 26_2_030D20A0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D20A0 mov eax, dword ptr fs:[00000030h] 26_2_030D20A0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D20A0 mov eax, dword ptr fs:[00000030h] 26_2_030D20A0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D20A0 mov eax, dword ptr fs:[00000030h] 26_2_030D20A0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030D20A0 mov eax, dword ptr fs:[00000030h] 26_2_030D20A0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030DF0BF mov ecx, dword ptr fs:[00000030h] 26_2_030DF0BF
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030DF0BF mov eax, dword ptr fs:[00000030h] 26_2_030DF0BF
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030DF0BF mov eax, dword ptr fs:[00000030h] 26_2_030DF0BF
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03178CD6 mov eax, dword ptr fs:[00000030h] 26_2_03178CD6
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0313B8D0 mov eax, dword ptr fs:[00000030h] 26_2_0313B8D0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0313B8D0 mov ecx, dword ptr fs:[00000030h] 26_2_0313B8D0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0313B8D0 mov eax, dword ptr fs:[00000030h] 26_2_0313B8D0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0313B8D0 mov eax, dword ptr fs:[00000030h] 26_2_0313B8D0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0313B8D0 mov eax, dword ptr fs:[00000030h] 26_2_0313B8D0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_0313B8D0 mov eax, dword ptr fs:[00000030h] 26_2_0313B8D0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03126CF0 mov eax, dword ptr fs:[00000030h] 26_2_03126CF0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03126CF0 mov eax, dword ptr fs:[00000030h] 26_2_03126CF0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_03126CF0 mov eax, dword ptr fs:[00000030h] 26_2_03126CF0
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_030A58EC mov eax, dword ptr fs:[00000030h] 26_2_030A58EC
Source: C:\Windows\SysWOW64\mshta.exe Code function: 26_2_031614FB mov eax, dword ptr fs:[00000030h] 26_2_031614FB
Enables debug privileges
Source: C:\Windows\SysWOW64\logagent.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.kilbyrnefarm.com
Source: C:\Windows\explorer.exe Domain query: www.delhibudokankarate.com
Source: C:\Windows\explorer.exe Domain query: www.f9fui8.xyz
Source: C:\Windows\explorer.exe Network Connect: 23.227.38.74 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 34.98.99.30 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.trendyheld.com
Source: C:\Windows\explorer.exe Domain query: www.besport24.com
Source: C:\Windows\explorer.exe Domain query: www.mobiessence.com
Source: C:\Windows\explorer.exe Network Connect: 64.190.62.111 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.titanusedcarsworth.com
Source: C:\Windows\explorer.exe Network Connect: 51.83.52.226 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 52.58.78.16 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 86.105.245.69 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 154.215.87.120 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.schoolfrontoffice.com
Source: C:\Windows\explorer.exe Domain query: www.beastninjas.com
Source: C:\Windows\explorer.exe Domain query: www.mylifeinpark.com
Source: C:\Windows\explorer.exe Network Connect: 35.186.238.101 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 23.27.129.115 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.vavasoo.com
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.opticatervisof.com
Source: C:\Windows\explorer.exe Domain query: www.dragonshipping.com
Source: C:\Windows\explorer.exe Domain query: www.mypursuitpodcast.com
Source: C:\Windows\explorer.exe Domain query: www.importexportasia.com
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 10410000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 2750000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 2760000 protect: page execute and read and write Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Memory allocated: C:\Windows\SysWOW64\mshta.exe base: 10410000 protect: page execute and read and write Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Memory allocated: C:\Windows\SysWOW64\mshta.exe base: 2340000 protect: page execute and read and write Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Memory allocated: C:\Windows\SysWOW64\mshta.exe base: 2350000 protect: page execute and read and write Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 10410000 protect: page execute and read and write Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 3290000 protect: page execute and read and write Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 32A0000 protect: page execute and read and write Jump to behavior
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Thread created: C:\Windows\SysWOW64\logagent.exe EIP: 2760000 Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Thread created: C:\Windows\SysWOW64\mshta.exe EIP: 2350000 Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Thread created: C:\Windows\SysWOW64\secinit.exe EIP: 32A0000 Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Memory written: C:\Windows\SysWOW64\logagent.exe base: 10410000 value starts with: 4D5A Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Memory written: C:\Windows\SysWOW64\mshta.exe base: 10410000 value starts with: 4D5A Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Memory written: C:\Windows\SysWOW64\secinit.exe base: 10410000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\SysWOW64\logagent.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\logagent.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\logagent.exe Section loaded: unknown target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\logagent.exe Section loaded: unknown target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: unknown target: C:\Windows\SysWOW64\reg.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: unknown target: C:\Windows\SysWOW64\reg.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\logagent.exe Thread register set: target process: 3440 Jump to behavior
Source: C:\Windows\SysWOW64\logagent.exe Thread register set: target process: 3440 Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Thread register set: target process: 3440 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread register set: target process: 3440 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\logagent.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Windows\SysWOW64\logagent.exe Section unmapped: C:\Windows\SysWOW64\NETSTAT.EXE base address: 260000 Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section unmapped: C:\Windows\SysWOW64\reg.exe base address: CE0000 Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Memory written: C:\Windows\SysWOW64\logagent.exe base: 10410000 Jump to behavior
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Memory written: C:\Windows\SysWOW64\logagent.exe base: 2750000 Jump to behavior
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Memory written: C:\Windows\SysWOW64\logagent.exe base: 2760000 Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Memory written: C:\Windows\SysWOW64\mshta.exe base: 10410000 Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Memory written: C:\Windows\SysWOW64\mshta.exe base: 2340000 Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Memory written: C:\Windows\SysWOW64\mshta.exe base: 2350000 Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Memory written: C:\Windows\SysWOW64\secinit.exe base: 10410000 Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Memory written: C:\Windows\SysWOW64\secinit.exe base: 3290000 Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Memory written: C:\Windows\SysWOW64\secinit.exe base: 32A0000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Form_TT_EUR57,890.exe Process created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe reg delete hkcu\Environment /v windir /f Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Process created: C:\Windows\SysWOW64\mshta.exe C:\Windows\System32\mshta.exe Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Process created: C:\Windows\SysWOW64\secinit.exe C:\Windows\System32\secinit.exe Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\SysWOW64\mshta.exe' Jump to behavior
Source: explorer.exe, 00000008.00000000.413574464.00000000083E7000.00000004.00000001.sdmp, rundll32.exe, 0000001C.00000002.863617047.0000000003540000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000008.00000000.464624457.00000000008B8000.00000004.00000020.sdmp, rundll32.exe, 0000001C.00000002.863617047.0000000003540000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000008.00000000.387156048.0000000000EE0000.00000002.00000001.sdmp, rundll32.exe, 0000001C.00000002.863617047.0000000003540000.00000002.00000001.sdmp Binary or memory string: &Program Manager
Source: explorer.exe, 00000008.00000000.387156048.0000000000EE0000.00000002.00000001.sdmp, rundll32.exe, 0000001C.00000002.863617047.0000000003540000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\Public\Libraries\Fdhlajk\Fdhlajk.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 4.0.logagent.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.logagent.exe.10410000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.secinit.exe.10410000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.0.mshta.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.logagent.exe.10410000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.mshta.exe.10410000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.0.secinit.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.0.mshta.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.0.secinit.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.secinit.exe.10410000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.mshta.exe.10410000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.logagent.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001D.00000000.493724351.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.861918517.0000000000B80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.495868043.0000000002910000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.496343429.0000000002C80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.863420934.0000000002DD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000000.467594845.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.505021347.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.513499123.0000000004600000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.862165299.0000000000CB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.497909086.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.512339844.0000000002940000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.380848795.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.512824544.0000000002B50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.515478166.0000000010410000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 4.0.logagent.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.logagent.exe.10410000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.secinit.exe.10410000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.0.mshta.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.logagent.exe.10410000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.mshta.exe.10410000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.0.secinit.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.0.mshta.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.0.secinit.exe.10410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.secinit.exe.10410000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.mshta.exe.10410000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.logagent.exe.10410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001D.00000000.493724351.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.861918517.0000000000B80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.495868043.0000000002910000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.496343429.0000000002C80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.863420934.0000000002DD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000000.467594845.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.505021347.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.513499123.0000000004600000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.862165299.0000000000CB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.497909086.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.512339844.0000000002940000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.380848795.0000000010410000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.512824544.0000000002B50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.515478166.0000000010410000.00000040.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 458655 Sample: Form_TT_EUR57,890.exe Startdate: 03/08/2021 Architecture: WINDOWS Score: 100 91 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->91 93 Malicious sample detected (through community Yara rule) 2->93 95 Antivirus detection for URL or domain 2->95 97 6 other signatures 2->97 10 Form_TT_EUR57,890.exe 1 24 2->10         started        process3 dnsIp4 77 sn-files.fe.1drv.com 10->77 79 pxqklq.sn.files.1drv.com 10->79 81 onedrive.live.com 10->81 57 C:\Users\Public\Libraries\...\Fdhlajk.exe, PE32 10->57 dropped 121 Writes to foreign memory regions 10->121 123 Allocates memory in foreign processes 10->123 125 Creates a thread in another existing process (thread injection) 10->125 127 Injects a PE file into a foreign processes 10->127 15 logagent.exe 10->15         started        18 cmd.exe 1 10->18         started        20 cmd.exe 1 10->20         started        file5 signatures6 process7 signatures8 129 Modifies the context of a thread in another process (thread injection) 15->129 131 Maps a DLL or memory area into another process 15->131 133 Sample uses process hollowing technique 15->133 135 2 other signatures 15->135 22 explorer.exe 2 15->22 injected 26 reg.exe 1 18->26         started        28 conhost.exe 18->28         started        30 cmd.exe 1 20->30         started        32 conhost.exe 20->32         started        process9 dnsIp10 71 www.f9fui8.xyz 22->71 73 www.dragonshipping.com 86.105.245.69, 49762, 49774, 80 TRANSIP-ASAmsterdamtheNetherlandsNL Netherlands 22->73 75 20 other IPs or domains 22->75 115 System process connects to network (likely due to code injection or exploit) 22->115 117 Performs DNS queries to domains with low reputation 22->117 119 Uses netstat to query active network connections and open ports 22->119 34 Fdhlajk.exe 16 22->34         started        38 Fdhlajk.exe 16 22->38         started        40 rundll32.exe 22->40         started        46 4 other processes 22->46 42 conhost.exe 26->42         started        44 conhost.exe 30->44         started        signatures11 process12 dnsIp13 59 sn-files.fe.1drv.com 34->59 61 pxqklq.sn.files.1drv.com 34->61 63 onedrive.live.com 34->63 99 Multi AV Scanner detection for dropped file 34->99 101 Writes to foreign memory regions 34->101 103 Allocates memory in foreign processes 34->103 48 mshta.exe 34->48         started        65 sn-files.fe.1drv.com 38->65 67 pxqklq.sn.files.1drv.com 38->67 69 onedrive.live.com 38->69 105 Creates a thread in another existing process (thread injection) 38->105 107 Injects a PE file into a foreign processes 38->107 51 secinit.exe 38->51         started        109 Modifies the context of a thread in another process (thread injection) 40->109 111 Maps a DLL or memory area into another process 40->111 113 Tries to detect virtualization through RDTSC time measurements 40->113 53 cmd.exe 1 40->53         started        signatures14 process15 signatures16 83 Modifies the context of a thread in another process (thread injection) 48->83 85 Maps a DLL or memory area into another process 48->85 87 Sample uses process hollowing technique 48->87 89 Tries to detect virtualization through RDTSC time measurements 51->89 55 conhost.exe 53->55         started        process17
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
52.58.78.16
 www.mobiessence.com United States
16509 AMAZON-02US false
86.105.245.69
 www.dragonshipping.com Netherlands
20857 TRANSIP-ASAmsterdamtheNetherlandsNL false
23.227.38.74
 shops.myshopify.com Canada
13335 CLOUDFLARENETUS false
34.98.99.30
 kilbyrnefarm.com United States
15169 GOOGLEUS false
154.215.87.120
 www.delhibudokankarate.com Seychelles
132839 POWERLINE-AS-APPOWERLINEDATACENTERHK false
35.186.238.101
 www.mylifeinpark.com United States
15169 GOOGLEUS false
23.27.129.115
 www.importexportasia.com United States
18779 EGIHOSTINGUS false
34.102.136.180
 beastninjas.com United States
15169 GOOGLEUS false
64.190.62.111
 www.vavasoo.com United States
11696 NBS11696US false
51.83.52.226
 besport24.com France
16276 OVHFR false

Contacted Domains

Name IP Active
besport24.com 51.83.52.226 true
beastninjas.com 34.102.136.180 true
www.delhibudokankarate.com 154.215.87.120 true
mypursuitpodcast.com 34.102.136.180 true
www.vavasoo.com 64.190.62.111 true
schoolfrontoffice.com 34.102.136.180 true
www.mobiessence.com 52.58.78.16 true
www.dragonshipping.com 86.105.245.69 true
shops.myshopify.com 23.227.38.74 true
kilbyrnefarm.com 34.98.99.30 true
www.mylifeinpark.com 35.186.238.101 true
www.importexportasia.com 23.27.129.115 true
www.kilbyrnefarm.com unknown unknown
www.f9fui8.xyz unknown unknown
www.trendyheld.com unknown unknown
www.schoolfrontoffice.com unknown unknown
www.besport24.com unknown unknown
www.beastninjas.com unknown unknown
onedrive.live.com unknown unknown
pxqklq.sn.files.1drv.com unknown unknown
www.opticatervisof.com unknown unknown
www.mypursuitpodcast.com unknown unknown
www.titanusedcarsworth.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.mylifeinpark.com/6mam/?wbYpSP=djxA7LmI8yOR5lrxItMqg4jKcWhO49sHA38/CyXgFoUCakRbVREb3j6xA5Z01WfJADXfd3zybw==&PJEt=HRR0_XgHGBD8 false
  • Avira URL Cloud: malware
 unknown
http://www.delhibudokankarate.com/6mam/?wbYpSP=Dhv3NEq4M+QwROw+dIik/SqBuvIY1/ydOcQwMfpHsV2StOMLf1p+AXWBQfK1e2Gy8MhXWnKhDQ==&PJEt=HRR0_XgHGBD8 true
  • Avira URL Cloud: safe
 unknown
http://www.beastninjas.com/6mam/?wbYpSP=oQhTdcG1kNI9/Lmcc2Ae/5c2EVHHJUmgpucHXQ4UdnJs0zjkXV1wGSuIEzpJIo84TCfrKzWPPA==&PJEt=HRR0_XgHGBD8 false
  • Avira URL Cloud: safe
 unknown
http://www.mypursuitpodcast.com/6mam/?wbYpSP=U4etKMGlduRHKY34/y2VHJ3U/bl1CG9JeeGxs20P+eoGUQdkn77fFsSN2SlAgFKwyO8ri7IQTA==&PJEt=HRR0_XgHGBD8 false
  • Avira URL Cloud: safe
 unknown
http://www.dragonshipping.com/6mam/?wbYpSP=5npnSCZ0ck9LfxTaUtRZHwWauGngCjsEHbJTec35d6ZUl1gSnMY6WOunSeDfnMtC3HJRIA/gUg==&PJEt=HRR0_XgHGBD8 true
  • Avira URL Cloud: safe
 unknown
http://www.vavasoo.com/6mam/?wbYpSP=L6FmBYjymbItbbnnjd7yzq8hOevfuspHLpHNfkA4yzrvipy3lucWli1gmvwrFafR77bKFMYeeA==&PJEt=HRR0_XgHGBD8 true
  • Avira URL Cloud: safe
 unknown
http://www.besport24.com/6mam/?wbYpSP=G66iPt+zysOdT87cMSNY3jIG1auw/RAx4PjK5prA1jAGCtavWTKfmUTffyE+Nzacke4pg1lsTg==&PJEt=HRR0_XgHGBD8 true
  • Avira URL Cloud: safe
 unknown
http://www.mobiessence.com/6mam/?wbYpSP=KE8gpfUEuqRqMBWGFV5goIwNmc44LE6Oi+PTcRo4vEp3RirjZlcD1GLbPH2NA5fTW+Y3K/xiNw==&PJEt=HRR0_XgHGBD8 true
  • Avira URL Cloud: malware
 unknown
http://www.trendyheld.com/6mam/?wbYpSP=E0pe+Y2tlTeS/nkCAz5H/oSd7jolrcEyLM5+sA5RPKgWYHOxmsRP4IrVmGJTeseGmyQ7XT1Vgg==&PJEt=HRR0_XgHGBD8 true
  • Avira URL Cloud: malware
 unknown
http://www.kilbyrnefarm.com/6mam/?wbYpSP=YkvzQHb0u0mjzgqcdkfc2nlAC0Yzm929bCO8fEJzAgzkJ6Iw6dVqaRJYZU+TtwSY8fdaCDocnA==&PJEt=HRR0_XgHGBD8 false
  • Avira URL Cloud: safe
 unknown
http://www.schoolfrontoffice.com/6mam/?wbYpSP=44unMI1Q/kB3N4iH8WCIjTNIPpmavX0UQR770OieCBmDyTCieL+ZZdhYfwuEfVyDA+gWGsSDYQ==&PJEt=HRR0_XgHGBD8 false
  • Avira URL Cloud: safe
 unknown