Windows Analysis Report gLO4rDsniT

Overview

General Information

Sample Name: gLO4rDsniT (renamed file extension from none to exe)
Analysis ID: 483687
MD5: ebcd5648eab5a3214ec61d4bed956a36
SHA1: b2a43a1489ce76373df3ba5e4ba54172a6cc92f4
SHA256: bef7f97dcb40fd71e9a9fca6f43389749245f17e7a3092219d20217b8ad8e36a
Tags: 32exetrojan
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Maps a DLL or memory area into another process
Writes to foreign memory regions
Machine Learning detection for sample
Injects a PE file into a foreign processes
Tries to detect virtualization through RDTSC time measurements
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Contains functionality to call native functions
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Contains functionality to read the PEB
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000018.00000002.545104364.0000000001700000.00000040.00020000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.inboundtechnology.net/b9qq/"], "decoy": ["tmalborz.com", "jiutianbath.com", "yazdir.info", "budget.sucks", "harman-enterprises.com", "kedaidaging.com", "exiteight.com", "urpropertymanager.com", "tomorrowsrider.com", "otlpro.com", "shopfunda.com", "xinhaojc1998.com", "fyqyzs.com", "legal-plaza.net", "bonmarchefr.net", "3bestrehab.com", "riyadhalnarjes.com", "bharateeyaswasrayadarshan.com", "inchingforhelp.com", "lojongdev.com", "jonathanbrowndrums.com", "rongnhonhatban.online", "gelora.site", "shirleyswigsinc.com", "pepsi-vm.com", "lovabubble.com", "wwwburlingtontownshipcourts.com", "findousd.com", "santavitrine.com", "sabaidiver.com", "actionclassiccars.com", "comdevfund.info", "geomasala.com", "leviathanpursuits.net", "fenrirnoise.com", "planeadvisory.com", "goehub.com", "greyriverstay.com", "monikalupaczewska.com", "yournorwegiancourse.com", "xn--hgbque4i.com", "topdex.info", "canvasgoogle.com", "leal-am.com", "peach-dev.finance", "us-phoneprotection.com", "nek.cool", "oraclenailstucson.com", "bloortoqueen.com", "hfhscn.com", "grooveautohacking.com", "getallentownpets.com", "storiesofablonde.com", "assistance-habitation.com", "aandzauto.services", "eating4mentalhealth.com", "getcareerpower.com", "hayokapan.com", "georgestuff.com", "manage-autpypl-account.com", "cjbwxs.com", "goodgly.com", "toptoffee.com", "salonefestival.com"]}
Multi AV Scanner detection for submitted file
Source: gLO4rDsniT.exe Virustotal: Detection: 32% Perma Link
Source: gLO4rDsniT.exe ReversingLabs: Detection: 40%
Yara detected FormBook
Source: Yara match File source: 24.2.gLO4rDsniT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.gLO4rDsniT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000018.00000002.545335617.0000000001800000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.545104364.0000000001700000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.466649182.0000000003B59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000000.493656809.0000000006740000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.543592754.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.529006238.0000000006740000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.467041262.0000000003C49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.466807357.0000000003BB4000.00000004.00000001.sdmp, type: MEMORY
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Virustotal: Detection: 32% Perma Link
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe ReversingLabs: Detection: 40%
Machine Learning detection for sample
Source: gLO4rDsniT.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 24.2.gLO4rDsniT.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: gLO4rDsniT.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Source: gLO4rDsniT.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: gLO4rDsniT.exe, 00000018.00000002.544829153.00000000014EF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: gLO4rDsniT.exe
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net35/Newtonsoft.Json.pdb source: gLO4rDsniT.exe
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net35/Newtonsoft.Json.pdbSHA256/ source: gLO4rDsniT.exe

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.inboundtechnology.net/b9qq/
Source: gLO4rDsniT.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: gLO4rDsniT.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: gLO4rDsniT.exe String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: gLO4rDsniT.exe String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: gLO4rDsniT.exe String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: gLO4rDsniT.exe String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: gLO4rDsniT.exe String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: gLO4rDsniT.exe String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: gLO4rDsniT.exe String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: gLO4rDsniT.exe String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: gLO4rDsniT.exe String found in binary or memory: http://james.newtonking.com/projects/json
Source: powershell.exe, 00000006.00000002.375657759.0000000005EB2000.00000004.00000001.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: gLO4rDsniT.exe String found in binary or memory: http://ocsp.digicert.com0C
Source: gLO4rDsniT.exe String found in binary or memory: http://ocsp.digicert.com0K
Source: gLO4rDsniT.exe String found in binary or memory: http://ocsp.digicert.com0N
Source: gLO4rDsniT.exe String found in binary or memory: http://ocsp.digicert.com0O
Source: powershell.exe, 00000006.00000002.371771340.0000000004F92000.00000004.00000001.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: gLO4rDsniT.exe, 00000001.00000002.466072258.0000000002B8C000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.371504237.0000000004E51000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000006.00000002.371771340.0000000004F92000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: gLO4rDsniT.exe, 00000001.00000002.468335884.0000000006C42000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: powershell.exe, 00000006.00000002.375657759.0000000005EB2000.00000004.00000001.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.375657759.0000000005EB2000.00000004.00000001.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.375657759.0000000005EB2000.00000004.00000001.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000006.00000002.371771340.0000000004F92000.00000004.00000001.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000006.00000002.374276316.00000000056CB000.00000004.00000001.sdmp String found in binary or memory: https://go.micro
Source: powershell.exe, 00000006.00000002.375657759.0000000005EB2000.00000004.00000001.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: gLO4rDsniT.exe String found in binary or memory: https://www.digicert.com/CPS0
Source: gLO4rDsniT.exe String found in binary or memory: https://www.newtonsoft.com/json
Source: gLO4rDsniT.exe String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: gLO4rDsniT.exe String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 24.2.gLO4rDsniT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.gLO4rDsniT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000018.00000002.545335617.0000000001800000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.545104364.0000000001700000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.466649182.0000000003B59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000000.493656809.0000000006740000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.543592754.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.529006238.0000000006740000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.467041262.0000000003C49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.466807357.0000000003BB4000.00000004.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 24.2.gLO4rDsniT.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 24.2.gLO4rDsniT.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 24.2.gLO4rDsniT.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 24.2.gLO4rDsniT.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000018.00000002.545335617.0000000001800000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000018.00000002.545335617.0000000001800000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000018.00000002.545104364.0000000001700000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000018.00000002.545104364.0000000001700000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.466649182.0000000003B59000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.466649182.0000000003B59000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000019.00000000.493656809.0000000006740000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000019.00000000.493656809.0000000006740000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000018.00000002.543592754.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000018.00000002.543592754.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000019.00000002.529006238.0000000006740000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000019.00000002.529006238.0000000006740000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.467041262.0000000003C49000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.467041262.0000000003C49000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.466807357.0000000003BB4000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.466807357.0000000003BB4000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: gLO4rDsniT.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Yara signature match
Source: 24.2.gLO4rDsniT.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 24.2.gLO4rDsniT.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 24.2.gLO4rDsniT.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 24.2.gLO4rDsniT.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000018.00000002.545335617.0000000001800000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000018.00000002.545335617.0000000001800000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000018.00000002.545104364.0000000001700000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000018.00000002.545104364.0000000001700000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.466649182.0000000003B59000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.466649182.0000000003B59000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000019.00000000.493656809.0000000006740000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000019.00000000.493656809.0000000006740000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000018.00000002.543592754.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000018.00000002.543592754.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000019.00000002.529006238.0000000006740000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000019.00000002.529006238.0000000006740000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.467041262.0000000003C49000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.467041262.0000000003C49000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.466807357.0000000003BB4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.466807357.0000000003BB4000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Code function: 1_2_07024080 1_2_07024080
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Code function: 1_2_07024070 1_2_07024070
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Code function: 1_2_07025C89 1_2_07025C89
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Code function: 1_2_006F3ECE 1_2_006F3ECE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_04D8CEB8 6_2_04D8CEB8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_04D88B58 6_2_04D88B58
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_04D88B4A 6_2_04D88B4A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_04D8DA78 6_2_04D8DA78
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_04D8DA68 6_2_04D8DA68
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_00401030 24_2_00401030
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0041BAC7 24_2_0041BAC7
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0041CBDC 24_2_0041CBDC
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_00408C5C 24_2_00408C5C
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_00408C60 24_2_00408C60
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0041B5E8 24_2_0041B5E8
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_00402D87 24_2_00402D87
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_00402D90 24_2_00402D90
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_00402FB0 24_2_00402FB0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013FF900 24_2_013FF900
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01414120 24_2_01414120
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014199BF 24_2_014199BF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F6800 24_2_013F6800
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B1002 24_2_014B1002
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014CE824 24_2_014CE824
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A830 24_2_0141A830
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C28EC 24_2_014C28EC
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0140B090 24_2_0140B090
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014220A0 24_2_014220A0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C20A8 24_2_014C20A8
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141AB40 24_2_0141AB40
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0149CB4F 24_2_0149CB4F
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01413360 24_2_01413360
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B231B 24_2_014B231B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C2B28 24_2_014C2B28
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B03DA 24_2_014B03DA
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014BDBD2 24_2_014BDBD2
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142ABD8 24_2_0142ABD8
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014A23E3 24_2_014A23E3
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01448BE8 24_2_01448BE8
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0149EB8A 24_2_0149EB8A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142138B 24_2_0142138B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141EB9A 24_2_0141EB9A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142EBB0 24_2_0142EBB0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014AFA2B 24_2_014AFA2B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B236 24_2_0141B236
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014BE2C5 24_2_014BE2C5
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4AEF 24_2_014B4AEF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C22AE 24_2_014C22AE
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C32A9 24_2_014C32A9
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01412D50 24_2_01412D50
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C1D55 24_2_014C1D55
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F0D20 24_2_013F0D20
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C2D07 24_2_014C2D07
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C25DD 24_2_014C25DD
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0140D5E0 24_2_0140D5E0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01422581 24_2_01422581
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B2D82 24_2_014B2D82
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014265A0 24_2_014265A0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014BD466 24_2_014BD466
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B477 24_2_0141B477
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0140841F 24_2_0140841F
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4496 24_2_014B4496
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014CDFCE 24_2_014CDFCE
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B67E2 24_2_014B67E2
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C1FF1 24_2_014C1FF1
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01415600 24_2_01415600
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014BD616 24_2_014BD616
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_00963ECE 24_2_00963ECE
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: String function: 01485720 appears 65 times
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: String function: 0144D08C appears 41 times
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: String function: 013FB150 appears 154 times
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_004181C0 NtCreateFile, 24_2_004181C0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_00418270 NtReadFile, 24_2_00418270
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_004182F0 NtClose, 24_2_004182F0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_004183A0 NtAllocateVirtualMemory, 24_2_004183A0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_004182EA NtClose, 24_2_004182EA
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0041839D NtAllocateVirtualMemory, 24_2_0041839D
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439910 NtAdjustPrivilegesToken,LdrInitializeThunk, 24_2_01439910
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014399A0 NtCreateSection,LdrInitializeThunk, 24_2_014399A0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439860 NtQuerySystemInformation,LdrInitializeThunk, 24_2_01439860
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439A50 NtCreateFile,LdrInitializeThunk, 24_2_01439A50
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439A00 NtProtectVirtualMemory,LdrInitializeThunk, 24_2_01439A00
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014395D0 NtClose,LdrInitializeThunk, 24_2_014395D0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439710 NtQueryInformationToken,LdrInitializeThunk, 24_2_01439710
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439FE0 NtCreateMutant,LdrInitializeThunk, 24_2_01439FE0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439780 NtMapViewOfSection,LdrInitializeThunk, 24_2_01439780
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439660 NtAllocateVirtualMemory,LdrInitializeThunk, 24_2_01439660
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014396E0 NtFreeVirtualMemory,LdrInitializeThunk, 24_2_014396E0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439950 NtQueueApcThread, 24_2_01439950
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014399D0 NtCreateProcessEx, 24_2_014399D0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0143B040 NtSuspendThread, 24_2_0143B040
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439840 NtDelayExecution, 24_2_01439840
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439820 NtEnumerateKey, 24_2_01439820
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014398F0 NtReadVirtualMemory, 24_2_014398F0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014398A0 NtWriteVirtualMemory, 24_2_014398A0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439B00 NtSetValueKey, 24_2_01439B00
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0143A3B0 NtGetContextThread, 24_2_0143A3B0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439A10 NtQuerySection, 24_2_01439A10
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439A20 NtResumeThread, 24_2_01439A20
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439A80 NtOpenDirectoryObject, 24_2_01439A80
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439540 NtReadFile, 24_2_01439540
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439560 NtWriteFile, 24_2_01439560
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439520 NtWaitForSingleObject, 24_2_01439520
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0143AD30 NtSetContextThread, 24_2_0143AD30
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014395F0 NtQueryInformationFile, 24_2_014395F0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439760 NtOpenProcess, 24_2_01439760
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0143A770 NtOpenThread, 24_2_0143A770
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439770 NtSetInformationFile, 24_2_01439770
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0143A710 NtOpenProcessToken, 24_2_0143A710
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439730 NtQueryVirtualMemory, 24_2_01439730
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014397A0 NtUnmapViewOfSection, 24_2_014397A0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439650 NtQueryValueKey, 24_2_01439650
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439670 NtQueryInformationProcess, 24_2_01439670
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01439610 NtEnumerateValueKey, 24_2_01439610
Sample file is different than original file name gathered from version info
Source: gLO4rDsniT.exe Binary or memory string: OriginalFilename vs gLO4rDsniT.exe
Source: gLO4rDsniT.exe, 00000001.00000002.464892605.0000000001030000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameEldvvwydeqtuviuraf.dllF vs gLO4rDsniT.exe
Source: gLO4rDsniT.exe, 00000001.00000002.463955476.0000000000CA0000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameVxddsbqhvdmitgr.dll" vs gLO4rDsniT.exe
Source: gLO4rDsniT.exe, 00000001.00000000.238967806.00000000006F2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs gLO4rDsniT.exe
Source: gLO4rDsniT.exe, 00000001.00000000.238967806.00000000006F2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameBEB.exe0 vs gLO4rDsniT.exe
Source: gLO4rDsniT.exe, 00000001.00000002.466492327.0000000002C92000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameclrjit.dllT vs gLO4rDsniT.exe
Source: gLO4rDsniT.exe Binary or memory string: OriginalFilename vs gLO4rDsniT.exe
Source: gLO4rDsniT.exe, 00000018.00000002.544829153.00000000014EF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs gLO4rDsniT.exe
Source: gLO4rDsniT.exe, 00000018.00000002.543650246.0000000000962000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs gLO4rDsniT.exe
Source: gLO4rDsniT.exe, 00000018.00000002.543650246.0000000000962000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameBEB.exe0 vs gLO4rDsniT.exe
Source: gLO4rDsniT.exe Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs gLO4rDsniT.exe
Source: gLO4rDsniT.exe Binary or memory string: OriginalFilenameBEB.exe0 vs gLO4rDsniT.exe
PE file contains strange resources
Source: gLO4rDsniT.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: gLO4rDsniT.exe.1.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: gLO4rDsniT.exe Virustotal: Detection: 32%
Source: gLO4rDsniT.exe ReversingLabs: Detection: 40%
Source: C:\Users\user\Desktop\gLO4rDsniT.exe File read: C:\Users\user\Desktop\gLO4rDsniT.exe Jump to behavior
Source: gLO4rDsniT.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\gLO4rDsniT.exe 'C:\Users\user\Desktop\gLO4rDsniT.exe'
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Start-Sleep -s 20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process created: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Start-Sleep -s 20 Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process created: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\gLO4rDsniT.exe.log Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe File created: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@6/8@0/0
Source: C:\Users\user\Desktop\gLO4rDsniT.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6748:120:WilError_01
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\gLO4rDsniT.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: gLO4rDsniT.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: gLO4rDsniT.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: gLO4rDsniT.exe, 00000018.00000002.544829153.00000000014EF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: gLO4rDsniT.exe
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net35/Newtonsoft.Json.pdb source: gLO4rDsniT.exe
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net35/Newtonsoft.Json.pdbSHA256/ source: gLO4rDsniT.exe

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Code function: 1_2_07027177 push edi; ret 1_2_07027179
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_04D8326F push dword ptr [esp+ecx*2-75h]; ret 6_2_04D83273
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0041612D push esp; ret 24_2_0041612E
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0040F371 push cs; retf 24_2_0040F377
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0041B3B5 push eax; ret 24_2_0041B408
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0041B46C push eax; ret 24_2_0041B472
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0041B402 push eax; ret 24_2_0041B408
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0041B40B push eax; ret 24_2_0041B472
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_00419C9C push eax; iretd 24_2_00419C9D
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0144D0D1 push ecx; ret 24_2_0144D0E4
Source: initial sample Static PE information: section name: .text entropy: 7.11687874343
Source: initial sample Static PE information: section name: .text entropy: 7.11687874343

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\gLO4rDsniT.exe File created: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Jump to dropped file
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe RDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\gLO4rDsniT.exe TID: 6312 Thread sleep time: -34000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe TID: 6392 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5432 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6884 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_004088B0 rdtsc 24_2_004088B0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2312 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2041 Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: powershell.exe, 00000006.00000002.372800204.0000000005294000.00000004.00000001.sdmp Binary or memory string: Hyper-V
Source: explorer.exe, 00000019.00000000.478669261.000000000891C000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000019.00000000.478669261.000000000891C000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000019.00000000.469435502.00000000011B3000.00000004.00000020.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: explorer.exe, 00000019.00000000.497503166.00000000089B5000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000019.00000000.472332532.00000000053D7000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000019.00000000.497503166.00000000089B5000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
Source: powershell.exe, 00000006.00000002.371771340.0000000004F92000.00000004.00000001.sdmp Binary or memory string: l:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_004088B0 rdtsc 24_2_004088B0
Enables debug privileges
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B944 mov eax, dword ptr fs:[00000030h] 24_2_0141B944
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B944 mov eax, dword ptr fs:[00000030h] 24_2_0141B944
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F3138 mov ecx, dword ptr fs:[00000030h] 24_2_013F3138
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B1951 mov eax, dword ptr fs:[00000030h] 24_2_014B1951
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014BE962 mov eax, dword ptr fs:[00000030h] 24_2_014BE962
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C8966 mov eax, dword ptr fs:[00000030h] 24_2_014C8966
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F9100 mov eax, dword ptr fs:[00000030h] 24_2_013F9100
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F9100 mov eax, dword ptr fs:[00000030h] 24_2_013F9100
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F9100 mov eax, dword ptr fs:[00000030h] 24_2_013F9100
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01400100 mov eax, dword ptr fs:[00000030h] 24_2_01400100
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01400100 mov eax, dword ptr fs:[00000030h] 24_2_01400100
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01400100 mov eax, dword ptr fs:[00000030h] 24_2_01400100
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013FB171 mov eax, dword ptr fs:[00000030h] 24_2_013FB171
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013FB171 mov eax, dword ptr fs:[00000030h] 24_2_013FB171
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013FC962 mov eax, dword ptr fs:[00000030h] 24_2_013FC962
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01414120 mov eax, dword ptr fs:[00000030h] 24_2_01414120
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01414120 mov eax, dword ptr fs:[00000030h] 24_2_01414120
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01414120 mov eax, dword ptr fs:[00000030h] 24_2_01414120
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01414120 mov eax, dword ptr fs:[00000030h] 24_2_01414120
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01414120 mov ecx, dword ptr fs:[00000030h] 24_2_01414120
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F395E mov eax, dword ptr fs:[00000030h] 24_2_013F395E
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F395E mov eax, dword ptr fs:[00000030h] 24_2_013F395E
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142513A mov eax, dword ptr fs:[00000030h] 24_2_0142513A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142513A mov eax, dword ptr fs:[00000030h] 24_2_0142513A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B19D8 mov eax, dword ptr fs:[00000030h] 24_2_014B19D8
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014841E8 mov eax, dword ptr fs:[00000030h] 24_2_014841E8
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F519E mov eax, dword ptr fs:[00000030h] 24_2_013F519E
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F519E mov ecx, dword ptr fs:[00000030h] 24_2_013F519E
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C89E7 mov eax, dword ptr fs:[00000030h] 24_2_014C89E7
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014BA189 mov eax, dword ptr fs:[00000030h] 24_2_014BA189
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014BA189 mov ecx, dword ptr fs:[00000030h] 24_2_014BA189
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141C182 mov eax, dword ptr fs:[00000030h] 24_2_0141C182
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142A185 mov eax, dword ptr fs:[00000030h] 24_2_0142A185
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01422990 mov eax, dword ptr fs:[00000030h] 24_2_01422990
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01424190 mov eax, dword ptr fs:[00000030h] 24_2_01424190
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013FB1E1 mov eax, dword ptr fs:[00000030h] 24_2_013FB1E1
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013FB1E1 mov eax, dword ptr fs:[00000030h] 24_2_013FB1E1
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013FB1E1 mov eax, dword ptr fs:[00000030h] 24_2_013FB1E1
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F31E0 mov eax, dword ptr fs:[00000030h] 24_2_013F31E0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014769A6 mov eax, dword ptr fs:[00000030h] 24_2_014769A6
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014261A0 mov eax, dword ptr fs:[00000030h] 24_2_014261A0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014261A0 mov eax, dword ptr fs:[00000030h] 24_2_014261A0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B49A4 mov eax, dword ptr fs:[00000030h] 24_2_014B49A4
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B49A4 mov eax, dword ptr fs:[00000030h] 24_2_014B49A4
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B49A4 mov eax, dword ptr fs:[00000030h] 24_2_014B49A4
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B49A4 mov eax, dword ptr fs:[00000030h] 24_2_014B49A4
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014751BE mov eax, dword ptr fs:[00000030h] 24_2_014751BE
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014751BE mov eax, dword ptr fs:[00000030h] 24_2_014751BE
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014751BE mov eax, dword ptr fs:[00000030h] 24_2_014751BE
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014751BE mov eax, dword ptr fs:[00000030h] 24_2_014751BE
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014199BF mov ecx, dword ptr fs:[00000030h] 24_2_014199BF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014199BF mov ecx, dword ptr fs:[00000030h] 24_2_014199BF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014199BF mov eax, dword ptr fs:[00000030h] 24_2_014199BF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014199BF mov ecx, dword ptr fs:[00000030h] 24_2_014199BF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014199BF mov ecx, dword ptr fs:[00000030h] 24_2_014199BF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014199BF mov eax, dword ptr fs:[00000030h] 24_2_014199BF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014199BF mov ecx, dword ptr fs:[00000030h] 24_2_014199BF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014199BF mov ecx, dword ptr fs:[00000030h] 24_2_014199BF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014199BF mov eax, dword ptr fs:[00000030h] 24_2_014199BF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014199BF mov ecx, dword ptr fs:[00000030h] 24_2_014199BF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014199BF mov ecx, dword ptr fs:[00000030h] 24_2_014199BF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014199BF mov eax, dword ptr fs:[00000030h] 24_2_014199BF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B1843 mov eax, dword ptr fs:[00000030h] 24_2_014B1843
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01410050 mov eax, dword ptr fs:[00000030h] 24_2_01410050
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01410050 mov eax, dword ptr fs:[00000030h] 24_2_01410050
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141F86D mov eax, dword ptr fs:[00000030h] 24_2_0141F86D
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B2073 mov eax, dword ptr fs:[00000030h] 24_2_014B2073
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C1074 mov eax, dword ptr fs:[00000030h] 24_2_014C1074
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F6800 mov eax, dword ptr fs:[00000030h] 24_2_013F6800
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F6800 mov eax, dword ptr fs:[00000030h] 24_2_013F6800
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F6800 mov eax, dword ptr fs:[00000030h] 24_2_013F6800
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01477016 mov eax, dword ptr fs:[00000030h] 24_2_01477016
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01477016 mov eax, dword ptr fs:[00000030h] 24_2_01477016
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01477016 mov eax, dword ptr fs:[00000030h] 24_2_01477016
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C4015 mov eax, dword ptr fs:[00000030h] 24_2_014C4015
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C4015 mov eax, dword ptr fs:[00000030h] 24_2_014C4015
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01424020 mov edi, dword ptr fs:[00000030h] 24_2_01424020
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F7057 mov eax, dword ptr fs:[00000030h] 24_2_013F7057
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0140B02A mov eax, dword ptr fs:[00000030h] 24_2_0140B02A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0140B02A mov eax, dword ptr fs:[00000030h] 24_2_0140B02A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0140B02A mov eax, dword ptr fs:[00000030h] 24_2_0140B02A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0140B02A mov eax, dword ptr fs:[00000030h] 24_2_0140B02A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142002D mov eax, dword ptr fs:[00000030h] 24_2_0142002D
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142002D mov eax, dword ptr fs:[00000030h] 24_2_0142002D
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142002D mov eax, dword ptr fs:[00000030h] 24_2_0142002D
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142002D mov eax, dword ptr fs:[00000030h] 24_2_0142002D
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142002D mov eax, dword ptr fs:[00000030h] 24_2_0142002D
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F5050 mov eax, dword ptr fs:[00000030h] 24_2_013F5050
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F5050 mov eax, dword ptr fs:[00000030h] 24_2_013F5050
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F5050 mov eax, dword ptr fs:[00000030h] 24_2_013F5050
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A830 mov eax, dword ptr fs:[00000030h] 24_2_0141A830
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A830 mov eax, dword ptr fs:[00000030h] 24_2_0141A830
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A830 mov eax, dword ptr fs:[00000030h] 24_2_0141A830
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A830 mov eax, dword ptr fs:[00000030h] 24_2_0141A830
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B18CA mov eax, dword ptr fs:[00000030h] 24_2_014B18CA
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0148B8D0 mov eax, dword ptr fs:[00000030h] 24_2_0148B8D0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0148B8D0 mov ecx, dword ptr fs:[00000030h] 24_2_0148B8D0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0148B8D0 mov eax, dword ptr fs:[00000030h] 24_2_0148B8D0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0148B8D0 mov eax, dword ptr fs:[00000030h] 24_2_0148B8D0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0148B8D0 mov eax, dword ptr fs:[00000030h] 24_2_0148B8D0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0148B8D0 mov eax, dword ptr fs:[00000030h] 24_2_0148B8D0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B8E4 mov eax, dword ptr fs:[00000030h] 24_2_0141B8E4
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B8E4 mov eax, dword ptr fs:[00000030h] 24_2_0141B8E4
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014028FD mov eax, dword ptr fs:[00000030h] 24_2_014028FD
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014028FD mov eax, dword ptr fs:[00000030h] 24_2_014028FD
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014028FD mov eax, dword ptr fs:[00000030h] 24_2_014028FD
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F9080 mov eax, dword ptr fs:[00000030h] 24_2_013F9080
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F3880 mov eax, dword ptr fs:[00000030h] 24_2_013F3880
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F3880 mov eax, dword ptr fs:[00000030h] 24_2_013F3880
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01473884 mov eax, dword ptr fs:[00000030h] 24_2_01473884
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01473884 mov eax, dword ptr fs:[00000030h] 24_2_01473884
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F58EC mov eax, dword ptr fs:[00000030h] 24_2_013F58EC
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F40E1 mov eax, dword ptr fs:[00000030h] 24_2_013F40E1
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F40E1 mov eax, dword ptr fs:[00000030h] 24_2_013F40E1
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F40E1 mov eax, dword ptr fs:[00000030h] 24_2_013F40E1
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014220A0 mov eax, dword ptr fs:[00000030h] 24_2_014220A0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014220A0 mov eax, dword ptr fs:[00000030h] 24_2_014220A0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014220A0 mov eax, dword ptr fs:[00000030h] 24_2_014220A0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014220A0 mov eax, dword ptr fs:[00000030h] 24_2_014220A0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014220A0 mov eax, dword ptr fs:[00000030h] 24_2_014220A0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014220A0 mov eax, dword ptr fs:[00000030h] 24_2_014220A0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014390AF mov eax, dword ptr fs:[00000030h] 24_2_014390AF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014028AE mov eax, dword ptr fs:[00000030h] 24_2_014028AE
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014028AE mov eax, dword ptr fs:[00000030h] 24_2_014028AE
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014028AE mov eax, dword ptr fs:[00000030h] 24_2_014028AE
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014028AE mov ecx, dword ptr fs:[00000030h] 24_2_014028AE
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014028AE mov eax, dword ptr fs:[00000030h] 24_2_014028AE
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014028AE mov eax, dword ptr fs:[00000030h] 24_2_014028AE
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142F0BF mov ecx, dword ptr fs:[00000030h] 24_2_0142F0BF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142F0BF mov eax, dword ptr fs:[00000030h] 24_2_0142F0BF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142F0BF mov eax, dword ptr fs:[00000030h] 24_2_0142F0BF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F70C0 mov eax, dword ptr fs:[00000030h] 24_2_013F70C0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F70C0 mov eax, dword ptr fs:[00000030h] 24_2_013F70C0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C8B58 mov eax, dword ptr fs:[00000030h] 24_2_014C8B58
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01423B5A mov eax, dword ptr fs:[00000030h] 24_2_01423B5A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01423B5A mov eax, dword ptr fs:[00000030h] 24_2_01423B5A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01423B5A mov eax, dword ptr fs:[00000030h] 24_2_01423B5A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01423B5A mov eax, dword ptr fs:[00000030h] 24_2_01423B5A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01486365 mov eax, dword ptr fs:[00000030h] 24_2_01486365
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01486365 mov eax, dword ptr fs:[00000030h] 24_2_01486365
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01486365 mov eax, dword ptr fs:[00000030h] 24_2_01486365
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0140F370 mov eax, dword ptr fs:[00000030h] 24_2_0140F370
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0140F370 mov eax, dword ptr fs:[00000030h] 24_2_0140F370
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0140F370 mov eax, dword ptr fs:[00000030h] 24_2_0140F370
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01423B7A mov eax, dword ptr fs:[00000030h] 24_2_01423B7A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01423B7A mov eax, dword ptr fs:[00000030h] 24_2_01423B7A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 mov eax, dword ptr fs:[00000030h] 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 mov eax, dword ptr fs:[00000030h] 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 mov eax, dword ptr fs:[00000030h] 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 mov eax, dword ptr fs:[00000030h] 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 mov eax, dword ptr fs:[00000030h] 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 mov eax, dword ptr fs:[00000030h] 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 mov eax, dword ptr fs:[00000030h] 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 mov eax, dword ptr fs:[00000030h] 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 mov eax, dword ptr fs:[00000030h] 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 mov eax, dword ptr fs:[00000030h] 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 mov eax, dword ptr fs:[00000030h] 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 mov eax, dword ptr fs:[00000030h] 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 mov eax, dword ptr fs:[00000030h] 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 mov eax, dword ptr fs:[00000030h] 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 mov eax, dword ptr fs:[00000030h] 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 mov eax, dword ptr fs:[00000030h] 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 mov eax, dword ptr fs:[00000030h] 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 mov eax, dword ptr fs:[00000030h] 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 mov eax, dword ptr fs:[00000030h] 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 mov eax, dword ptr fs:[00000030h] 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A309 mov eax, dword ptr fs:[00000030h] 24_2_0141A309
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B131B mov eax, dword ptr fs:[00000030h] 24_2_014B131B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013FDB60 mov ecx, dword ptr fs:[00000030h] 24_2_013FDB60
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013FF358 mov eax, dword ptr fs:[00000030h] 24_2_013FF358
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013FDB40 mov eax, dword ptr fs:[00000030h] 24_2_013FDB40
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014253C5 mov eax, dword ptr fs:[00000030h] 24_2_014253C5
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014753CA mov eax, dword ptr fs:[00000030h] 24_2_014753CA
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014753CA mov eax, dword ptr fs:[00000030h] 24_2_014753CA
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014203E2 mov eax, dword ptr fs:[00000030h] 24_2_014203E2
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014203E2 mov eax, dword ptr fs:[00000030h] 24_2_014203E2
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014203E2 mov eax, dword ptr fs:[00000030h] 24_2_014203E2
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014203E2 mov eax, dword ptr fs:[00000030h] 24_2_014203E2
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014203E2 mov eax, dword ptr fs:[00000030h] 24_2_014203E2
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014203E2 mov eax, dword ptr fs:[00000030h] 24_2_014203E2
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141DBE9 mov eax, dword ptr fs:[00000030h] 24_2_0141DBE9
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014A23E3 mov ecx, dword ptr fs:[00000030h] 24_2_014A23E3
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014A23E3 mov ecx, dword ptr fs:[00000030h] 24_2_014A23E3
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014A23E3 mov eax, dword ptr fs:[00000030h] 24_2_014A23E3
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F4B94 mov edi, dword ptr fs:[00000030h] 24_2_013F4B94
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B138A mov eax, dword ptr fs:[00000030h] 24_2_014B138A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0149EB8A mov ecx, dword ptr fs:[00000030h] 24_2_0149EB8A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0149EB8A mov eax, dword ptr fs:[00000030h] 24_2_0149EB8A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0149EB8A mov eax, dword ptr fs:[00000030h] 24_2_0149EB8A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0149EB8A mov eax, dword ptr fs:[00000030h] 24_2_0149EB8A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142138B mov eax, dword ptr fs:[00000030h] 24_2_0142138B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142138B mov eax, dword ptr fs:[00000030h] 24_2_0142138B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142138B mov eax, dword ptr fs:[00000030h] 24_2_0142138B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014AD380 mov ecx, dword ptr fs:[00000030h] 24_2_014AD380
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01401B8F mov eax, dword ptr fs:[00000030h] 24_2_01401B8F
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01401B8F mov eax, dword ptr fs:[00000030h] 24_2_01401B8F
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142B390 mov eax, dword ptr fs:[00000030h] 24_2_0142B390
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01422397 mov eax, dword ptr fs:[00000030h] 24_2_01422397
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F1BE9 mov eax, dword ptr fs:[00000030h] 24_2_013F1BE9
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141EB9A mov eax, dword ptr fs:[00000030h] 24_2_0141EB9A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141EB9A mov eax, dword ptr fs:[00000030h] 24_2_0141EB9A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B1BA8 mov eax, dword ptr fs:[00000030h] 24_2_014B1BA8
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C5BA5 mov eax, dword ptr fs:[00000030h] 24_2_014C5BA5
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01424BAD mov eax, dword ptr fs:[00000030h] 24_2_01424BAD
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01424BAD mov eax, dword ptr fs:[00000030h] 24_2_01424BAD
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01424BAD mov eax, dword ptr fs:[00000030h] 24_2_01424BAD
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C9BBE mov eax, dword ptr fs:[00000030h] 24_2_014C9BBE
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C8BB6 mov eax, dword ptr fs:[00000030h] 24_2_014C8BB6
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F8239 mov eax, dword ptr fs:[00000030h] 24_2_013F8239
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F8239 mov eax, dword ptr fs:[00000030h] 24_2_013F8239
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F8239 mov eax, dword ptr fs:[00000030h] 24_2_013F8239
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B1A5F mov eax, dword ptr fs:[00000030h] 24_2_014B1A5F
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014BEA55 mov eax, dword ptr fs:[00000030h] 24_2_014BEA55
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01484257 mov eax, dword ptr fs:[00000030h] 24_2_01484257
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F4A20 mov eax, dword ptr fs:[00000030h] 24_2_013F4A20
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F4A20 mov eax, dword ptr fs:[00000030h] 24_2_013F4A20
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013FAA16 mov eax, dword ptr fs:[00000030h] 24_2_013FAA16
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013FAA16 mov eax, dword ptr fs:[00000030h] 24_2_013FAA16
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014AB260 mov eax, dword ptr fs:[00000030h] 24_2_014AB260
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014AB260 mov eax, dword ptr fs:[00000030h] 24_2_014AB260
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01435A69 mov eax, dword ptr fs:[00000030h] 24_2_01435A69
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01435A69 mov eax, dword ptr fs:[00000030h] 24_2_01435A69
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01435A69 mov eax, dword ptr fs:[00000030h] 24_2_01435A69
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C8A62 mov eax, dword ptr fs:[00000030h] 24_2_014C8A62
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F5210 mov eax, dword ptr fs:[00000030h] 24_2_013F5210
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F5210 mov ecx, dword ptr fs:[00000030h] 24_2_013F5210
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F5210 mov eax, dword ptr fs:[00000030h] 24_2_013F5210
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F5210 mov eax, dword ptr fs:[00000030h] 24_2_013F5210
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0143927A mov eax, dword ptr fs:[00000030h] 24_2_0143927A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01408A0A mov eax, dword ptr fs:[00000030h] 24_2_01408A0A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01413A1C mov eax, dword ptr fs:[00000030h] 24_2_01413A1C
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014BAA16 mov eax, dword ptr fs:[00000030h] 24_2_014BAA16
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014BAA16 mov eax, dword ptr fs:[00000030h] 24_2_014BAA16
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B1229 mov eax, dword ptr fs:[00000030h] 24_2_014B1229
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A229 mov eax, dword ptr fs:[00000030h] 24_2_0141A229
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A229 mov eax, dword ptr fs:[00000030h] 24_2_0141A229
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A229 mov eax, dword ptr fs:[00000030h] 24_2_0141A229
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A229 mov eax, dword ptr fs:[00000030h] 24_2_0141A229
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A229 mov eax, dword ptr fs:[00000030h] 24_2_0141A229
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A229 mov eax, dword ptr fs:[00000030h] 24_2_0141A229
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A229 mov eax, dword ptr fs:[00000030h] 24_2_0141A229
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A229 mov eax, dword ptr fs:[00000030h] 24_2_0141A229
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141A229 mov eax, dword ptr fs:[00000030h] 24_2_0141A229
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01434A2C mov eax, dword ptr fs:[00000030h] 24_2_01434A2C
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01434A2C mov eax, dword ptr fs:[00000030h] 24_2_01434A2C
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B236 mov eax, dword ptr fs:[00000030h] 24_2_0141B236
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B236 mov eax, dword ptr fs:[00000030h] 24_2_0141B236
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B236 mov eax, dword ptr fs:[00000030h] 24_2_0141B236
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B236 mov eax, dword ptr fs:[00000030h] 24_2_0141B236
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B236 mov eax, dword ptr fs:[00000030h] 24_2_0141B236
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B236 mov eax, dword ptr fs:[00000030h] 24_2_0141B236
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F9240 mov eax, dword ptr fs:[00000030h] 24_2_013F9240
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F9240 mov eax, dword ptr fs:[00000030h] 24_2_013F9240
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F9240 mov eax, dword ptr fs:[00000030h] 24_2_013F9240
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F9240 mov eax, dword ptr fs:[00000030h] 24_2_013F9240
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01422ACB mov eax, dword ptr fs:[00000030h] 24_2_01422ACB
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C8ADD mov eax, dword ptr fs:[00000030h] 24_2_014C8ADD
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F52A5 mov eax, dword ptr fs:[00000030h] 24_2_013F52A5
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F52A5 mov eax, dword ptr fs:[00000030h] 24_2_013F52A5
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F52A5 mov eax, dword ptr fs:[00000030h] 24_2_013F52A5
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F52A5 mov eax, dword ptr fs:[00000030h] 24_2_013F52A5
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F52A5 mov eax, dword ptr fs:[00000030h] 24_2_013F52A5
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F1AA0 mov eax, dword ptr fs:[00000030h] 24_2_013F1AA0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4AEF mov eax, dword ptr fs:[00000030h] 24_2_014B4AEF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4AEF mov eax, dword ptr fs:[00000030h] 24_2_014B4AEF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4AEF mov eax, dword ptr fs:[00000030h] 24_2_014B4AEF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4AEF mov eax, dword ptr fs:[00000030h] 24_2_014B4AEF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4AEF mov eax, dword ptr fs:[00000030h] 24_2_014B4AEF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4AEF mov eax, dword ptr fs:[00000030h] 24_2_014B4AEF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4AEF mov eax, dword ptr fs:[00000030h] 24_2_014B4AEF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4AEF mov eax, dword ptr fs:[00000030h] 24_2_014B4AEF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4AEF mov eax, dword ptr fs:[00000030h] 24_2_014B4AEF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4AEF mov eax, dword ptr fs:[00000030h] 24_2_014B4AEF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4AEF mov eax, dword ptr fs:[00000030h] 24_2_014B4AEF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4AEF mov eax, dword ptr fs:[00000030h] 24_2_014B4AEF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4AEF mov eax, dword ptr fs:[00000030h] 24_2_014B4AEF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4AEF mov eax, dword ptr fs:[00000030h] 24_2_014B4AEF
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01422AE4 mov eax, dword ptr fs:[00000030h] 24_2_01422AE4
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142DA88 mov eax, dword ptr fs:[00000030h] 24_2_0142DA88
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142DA88 mov eax, dword ptr fs:[00000030h] 24_2_0142DA88
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B129A mov eax, dword ptr fs:[00000030h] 24_2_014B129A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142D294 mov eax, dword ptr fs:[00000030h] 24_2_0142D294
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142D294 mov eax, dword ptr fs:[00000030h] 24_2_0142D294
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01425AA0 mov eax, dword ptr fs:[00000030h] 24_2_01425AA0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01425AA0 mov eax, dword ptr fs:[00000030h] 24_2_01425AA0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F12D4 mov eax, dword ptr fs:[00000030h] 24_2_013F12D4
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0140AAB0 mov eax, dword ptr fs:[00000030h] 24_2_0140AAB0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0140AAB0 mov eax, dword ptr fs:[00000030h] 24_2_0140AAB0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142FAB0 mov eax, dword ptr fs:[00000030h] 24_2_0142FAB0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F3ACA mov eax, dword ptr fs:[00000030h] 24_2_013F3ACA
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014212BD mov esi, dword ptr fs:[00000030h] 24_2_014212BD
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014212BD mov eax, dword ptr fs:[00000030h] 24_2_014212BD
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014212BD mov eax, dword ptr fs:[00000030h] 24_2_014212BD
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F5AC0 mov eax, dword ptr fs:[00000030h] 24_2_013F5AC0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F5AC0 mov eax, dword ptr fs:[00000030h] 24_2_013F5AC0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F5AC0 mov eax, dword ptr fs:[00000030h] 24_2_013F5AC0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01433D43 mov eax, dword ptr fs:[00000030h] 24_2_01433D43
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01473540 mov eax, dword ptr fs:[00000030h] 24_2_01473540
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014A3D40 mov eax, dword ptr fs:[00000030h] 24_2_014A3D40
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014A8D47 mov eax, dword ptr fs:[00000030h] 24_2_014A8D47
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013FAD30 mov eax, dword ptr fs:[00000030h] 24_2_013FAD30
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01417D50 mov eax, dword ptr fs:[00000030h] 24_2_01417D50
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01434D51 mov eax, dword ptr fs:[00000030h] 24_2_01434D51
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01434D51 mov eax, dword ptr fs:[00000030h] 24_2_01434D51
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141C577 mov eax, dword ptr fs:[00000030h] 24_2_0141C577
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141C577 mov eax, dword ptr fs:[00000030h] 24_2_0141C577
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01418D76 mov eax, dword ptr fs:[00000030h] 24_2_01418D76
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01418D76 mov eax, dword ptr fs:[00000030h] 24_2_01418D76
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01418D76 mov eax, dword ptr fs:[00000030h] 24_2_01418D76
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01418D76 mov eax, dword ptr fs:[00000030h] 24_2_01418D76
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01418D76 mov eax, dword ptr fs:[00000030h] 24_2_01418D76
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B3518 mov eax, dword ptr fs:[00000030h] 24_2_014B3518
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B3518 mov eax, dword ptr fs:[00000030h] 24_2_014B3518
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B3518 mov eax, dword ptr fs:[00000030h] 24_2_014B3518
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142F527 mov eax, dword ptr fs:[00000030h] 24_2_0142F527
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142F527 mov eax, dword ptr fs:[00000030h] 24_2_0142F527
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142F527 mov eax, dword ptr fs:[00000030h] 24_2_0142F527
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0147A537 mov eax, dword ptr fs:[00000030h] 24_2_0147A537
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014BE539 mov eax, dword ptr fs:[00000030h] 24_2_014BE539
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F354C mov eax, dword ptr fs:[00000030h] 24_2_013F354C
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F354C mov eax, dword ptr fs:[00000030h] 24_2_013F354C
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01403D34 mov eax, dword ptr fs:[00000030h] 24_2_01403D34
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01403D34 mov eax, dword ptr fs:[00000030h] 24_2_01403D34
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01403D34 mov eax, dword ptr fs:[00000030h] 24_2_01403D34
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01403D34 mov eax, dword ptr fs:[00000030h] 24_2_01403D34
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01403D34 mov eax, dword ptr fs:[00000030h] 24_2_01403D34
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01403D34 mov eax, dword ptr fs:[00000030h] 24_2_01403D34
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01403D34 mov eax, dword ptr fs:[00000030h] 24_2_01403D34
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01403D34 mov eax, dword ptr fs:[00000030h] 24_2_01403D34
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01403D34 mov eax, dword ptr fs:[00000030h] 24_2_01403D34
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01403D34 mov eax, dword ptr fs:[00000030h] 24_2_01403D34
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01403D34 mov eax, dword ptr fs:[00000030h] 24_2_01403D34
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01403D34 mov eax, dword ptr fs:[00000030h] 24_2_01403D34
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01403D34 mov eax, dword ptr fs:[00000030h] 24_2_01403D34
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C8D34 mov eax, dword ptr fs:[00000030h] 24_2_014C8D34
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01424D3B mov eax, dword ptr fs:[00000030h] 24_2_01424D3B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01424D3B mov eax, dword ptr fs:[00000030h] 24_2_01424D3B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01424D3B mov eax, dword ptr fs:[00000030h] 24_2_01424D3B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01476DC9 mov eax, dword ptr fs:[00000030h] 24_2_01476DC9
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01476DC9 mov eax, dword ptr fs:[00000030h] 24_2_01476DC9
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01476DC9 mov eax, dword ptr fs:[00000030h] 24_2_01476DC9
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01476DC9 mov ecx, dword ptr fs:[00000030h] 24_2_01476DC9
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01476DC9 mov eax, dword ptr fs:[00000030h] 24_2_01476DC9
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01476DC9 mov eax, dword ptr fs:[00000030h] 24_2_01476DC9
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014AFDD3 mov eax, dword ptr fs:[00000030h] 24_2_014AFDD3
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0140D5E0 mov eax, dword ptr fs:[00000030h] 24_2_0140D5E0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0140D5E0 mov eax, dword ptr fs:[00000030h] 24_2_0140D5E0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014BFDE2 mov eax, dword ptr fs:[00000030h] 24_2_014BFDE2
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014BFDE2 mov eax, dword ptr fs:[00000030h] 24_2_014BFDE2
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014BFDE2 mov eax, dword ptr fs:[00000030h] 24_2_014BFDE2
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014BFDE2 mov eax, dword ptr fs:[00000030h] 24_2_014BFDE2
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F3591 mov eax, dword ptr fs:[00000030h] 24_2_013F3591
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014295EC mov eax, dword ptr fs:[00000030h] 24_2_014295EC
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F2D8A mov eax, dword ptr fs:[00000030h] 24_2_013F2D8A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F2D8A mov eax, dword ptr fs:[00000030h] 24_2_013F2D8A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F2D8A mov eax, dword ptr fs:[00000030h] 24_2_013F2D8A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F2D8A mov eax, dword ptr fs:[00000030h] 24_2_013F2D8A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F2D8A mov eax, dword ptr fs:[00000030h] 24_2_013F2D8A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014A8DF1 mov eax, dword ptr fs:[00000030h] 24_2_014A8DF1
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01422581 mov eax, dword ptr fs:[00000030h] 24_2_01422581
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01422581 mov eax, dword ptr fs:[00000030h] 24_2_01422581
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01422581 mov eax, dword ptr fs:[00000030h] 24_2_01422581
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01422581 mov eax, dword ptr fs:[00000030h] 24_2_01422581
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B2D82 mov eax, dword ptr fs:[00000030h] 24_2_014B2D82
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B2D82 mov eax, dword ptr fs:[00000030h] 24_2_014B2D82
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B2D82 mov eax, dword ptr fs:[00000030h] 24_2_014B2D82
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B2D82 mov eax, dword ptr fs:[00000030h] 24_2_014B2D82
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B2D82 mov eax, dword ptr fs:[00000030h] 24_2_014B2D82
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B2D82 mov eax, dword ptr fs:[00000030h] 24_2_014B2D82
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B2D82 mov eax, dword ptr fs:[00000030h] 24_2_014B2D82
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014BB581 mov eax, dword ptr fs:[00000030h] 24_2_014BB581
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014BB581 mov eax, dword ptr fs:[00000030h] 24_2_014BB581
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014BB581 mov eax, dword ptr fs:[00000030h] 24_2_014BB581
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014BB581 mov eax, dword ptr fs:[00000030h] 24_2_014BB581
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F95F0 mov eax, dword ptr fs:[00000030h] 24_2_013F95F0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F95F0 mov ecx, dword ptr fs:[00000030h] 24_2_013F95F0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142FD9B mov eax, dword ptr fs:[00000030h] 24_2_0142FD9B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142FD9B mov eax, dword ptr fs:[00000030h] 24_2_0142FD9B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C05AC mov eax, dword ptr fs:[00000030h] 24_2_014C05AC
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C05AC mov eax, dword ptr fs:[00000030h] 24_2_014C05AC
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014265A0 mov eax, dword ptr fs:[00000030h] 24_2_014265A0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014265A0 mov eax, dword ptr fs:[00000030h] 24_2_014265A0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014265A0 mov eax, dword ptr fs:[00000030h] 24_2_014265A0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014235A1 mov eax, dword ptr fs:[00000030h] 24_2_014235A1
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01421DB5 mov eax, dword ptr fs:[00000030h] 24_2_01421DB5
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01421DB5 mov eax, dword ptr fs:[00000030h] 24_2_01421DB5
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01421DB5 mov eax, dword ptr fs:[00000030h] 24_2_01421DB5
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F15C1 mov eax, dword ptr fs:[00000030h] 24_2_013F15C1
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F4439 mov eax, dword ptr fs:[00000030h] 24_2_013F4439
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142A44B mov eax, dword ptr fs:[00000030h] 24_2_0142A44B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0148C450 mov eax, dword ptr fs:[00000030h] 24_2_0148C450
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0148C450 mov eax, dword ptr fs:[00000030h] 24_2_0148C450
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C8450 mov eax, dword ptr fs:[00000030h] 24_2_014C8450
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141746D mov eax, dword ptr fs:[00000030h] 24_2_0141746D
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01435C70 mov eax, dword ptr fs:[00000030h] 24_2_01435C70
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B477 mov eax, dword ptr fs:[00000030h] 24_2_0141B477
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B477 mov eax, dword ptr fs:[00000030h] 24_2_0141B477
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B477 mov eax, dword ptr fs:[00000030h] 24_2_0141B477
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B477 mov eax, dword ptr fs:[00000030h] 24_2_0141B477
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B477 mov eax, dword ptr fs:[00000030h] 24_2_0141B477
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B477 mov eax, dword ptr fs:[00000030h] 24_2_0141B477
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B477 mov eax, dword ptr fs:[00000030h] 24_2_0141B477
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B477 mov eax, dword ptr fs:[00000030h] 24_2_0141B477
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B477 mov eax, dword ptr fs:[00000030h] 24_2_0141B477
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B477 mov eax, dword ptr fs:[00000030h] 24_2_0141B477
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B477 mov eax, dword ptr fs:[00000030h] 24_2_0141B477
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141B477 mov eax, dword ptr fs:[00000030h] 24_2_0141B477
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142AC7B mov eax, dword ptr fs:[00000030h] 24_2_0142AC7B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142AC7B mov eax, dword ptr fs:[00000030h] 24_2_0142AC7B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142AC7B mov eax, dword ptr fs:[00000030h] 24_2_0142AC7B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142AC7B mov eax, dword ptr fs:[00000030h] 24_2_0142AC7B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142AC7B mov eax, dword ptr fs:[00000030h] 24_2_0142AC7B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142AC7B mov eax, dword ptr fs:[00000030h] 24_2_0142AC7B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142AC7B mov eax, dword ptr fs:[00000030h] 24_2_0142AC7B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142AC7B mov eax, dword ptr fs:[00000030h] 24_2_0142AC7B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142AC7B mov eax, dword ptr fs:[00000030h] 24_2_0142AC7B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142AC7B mov eax, dword ptr fs:[00000030h] 24_2_0142AC7B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142AC7B mov eax, dword ptr fs:[00000030h] 24_2_0142AC7B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C8C75 mov eax, dword ptr fs:[00000030h] 24_2_014C8C75
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C740D mov eax, dword ptr fs:[00000030h] 24_2_014C740D
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C740D mov eax, dword ptr fs:[00000030h] 24_2_014C740D
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C740D mov eax, dword ptr fs:[00000030h] 24_2_014C740D
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B1C06 mov eax, dword ptr fs:[00000030h] 24_2_014B1C06
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B1C06 mov eax, dword ptr fs:[00000030h] 24_2_014B1C06
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B1C06 mov eax, dword ptr fs:[00000030h] 24_2_014B1C06
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B1C06 mov eax, dword ptr fs:[00000030h] 24_2_014B1C06
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B1C06 mov eax, dword ptr fs:[00000030h] 24_2_014B1C06
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B1C06 mov eax, dword ptr fs:[00000030h] 24_2_014B1C06
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B1C06 mov eax, dword ptr fs:[00000030h] 24_2_014B1C06
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B1C06 mov eax, dword ptr fs:[00000030h] 24_2_014B1C06
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B1C06 mov eax, dword ptr fs:[00000030h] 24_2_014B1C06
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B1C06 mov eax, dword ptr fs:[00000030h] 24_2_014B1C06
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B1C06 mov eax, dword ptr fs:[00000030h] 24_2_014B1C06
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B1C06 mov eax, dword ptr fs:[00000030h] 24_2_014B1C06
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B1C06 mov eax, dword ptr fs:[00000030h] 24_2_014B1C06
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B1C06 mov eax, dword ptr fs:[00000030h] 24_2_014B1C06
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01476C0A mov eax, dword ptr fs:[00000030h] 24_2_01476C0A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01476C0A mov eax, dword ptr fs:[00000030h] 24_2_01476C0A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01476C0A mov eax, dword ptr fs:[00000030h] 24_2_01476C0A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01476C0A mov eax, dword ptr fs:[00000030h] 24_2_01476C0A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C8C14 mov eax, dword ptr fs:[00000030h] 24_2_014C8C14
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142BC2C mov eax, dword ptr fs:[00000030h] 24_2_0142BC2C
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0140B433 mov eax, dword ptr fs:[00000030h] 24_2_0140B433
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0140B433 mov eax, dword ptr fs:[00000030h] 24_2_0140B433
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0140B433 mov eax, dword ptr fs:[00000030h] 24_2_0140B433
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01423C3E mov eax, dword ptr fs:[00000030h] 24_2_01423C3E
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01423C3E mov eax, dword ptr fs:[00000030h] 24_2_01423C3E
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01423C3E mov eax, dword ptr fs:[00000030h] 24_2_01423C3E
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142CCC0 mov eax, dword ptr fs:[00000030h] 24_2_0142CCC0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142CCC0 mov eax, dword ptr fs:[00000030h] 24_2_0142CCC0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142CCC0 mov eax, dword ptr fs:[00000030h] 24_2_0142CCC0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142CCC0 mov eax, dword ptr fs:[00000030h] 24_2_0142CCC0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F4CB0 mov eax, dword ptr fs:[00000030h] 24_2_013F4CB0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C8CD6 mov eax, dword ptr fs:[00000030h] 24_2_014C8CD6
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F649B mov eax, dword ptr fs:[00000030h] 24_2_013F649B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F649B mov eax, dword ptr fs:[00000030h] 24_2_013F649B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B14FB mov eax, dword ptr fs:[00000030h] 24_2_014B14FB
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01476CF0 mov eax, dword ptr fs:[00000030h] 24_2_01476CF0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01476CF0 mov eax, dword ptr fs:[00000030h] 24_2_01476CF0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01476CF0 mov eax, dword ptr fs:[00000030h] 24_2_01476CF0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F1480 mov eax, dword ptr fs:[00000030h] 24_2_013F1480
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0140849B mov eax, dword ptr fs:[00000030h] 24_2_0140849B
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4496 mov eax, dword ptr fs:[00000030h] 24_2_014B4496
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4496 mov eax, dword ptr fs:[00000030h] 24_2_014B4496
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4496 mov eax, dword ptr fs:[00000030h] 24_2_014B4496
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4496 mov eax, dword ptr fs:[00000030h] 24_2_014B4496
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4496 mov eax, dword ptr fs:[00000030h] 24_2_014B4496
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4496 mov eax, dword ptr fs:[00000030h] 24_2_014B4496
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4496 mov eax, dword ptr fs:[00000030h] 24_2_014B4496
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4496 mov eax, dword ptr fs:[00000030h] 24_2_014B4496
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4496 mov eax, dword ptr fs:[00000030h] 24_2_014B4496
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4496 mov eax, dword ptr fs:[00000030h] 24_2_014B4496
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4496 mov eax, dword ptr fs:[00000030h] 24_2_014B4496
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4496 mov eax, dword ptr fs:[00000030h] 24_2_014B4496
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B4496 mov eax, dword ptr fs:[00000030h] 24_2_014B4496
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F2CDB mov eax, dword ptr fs:[00000030h] 24_2_013F2CDB
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142D4B0 mov eax, dword ptr fs:[00000030h] 24_2_0142D4B0
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C9CB3 mov eax, dword ptr fs:[00000030h] 24_2_014C9CB3
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0140EF40 mov eax, dword ptr fs:[00000030h] 24_2_0140EF40
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142DF4C mov eax, dword ptr fs:[00000030h] 24_2_0142DF4C
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F6730 mov eax, dword ptr fs:[00000030h] 24_2_013F6730
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F6730 mov eax, dword ptr fs:[00000030h] 24_2_013F6730
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F6730 mov eax, dword ptr fs:[00000030h] 24_2_013F6730
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F4F2E mov eax, dword ptr fs:[00000030h] 24_2_013F4F2E
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_013F4F2E mov eax, dword ptr fs:[00000030h] 24_2_013F4F2E
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01485F5F mov eax, dword ptr fs:[00000030h] 24_2_01485F5F
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01485F5F mov eax, dword ptr fs:[00000030h] 24_2_01485F5F
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01485F5F mov eax, dword ptr fs:[00000030h] 24_2_01485F5F
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01485F5F mov eax, dword ptr fs:[00000030h] 24_2_01485F5F
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_01485F5F mov eax, dword ptr fs:[00000030h] 24_2_01485F5F
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014B1751 mov eax, dword ptr fs:[00000030h] 24_2_014B1751
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0140FF60 mov eax, dword ptr fs:[00000030h] 24_2_0140FF60
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141E760 mov eax, dword ptr fs:[00000030h] 24_2_0141E760
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0141E760 mov eax, dword ptr fs:[00000030h] 24_2_0141E760
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C8F6A mov eax, dword ptr fs:[00000030h] 24_2_014C8F6A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142CF6A mov eax, dword ptr fs:[00000030h] 24_2_0142CF6A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142CF6A mov eax, dword ptr fs:[00000030h] 24_2_0142CF6A
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C070D mov eax, dword ptr fs:[00000030h] 24_2_014C070D
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_014C070D mov eax, dword ptr fs:[00000030h] 24_2_014C070D
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_0142C707 mov eax, dword ptr fs:[00000030h] 24_2_0142C707
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Code function: 24_2_00409B20 LdrLoadDll, 24_2_00409B20
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Memory written: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Memory written: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Memory written: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe base: C22008 Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Memory written: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe base: 400000 value starts with: 4D5A Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Thread register set: target process: 3472 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Start-Sleep -s 20 Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Process created: C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe C:\Users\user\AppData\Local\Temp\gLO4rDsniT.exe Jump to behavior
Source: explorer.exe, 00000019.00000000.478793677.00000000089FF000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000019.00000002.514938411.0000000001640000.00000002.00020000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000019.00000002.514938411.0000000001640000.00000002.00020000.sdmp Binary or memory string: SProgram Managerl
Source: explorer.exe, 00000019.00000000.469199654.0000000001128000.00000004.00000020.sdmp Binary or memory string: ProgmanOMEa
Source: explorer.exe, 00000019.00000002.514938411.0000000001640000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000019.00000002.514938411.0000000001640000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Users\user\Desktop\gLO4rDsniT.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gLO4rDsniT.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 24.2.gLO4rDsniT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.gLO4rDsniT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000018.00000002.545335617.0000000001800000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.545104364.0000000001700000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.466649182.0000000003B59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000000.493656809.0000000006740000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.543592754.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.529006238.0000000006740000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.467041262.0000000003C49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.466807357.0000000003BB4000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 24.2.gLO4rDsniT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.gLO4rDsniT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000018.00000002.545335617.0000000001800000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.545104364.0000000001700000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.466649182.0000000003B59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000000.493656809.0000000006740000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.543592754.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.529006238.0000000006740000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.467041262.0000000003C49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.466807357.0000000003BB4000.00000004.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 483687 Sample: gLO4rDsniT Startdate: 15/09/2021 Architecture: WINDOWS Score: 100 26 Found malware configuration 2->26 28 Malicious sample detected (through community Yara rule) 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 3 other signatures 2->32 7 gLO4rDsniT.exe 6 2->7         started        process3 file4 20 C:\Users\user\AppData\...\gLO4rDsniT.exe, PE32 7->20 dropped 22 C:\Users\...\gLO4rDsniT.exe:Zone.Identifier, ASCII 7->22 dropped 24 C:\Users\user\AppData\...\gLO4rDsniT.exe.log, ASCII 7->24 dropped 34 Writes to foreign memory regions 7->34 36 Injects a PE file into a foreign processes 7->36 11 gLO4rDsniT.exe 7->11         started        14 powershell.exe 18 7->14         started        signatures5 process6 signatures7 38 Multi AV Scanner detection for dropped file 11->38 40 Machine Learning detection for dropped file 11->40 42 Modifies the context of a thread in another process (thread injection) 11->42 44 2 other signatures 11->44 16 explorer.exe 11->16 injected 18 conhost.exe 14->18         started        process8
No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.inboundtechnology.net/b9qq/ true
  • Avira URL Cloud: safe
 low