Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
6109238.exe

Overview

General Information

Sample Name:6109238.exe
Analysis ID:680485
MD5:2aeb09e3b19012d3d2add45559422416
SHA1:0364e572469a4bfb486c982348c7fa62ccb7e818
SHA256:917e03484856f0980f2150822a231e0f73e3cef3f074ea1644dcbd1082590399
Tags:exeformbook
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Modifies the prolog of user mode functions (user mode inline hooks)
Injects a PE file into a foreign processes
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Adds a directory exclusion to Windows Defender
Uses schtasks.exe or at.exe to add and modify task schedules
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Checks if the current process is being debugged
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64
  • 6109238.exe (PID: 1980 cmdline: "C:\Users\user\Desktop\6109238.exe" MD5: 2AEB09E3B19012D3D2ADD45559422416)
    • powershell.exe (PID: 5756 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eHkVrJJ.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 5064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • schtasks.exe (PID: 2276 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eHkVrJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp1585.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 1384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • 6109238.exe (PID: 5392 cmdline: C:\Users\user\Desktop\6109238.exe MD5: 2AEB09E3B19012D3D2ADD45559422416)
      • explorer.exe (PID: 3688 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)
        • help.exe (PID: 2056 cmdline: C:\Windows\SysWOW64\help.exe MD5: 09A715036F14D3632AD03B52D1DA6BFF)
          • cmd.exe (PID: 5596 cmdline: /c del "C:\Users\user\Desktop\6109238.exe" MD5: F3BDBE3BB6F734E357235F4D5898582D)
            • conhost.exe (PID: 6112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.ruichuo888.com/g2i8/"], "decoy": ["ziezi.top", "vngik.com", "alternativaporbenidorm.com", "papinahooy.com", "aldemyangin.com", "943757.com", "ayty8.com", "rindedwladku.xyz", "highwoodcorp.com", "tyarx.com", "pikkunoita.online", "airtaxifl.com", "bjbjbfc.com", "busan.xyz", "ieeeturkeyblog.com", "valtuo.store", "xinyenet.net", "ditral.com", "protocolozero.info", "newbrunswickcreditunions.com", "elainebaby.xyz", "koidesignstudio.com", "99vin.group", "archipel-aventure.com", "khademi.group", "takaboar.com", "rzxx123.net", "games-wedding.com", "spinhaus.com", "51sic.com", "3dtouch.asia", "tracking173.xyz", "febmaklstudio.xyz", "cookingshots.com", "royaltristate.com", "amangift.store", "vehicleaccessories.store", "kannadasuddi.com", "the4weekway.international", "asd1118.xyz", "cursosparapotenciarte.store", "faithsquint.sbs", "otom.blue", "mamaandpapafoodtruck.com", "287by.com", "memoryuniverse.com", "televizeme.tech", "zpw168.com", "kayseriozelders.xyz", "solytics.xyz", "3kidsandahouse.com", "020dd.com", "shawlco.com", "wekiok05.top", "zalandashop.com", "tenergia.info", "nedreptate.net", "dentalimplantnearme-sg.space", "vpussy.com", "katzenglueck.net", "leftygolf.online", "simplehealthquotes.today", "estuidioma.online", "aviaboofit.site"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000A.00000002.640356208.0000000000EC0000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    0000000A.00000002.640356208.0000000000EC0000.00000004.00000800.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x6251:$a1: 3C 30 50 4F 53 54 74 09 40
    • 0x1cbb0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    • 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
    0000000A.00000002.640356208.0000000000EC0000.00000004.00000800.00020000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    0000000A.00000002.640356208.0000000000EC0000.00000004.00000800.00020000.00000000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0x18839:$sqlite3step: 68 34 1C 7B E1
    • 0x1894c:$sqlite3step: 68 34 1C 7B E1
    • 0x18868:$sqlite3text: 68 38 2A 90 C5
    • 0x1898d:$sqlite3text: 68 38 2A 90 C5
    • 0x1887b:$sqlite3blob: 68 53 D8 7F 8C
    • 0x189a3:$sqlite3blob: 68 53 D8 7F 8C
    00000005.00000000.423502729.0000000000401000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
      Click to see the 29 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      5.0.6109238.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        5.0.6109238.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
        • 0x5451:$a1: 3C 30 50 4F 53 54 74 09 40
        • 0x1bdb0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
        • 0x9bbf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
        • 0x14aa7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
        5.0.6109238.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
        • 0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
        • 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
        • 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
        • 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
        • 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
        • 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
        • 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D
        • 0x1ab17:$sequence_8: 3C 54 74 04 3C 74 75 F4
        • 0x1bb1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
        5.0.6109238.exe.400000.0.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
        • 0x17a39:$sqlite3step: 68 34 1C 7B E1
        • 0x17b4c:$sqlite3step: 68 34 1C 7B E1
        • 0x17a68:$sqlite3text: 68 38 2A 90 C5
        • 0x17b8d:$sqlite3text: 68 38 2A 90 C5
        • 0x17a7b:$sqlite3blob: 68 53 D8 7F 8C
        • 0x17ba3:$sqlite3blob: 68 53 D8 7F 8C
        0.2.6109238.exe.43053d8.6.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
          Click to see the 3 entries

          Sigma Signatures

          ⊘No Sigma rule has matched

          Snort Signatures

          ⊘No Snort rule has matched

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Multi AV Scanner detection for submitted file
          Source: 6109238.exeReversingLabs: Detection: 29%
          Yara detected FormBook
          Source: Yara matchFile source: 5.0.6109238.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.6109238.exe.43053d8.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000A.00000002.640356208.0000000000EC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000000.423502729.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000009.00000000.498783665.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000009.00000000.519597064.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.442527217.0000000004305000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.640116150.0000000000E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.639269207.0000000000C70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Antivirus detection for URL or domain
          Source: www.ruichuo888.com/g2i8/Avira URL Cloud: Label: malware
          Multi AV Scanner detection for dropped file
          Source: C:\Users\user\AppData\Roaming\eHkVrJJ.exeReversingLabs: Detection: 29%
          Machine Learning detection for sample
          Source: 6109238.exeJoe Sandbox ML: detected
          Machine Learning detection for dropped file
          Source: C:\Users\user\AppData\Roaming\eHkVrJJ.exeJoe Sandbox ML: detected
          Source: 5.0.6109238.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 0000000A.00000002.640356208.0000000000EC0000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.ruichuo888.com/g2i8/"], "decoy": ["ziezi.top", "vngik.com", "alternativaporbenidorm.com", "papinahooy.com", "aldemyangin.com", "943757.com", "ayty8.com", "rindedwladku.xyz", "highwoodcorp.com", "tyarx.com", "pikkunoita.online", "airtaxifl.com", "bjbjbfc.com", "busan.xyz", "ieeeturkeyblog.com", "valtuo.store", "xinyenet.net", "ditral.com", "protocolozero.info", "newbrunswickcreditunions.com", "elainebaby.xyz", "koidesignstudio.com", "99vin.group", "archipel-aventure.com", "khademi.group", "takaboar.com", "rzxx123.net", "games-wedding.com", "spinhaus.com", "51sic.com", "3dtouch.asia", "tracking173.xyz", "febmaklstudio.xyz", "cookingshots.com", "royaltristate.com", "amangift.store", "vehicleaccessories.store", "kannadasuddi.com", "the4weekway.international", "asd1118.xyz", "cursosparapotenciarte.store", "faithsquint.sbs", "otom.blue", "mamaandpapafoodtruck.com", "287by.com", "memoryuniverse.com", "televizeme.tech", "zpw168.com", "kayseriozelders.xyz", "solytics.xyz", "3kidsandahouse.com", "020dd.com", "shawlco.com", "wekiok05.top", "zalandashop.com", "tenergia.info", "nedreptate.net", "dentalimplantnearme-sg.space", "vpussy.com", "katzenglueck.net", "leftygolf.online", "simplehealthquotes.today", "estuidioma.online", "aviaboofit.site"]}
          Source: 6109238.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: 6109238.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Binary string: wntdll.pdbUGP source: 6109238.exe, 00000005.00000003.427753698.0000000001558000.00000004.00000800.00020000.00000000.sdmp, 6109238.exe, 00000005.00000002.534207193.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, 6109238.exe, 00000005.00000003.424452621.00000000013C0000.00000004.00000800.00020000.00000000.sdmp, help.exe, 0000000A.00000002.642772599.0000000003480000.00000040.00000800.00020000.00000000.sdmp, help.exe, 0000000A.00000003.536061575.00000000032E8000.00000004.00000800.00020000.00000000.sdmp, help.exe, 0000000A.00000002.643970249.000000000359F000.00000040.00000800.00020000.00000000.sdmp, help.exe, 0000000A.00000003.533670092.0000000000FFA000.00000004.00000800.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: 6109238.exe, 6109238.exe, 00000005.00000003.427753698.0000000001558000.00000004.00000800.00020000.00000000.sdmp, 6109238.exe, 00000005.00000002.534207193.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, 6109238.exe, 00000005.00000003.424452621.00000000013C0000.00000004.00000800.00020000.00000000.sdmp, help.exe, 0000000A.00000002.642772599.0000000003480000.00000040.00000800.00020000.00000000.sdmp, help.exe, 0000000A.00000003.536061575.00000000032E8000.00000004.00000800.00020000.00000000.sdmp, help.exe, 0000000A.00000002.643970249.000000000359F000.00000040.00000800.00020000.00000000.sdmp, help.exe, 0000000A.00000003.533670092.0000000000FFA000.00000004.00000800.00020000.00000000.sdmp

          Networking

          barindex
          C2 URLs / IPs found in malware configuration
          Source: Malware configuration extractorURLs: www.ruichuo888.com/g2i8/
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://fontfabrik.com
          Source: 6109238.exe, 00000000.00000002.433596561.0000000003225000.00000004.00000800.00020000.00000000.sdmp, 6109238.exe, 00000000.00000002.439859566.000000000345A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
          Source: 6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn

          E-Banking Fraud

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 5.0.6109238.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.6109238.exe.43053d8.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000A.00000002.640356208.0000000000EC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000000.423502729.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000009.00000000.498783665.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000009.00000000.519597064.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.442527217.0000000004305000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.640116150.0000000000E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.639269207.0000000000C70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 5.0.6109238.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 5.0.6109238.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 5.0.6109238.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0.2.6109238.exe.43053d8.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0.2.6109238.exe.43053d8.6.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0.2.6109238.exe.43053d8.6.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000A.00000002.640356208.0000000000EC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000A.00000002.640356208.0000000000EC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000A.00000002.640356208.0000000000EC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000005.00000000.423502729.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000005.00000000.423502729.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000005.00000000.423502729.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000009.00000000.498783665.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000009.00000000.498783665.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000009.00000000.498783665.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000009.00000000.519597064.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000009.00000000.519597064.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000009.00000000.519597064.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000000.00000002.442527217.0000000004305000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000000.00000002.442527217.0000000004305000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000000.00000002.442527217.0000000004305000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000A.00000002.640116150.0000000000E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000A.00000002.640116150.0000000000E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000A.00000002.640116150.0000000000E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000A.00000002.639269207.0000000000C70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000A.00000002.639269207.0000000000C70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000A.00000002.639269207.0000000000C70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: Process Memory Space: 6109238.exe PID: 1980, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: 6109238.exe PID: 5392, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: help.exe PID: 2056, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 6109238.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: 5.0.6109238.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 5.0.6109238.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 5.0.6109238.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0.2.6109238.exe.43053d8.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0.2.6109238.exe.43053d8.6.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0.2.6109238.exe.43053d8.6.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000A.00000002.640356208.0000000000EC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000A.00000002.640356208.0000000000EC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000A.00000002.640356208.0000000000EC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000005.00000000.423502729.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000005.00000000.423502729.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000005.00000000.423502729.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000009.00000000.498783665.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000009.00000000.498783665.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000009.00000000.498783665.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000009.00000000.519597064.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000009.00000000.519597064.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000009.00000000.519597064.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000000.00000002.442527217.0000000004305000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000000.00000002.442527217.0000000004305000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000000.00000002.442527217.0000000004305000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000A.00000002.640116150.0000000000E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000A.00000002.640116150.0000000000E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000A.00000002.640116150.0000000000E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000A.00000002.639269207.0000000000C70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000A.00000002.639269207.0000000000C70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000A.00000002.639269207.0000000000C70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: Process Memory Space: 6109238.exe PID: 1980, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: 6109238.exe PID: 5392, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: help.exe PID: 2056, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: C:\Users\user\Desktop\6109238.exeCode function: 0_2_0186D1CC
          Source: C:\Users\user\Desktop\6109238.exeCode function: 0_2_0186F160
          Source: C:\Users\user\Desktop\6109238.exeCode function: 0_2_0186F170
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01734120
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0171F900
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017D1002
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E28EC
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017420A0
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E20A8
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0172B090
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E2B28
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017DDBD2
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174EBB0
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E22AE
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E1D55
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01710D20
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E2D07
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0172D5E0
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E25DD
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01742581
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017DD466
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0172841F
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E1FF1
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01736E30
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017DD616
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E2EF7
          Source: C:\Users\user\Desktop\6109238.exeCode function: String function: 0171B150 appears 35 times
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759910 NtAdjustPrivilegesToken,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017599A0 NtCreateSection,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759860 NtQuerySystemInformation,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759840 NtDelayExecution,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017598F0 NtReadVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759A50 NtCreateFile,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759A20 NtResumeThread,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759A00 NtProtectVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759540 NtReadFile,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017595D0 NtClose,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759710 NtQueryInformationToken,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017597A0 NtUnmapViewOfSection,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759780 NtMapViewOfSection,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759660 NtAllocateVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017596E0 NtFreeVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759950 NtQueueApcThread,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017599D0 NtCreateProcessEx,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0175B040 NtSuspendThread,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759820 NtEnumerateKey,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017598A0 NtWriteVirtualMemory,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759B00 NtSetValueKey,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0175A3B0 NtGetContextThread,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759A10 NtQuerySection,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759A80 NtOpenDirectoryObject,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759560 NtWriteFile,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0175AD30 NtSetContextThread,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759520 NtWaitForSingleObject,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017595F0 NtQueryInformationFile,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0175A770 NtOpenThread,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759770 NtSetInformationFile,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759760 NtOpenProcess,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759730 NtQueryVirtualMemory,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0175A710 NtOpenProcessToken,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759FE0 NtCreateMutant,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759670 NtQueryInformationProcess,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759650 NtQueryValueKey,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759610 NtEnumerateValueKey,
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017596D0 NtCreateKey,
          Source: 6109238.exe, 00000000.00000002.448879453.0000000007930000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameKeysNormalize.dll4 vs 6109238.exe
          Source: 6109238.exe, 00000000.00000002.442527217.0000000004305000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDoncepre.dll@ vs 6109238.exe
          Source: 6109238.exe, 00000000.00000000.367739549.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameBinaryAr.exeB vs 6109238.exe
          Source: 6109238.exe, 00000000.00000002.449934520.0000000007BD0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameDoncepre.dll@ vs 6109238.exe
          Source: 6109238.exe, 00000000.00000002.449404490.0000000007A60000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameWebName.dll4 vs 6109238.exe
          Source: 6109238.exe, 00000005.00000003.430684639.0000000001677000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs 6109238.exe
          Source: 6109238.exe, 00000005.00000003.426052343.00000000014D6000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs 6109238.exe
          Source: 6109238.exe, 00000005.00000002.535959139.000000000180F000.00000040.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs 6109238.exe
          Source: 6109238.exeBinary or memory string: OriginalFilenameBinaryAr.exeB vs 6109238.exe
          Source: C:\Users\user\Desktop\6109238.exeSection loaded: onecoreuapcommonproxystub.dll
          Source: 6109238.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: eHkVrJJ.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: 6109238.exeReversingLabs: Detection: 29%
          Source: C:\Users\user\Desktop\6109238.exeFile read: C:\Users\user\Desktop\6109238.exeJump to behavior
          Source: 6109238.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: C:\Users\user\Desktop\6109238.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
          Source: unknownProcess created: C:\Users\user\Desktop\6109238.exe "C:\Users\user\Desktop\6109238.exe"
          Source: C:\Users\user\Desktop\6109238.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eHkVrJJ.exe
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\6109238.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eHkVrJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp1585.tmp
          Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\6109238.exeProcess created: C:\Users\user\Desktop\6109238.exe C:\Users\user\Desktop\6109238.exe
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\help.exe
          Source: C:\Windows\SysWOW64\help.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\6109238.exe"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\6109238.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eHkVrJJ.exe
          Source: C:\Users\user\Desktop\6109238.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eHkVrJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp1585.tmp
          Source: C:\Users\user\Desktop\6109238.exeProcess created: C:\Users\user\Desktop\6109238.exe C:\Users\user\Desktop\6109238.exe
          Source: C:\Windows\SysWOW64\help.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\6109238.exe"
          Source: C:\Users\user\Desktop\6109238.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
          Source: C:\Users\user\Desktop\6109238.exeFile created: C:\Users\user\AppData\Roaming\eHkVrJJ.exeJump to behavior
          Source: C:\Users\user\Desktop\6109238.exeFile created: C:\Users\user\AppData\Local\Temp\tmp1585.tmpJump to behavior
          Source: classification engineClassification label: mal100.troj.evad.winEXE@13/8@0/0
          Source: C:\Users\user\Desktop\6109238.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
          Source: 6109238.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
          Source: C:\Users\user\Desktop\6109238.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1384:120:WilError_01
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6112:120:WilError_01
          Source: C:\Users\user\Desktop\6109238.exeMutant created: \Sessions\1\BaseNamedObjects\AjTPgfGGWTEvNoTEhQPc
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5064:120:WilError_01
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: C:\Users\user\Desktop\6109238.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
          Source: 6109238.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
          Source: 6109238.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Binary string: wntdll.pdbUGP source: 6109238.exe, 00000005.00000003.427753698.0000000001558000.00000004.00000800.00020000.00000000.sdmp, 6109238.exe, 00000005.00000002.534207193.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, 6109238.exe, 00000005.00000003.424452621.00000000013C0000.00000004.00000800.00020000.00000000.sdmp, help.exe, 0000000A.00000002.642772599.0000000003480000.00000040.00000800.00020000.00000000.sdmp, help.exe, 0000000A.00000003.536061575.00000000032E8000.00000004.00000800.00020000.00000000.sdmp, help.exe, 0000000A.00000002.643970249.000000000359F000.00000040.00000800.00020000.00000000.sdmp, help.exe, 0000000A.00000003.533670092.0000000000FFA000.00000004.00000800.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: 6109238.exe, 6109238.exe, 00000005.00000003.427753698.0000000001558000.00000004.00000800.00020000.00000000.sdmp, 6109238.exe, 00000005.00000002.534207193.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, 6109238.exe, 00000005.00000003.424452621.00000000013C0000.00000004.00000800.00020000.00000000.sdmp, help.exe, 0000000A.00000002.642772599.0000000003480000.00000040.00000800.00020000.00000000.sdmp, help.exe, 0000000A.00000003.536061575.00000000032E8000.00000004.00000800.00020000.00000000.sdmp, help.exe, 0000000A.00000002.643970249.000000000359F000.00000040.00000800.00020000.00000000.sdmp, help.exe, 0000000A.00000003.533670092.0000000000FFA000.00000004.00000800.00020000.00000000.sdmp
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0176D0D1 push ecx; ret
          Source: initial sampleStatic PE information: section name: .text entropy: 7.729019884750608
          Source: initial sampleStatic PE information: section name: .text entropy: 7.729019884750608
          Source: C:\Users\user\Desktop\6109238.exeFile created: C:\Users\user\AppData\Roaming\eHkVrJJ.exeJump to dropped file

          Boot Survival

          barindex
          Uses schtasks.exe or at.exe to add and modify task schedules
          Source: C:\Users\user\Desktop\6109238.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eHkVrJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp1585.tmp

          Hooking and other Techniques for Hiding and Protection

          barindex
          Modifies the prolog of user mode functions (user mode inline hooks)
          Source: explorer.exeUser mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8E 0xEE 0xE8
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\6109238.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\help.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

          Malware Analysis System Evasion

          barindex
          Yara detected AntiVM3
          Source: Yara matchFile source: 00000000.00000002.433596561.0000000003225000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.439859566.000000000345A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: 6109238.exe PID: 1980, type: MEMORYSTR
          Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
          Source: 6109238.exe, 00000000.00000002.433596561.0000000003225000.00000004.00000800.00020000.00000000.sdmp, 6109238.exe, 00000000.00000002.439859566.000000000345A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
          Source: 6109238.exe, 00000000.00000002.433596561.0000000003225000.00000004.00000800.00020000.00000000.sdmp, 6109238.exe, 00000000.00000002.439859566.000000000345A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
          Tries to detect virtualization through RDTSC time measurements
          Source: C:\Users\user\Desktop\6109238.exeRDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\6109238.exeRDTSC instruction interceptor: First address: 0000000000409B6E second address: 0000000000409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\help.exeRDTSC instruction interceptor: First address: 0000000000C79904 second address: 0000000000C7990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\help.exeRDTSC instruction interceptor: First address: 0000000000C79B6E second address: 0000000000C79B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\6109238.exe TID: 924Thread sleep time: -45877s >= -30000s
          Source: C:\Users\user\Desktop\6109238.exe TID: 4008Thread sleep time: -922337203685477s >= -30000s
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2332Thread sleep time: -6456360425798339s >= -30000s
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\help.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E5BA5 rdtsc
          Source: C:\Users\user\Desktop\6109238.exeThread delayed: delay time: 922337203685477
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9329
          Source: C:\Users\user\Desktop\6109238.exeAPI coverage: 5.2 %
          Source: C:\Users\user\Desktop\6109238.exeProcess information queried: ProcessInformation
          Source: C:\Users\user\Desktop\6109238.exeThread delayed: delay time: 45877
          Source: C:\Users\user\Desktop\6109238.exeThread delayed: delay time: 922337203685477
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
          Source: 6109238.exe, 00000000.00000002.439859566.000000000345A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
          Source: explorer.exe, 00000009.00000000.494644616.0000000007FBD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: 6109238.exe, 00000000.00000002.439859566.000000000345A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
          Source: explorer.exe, 00000009.00000000.494644616.0000000007FBD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}d
          Source: explorer.exe, 00000009.00000000.462973257.000000000807C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
          Source: 6109238.exe, 00000000.00000002.449934520.0000000007BD0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: t4VMCiahkW98QFvBt5K
          Source: explorer.exe, 00000009.00000000.462973257.000000000807C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000I
          Source: explorer.exe, 00000009.00000000.462973257.000000000807C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
          Source: 6109238.exe, 00000000.00000002.442527217.0000000004305000.00000004.00000800.00020000.00000000.sdmp, 6109238.exe, 00000000.00000002.449934520.0000000007BD0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: cfZLZJWV1qemuSyMDkE
          Source: explorer.exe, 00000009.00000000.488066558.00000000042EE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}q^
          Source: 6109238.exe, 00000000.00000002.439859566.000000000345A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
          Source: explorer.exe, 00000009.00000000.507782837.00000000042A0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000O
          Source: 6109238.exe, 00000000.00000002.439859566.000000000345A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E5BA5 rdtsc
          Source: C:\Users\user\Desktop\6109238.exeProcess token adjusted: Debug
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
          Source: C:\Users\user\Desktop\6109238.exeProcess token adjusted: Debug
          Source: C:\Windows\SysWOW64\help.exeProcess token adjusted: Debug
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0171B171 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0171B171 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0171C962 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0173B944 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0173B944 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174513A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174513A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01734120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01734120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01734120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01734120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01734120 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01719100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01719100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01719100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0171B1E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0171B1E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0171B1E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017A41E8 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017951BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017951BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017951BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017951BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017461A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017461A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017969A6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01742990 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0173C182 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174A185 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E1074 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017D2073 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01730050 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01730050 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0172B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0172B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0172B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0172B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E4015 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E4015 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01797016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01797016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01797016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017158EC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017AB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017AB8D0 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017AB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017AB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017AB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017AB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174F0BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174F0BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174F0BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017420A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017420A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017420A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017420A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017420A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017420A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017590AF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01719080 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01793884 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01793884 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01743B7A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01743B7A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0171DB60 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E8B58 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0171F358 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0171DB40 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017D131B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017403E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017403E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017403E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017403E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017403E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017403E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0173DBE9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017953CA mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017953CA mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01744BAD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01744BAD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01744BAD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E5BA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01742397 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174B390 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017D138A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017CD380 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01721B8F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01721B8F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0175927A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017CB260 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017CB260 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E8A62 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017DEA55 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017A4257 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01719240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01719240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01719240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01719240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01754A2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01754A2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01715210 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01715210 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01715210 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01715210 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0171AA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0171AA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01733A1C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01728A0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01742AE4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01742ACB mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0172AAB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0172AAB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174FAB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017152A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017152A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017152A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017152A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017152A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174D294 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174D294 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0173C577 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0173C577 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01737D50 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01753D43 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01793540 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0171AD30 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017DE539 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01723D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01723D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01723D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01723D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01723D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01723D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01723D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01723D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01723D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01723D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01723D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01723D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01723D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E8D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0179A537 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01744D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01744D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01744D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017C8DF1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0172D5E0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0172D5E0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017DFDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017DFDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017DFDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017DFDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01796DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01796DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01796DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01796DC9 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01796DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01796DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01741DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01741DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01741DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E05AC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E05AC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017435A1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174FD9B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174FD9B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01742581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01742581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01742581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01742581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01712D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01712D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01712D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01712D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01712D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0173746D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017AC450 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017AC450 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174A44B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174BC2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01796C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01796C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01796C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01796C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017D1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017D1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017D1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017D1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017D1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017D1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017D1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017D1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017D1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017D1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017D1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017D1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017D1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017D1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017D14FB mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01796CF0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01796CF0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01796CF0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E8CD6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0172849B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0172FF60 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E8F6A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0172EF40 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174E730 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01714F2E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01714F2E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0173F716 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017AFF10 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017AFF10 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E070D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E070D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174A70E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174A70E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017537F5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01728794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01797794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01797794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01797794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0173AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0173AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0173AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0173AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0173AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0172766D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01727E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01727E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01727E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01727E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01727E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01727E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017DAE44 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017DAE44 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017CFE3F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0171E620 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174A61C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0174A61C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0171C600 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0171C600 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_0171C600 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01748E00 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017D1608 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017276E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017416E0 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E8ED6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01758EC7 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017436CC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017CFEC0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E0EA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E0EA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017E0EA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017946A7 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_017AFE87 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\6109238.exeProcess queried: DebugPort
          Source: C:\Windows\SysWOW64\help.exeProcess queried: DebugPort
          Source: C:\Users\user\Desktop\6109238.exeCode function: 5_2_01759910 NtAdjustPrivilegesToken,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\6109238.exeMemory allocated: page read and write | page guard

          HIPS / PFW / Operating System Protection Evasion

          barindex
          Sample uses process hollowing technique
          Source: C:\Users\user\Desktop\6109238.exeSection unmapped: C:\Windows\SysWOW64\help.exe base address: 12D0000
          Maps a DLL or memory area into another process
          Source: C:\Users\user\Desktop\6109238.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
          Source: C:\Users\user\Desktop\6109238.exeSection loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write
          Source: C:\Users\user\Desktop\6109238.exeSection loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write
          Source: C:\Windows\SysWOW64\help.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: read write
          Source: C:\Windows\SysWOW64\help.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
          Injects a PE file into a foreign processes
          Source: C:\Users\user\Desktop\6109238.exeMemory written: C:\Users\user\Desktop\6109238.exe base: 400000 value starts with: 4D5A
          Queues an APC in another process (thread injection)
          Source: C:\Users\user\Desktop\6109238.exeThread APC queued: target process: C:\Windows\explorer.exe
          Modifies the context of a thread in another process (thread injection)
          Source: C:\Users\user\Desktop\6109238.exeThread register set: target process: 3688
          Source: C:\Windows\SysWOW64\help.exeThread register set: target process: 3688
          Adds a directory exclusion to Windows Defender
          Source: C:\Users\user\Desktop\6109238.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eHkVrJJ.exe
          Source: C:\Users\user\Desktop\6109238.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eHkVrJJ.exe
          Source: C:\Users\user\Desktop\6109238.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eHkVrJJ.exe
          Source: C:\Users\user\Desktop\6109238.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eHkVrJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp1585.tmp
          Source: C:\Users\user\Desktop\6109238.exeProcess created: C:\Users\user\Desktop\6109238.exe C:\Users\user\Desktop\6109238.exe
          Source: C:\Windows\SysWOW64\help.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\6109238.exe"
          Source: explorer.exe, 00000009.00000000.505710262.0000000000D70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000000.441486575.0000000000D70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000000.588089772.000000000081C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 00000009.00000000.505710262.0000000000D70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000000.441486575.0000000000D70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000000.439978724.0000000000778000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Progman
          Source: explorer.exe, 00000009.00000000.505710262.0000000000D70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000000.441486575.0000000000D70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000000.589451145.0000000000D70000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
          Source: explorer.exe, 00000009.00000000.505710262.0000000000D70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000000.441486575.0000000000D70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000000.589451145.0000000000D70000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: }Program Manager
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Users\user\Desktop\6109238.exe VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
          Source: C:\Users\user\Desktop\6109238.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

          Stealing of Sensitive Information

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 5.0.6109238.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.6109238.exe.43053d8.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000A.00000002.640356208.0000000000EC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000000.423502729.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000009.00000000.498783665.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000009.00000000.519597064.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.442527217.0000000004305000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.640116150.0000000000E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.639269207.0000000000C70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

          Remote Access Functionality

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 5.0.6109238.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.6109238.exe.43053d8.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000A.00000002.640356208.0000000000EC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000000.423502729.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000009.00000000.498783665.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000009.00000000.519597064.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.442527217.0000000004305000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.640116150.0000000000E80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.639269207.0000000000C70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

          Mitre Att&ck Matrix

          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid Accounts1
          Scheduled Task/Job          		1
          Scheduled Task/Job          		512
          Process Injection          		1
          Rootkit          		1
          Credential API Hooking          		321
          Security Software Discovery          		Remote Services1
          Credential API Hooking          		Exfiltration Over Other Network Medium1
          Encrypted Channel          		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
          Default Accounts1
          Shared Modules          		1
          DLL Side-Loading          		1
          Scheduled Task/Job          		1
          Masquerading          		LSASS Memory2
          Process Discovery          		Remote Desktop Protocol1
          Archive Collected Data          		Exfiltration Over Bluetooth1
          Application Layer Protocol          		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain AccountsAt (Linux)Logon Script (Windows)1
          DLL Side-Loading          		11
          Disable or Modify Tools          		Security Account Manager31
          Virtualization/Sandbox Evasion          		SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
          Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)31
          Virtualization/Sandbox Evasion          		NTDS1
          Application Window Discovery          		Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
          Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script512
          Process Injection          		LSA Secrets1
          File and Directory Discovery          		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
          Replication Through Removable MediaLaunchdRc.commonRc.common1
          Deobfuscate/Decode Files or Information          		Cached Domain Credentials112
          System Information Discovery          		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
          External Remote ServicesScheduled TaskStartup ItemsStartup Items3
          Obfuscated Files or Information          		DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
          Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job3
          Software Packing          		Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
          Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)1
          DLL Side-Loading          		/etc/passwd and /etc/shadowSystem Network Connections DiscoverySoftware Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 signatures2 2 Behavior Graph ID: 680485 Sample: 6109238.exe Startdate: 08/08/2022 Architecture: WINDOWS Score: 100 42 Malicious sample detected (through community Yara rule) 2->42 44 Antivirus detection for URL or domain 2->44 46 Multi AV Scanner detection for dropped file 2->46 48 8 other signatures 2->48 10 6109238.exe 7 2->10         started        process3 file4 34 C:\Users\user\AppData\Roaming\eHkVrJJ.exe, PE32 10->34 dropped 36 C:\Users\user\...\eHkVrJJ.exe:Zone.Identifier, ASCII 10->36 dropped 38 C:\Users\user\AppData\Local\...\tmp1585.tmp, XML 10->38 dropped 40 C:\Users\user\AppData\...\6109238.exe.log, ASCII 10->40 dropped 50 Uses schtasks.exe or at.exe to add and modify task schedules 10->50 52 Adds a directory exclusion to Windows Defender 10->52 54 Tries to detect virtualization through RDTSC time measurements 10->54 56 Injects a PE file into a foreign processes 10->56 14 6109238.exe 10->14         started        17 powershell.exe 23 10->17         started        19 schtasks.exe 1 10->19         started        signatures5 process6 signatures7 64 Modifies the context of a thread in another process (thread injection) 14->64 66 Maps a DLL or memory area into another process 14->66 68 Sample uses process hollowing technique 14->68 70 Queues an APC in another process (thread injection) 14->70 21 explorer.exe 14->21 injected 23 conhost.exe 17->23         started        25 conhost.exe 19->25         started        process8 process9 27 help.exe 21->27         started        signatures10 58 Modifies the context of a thread in another process (thread injection) 27->58 60 Maps a DLL or memory area into another process 27->60 62 Tries to detect virtualization through RDTSC time measurements 27->62 30 cmd.exe 1 27->30         started        process11 process12 32 conhost.exe 30->32         started       

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          6109238.exe29%ReversingLabsByteCode-MSIL.Trojan.Pwsx
          6109238.exe100%Joe Sandbox ML

          Dropped Files

          SourceDetectionScannerLabelLink
          C:\Users\user\AppData\Roaming\eHkVrJJ.exe100%Joe Sandbox ML
          C:\Users\user\AppData\Roaming\eHkVrJJ.exe29%ReversingLabsByteCode-MSIL.Trojan.Pwsx

          Unpacked PE Files

          SourceDetectionScannerLabelLinkDownload
          5.0.6109238.exe.400000.0.unpack100%AviraTR/Crypt.ZPACK.GenDownload File

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
          www.ruichuo888.com/g2i8/100%Avira URL Cloudmalware
          http://www.tiro.com0%URL Reputationsafe
          http://www.goodfont.co.kr0%URL Reputationsafe
          http://www.carterandcone.coml0%URL Reputationsafe
          http://www.sajatypeworks.com0%URL Reputationsafe
          http://www.typography.netD0%URL Reputationsafe
          http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
          http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
          http://fontfabrik.com0%URL Reputationsafe
          http://www.founder.com.cn/cn0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
          http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
          http://www.sandoll.co.kr0%URL Reputationsafe
          http://www.urwpp.deDPlease0%URL Reputationsafe
          http://www.zhongyicts.com.cn0%URL Reputationsafe
          http://www.sakkal.com0%URL Reputationsafe

          Domains and IPs

          Contacted Domains

          ⊘No contacted domains info

          Contacted URLs

          NameMaliciousAntivirus DetectionReputation
          www.ruichuo888.com/g2i8/true
          • Avira URL Cloud: malware
          		low

          URLs from Memory and Binaries

          NameSourceMaliciousAntivirus DetectionReputation
          http://www.apache.org/licenses/LICENSE-2.06109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
            		high
            http://www.fontbureau.com6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
              		high
              http://www.fontbureau.com/designersG6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                		high
                http://www.fontbureau.com/designers/?6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                  		high
                  http://www.founder.com.cn/cn/bThe6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://www.fontbureau.com/designers?6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                    		high
                    http://www.tiro.com6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    http://www.fontbureau.com/designers6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      http://www.goodfont.co.kr6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://www.carterandcone.coml6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://www.sajatypeworks.com6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://www.typography.netD6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://www.fontbureau.com/designers/cabarga.htmlN6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        http://www.founder.com.cn/cn/cThe6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.galapagosdesign.com/staff/dennis.htm6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://fontfabrik.com6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.founder.com.cn/cn6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.fontbureau.com/designers/frere-jones.html6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://www.jiyu-kobo.co.jp/6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.galapagosdesign.com/DPlease6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.com/designers86109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://www.fonts.com6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://www.sandoll.co.kr6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.urwpp.deDPlease6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.zhongyicts.com.cn6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name6109238.exe, 00000000.00000002.433596561.0000000003225000.00000004.00000800.00020000.00000000.sdmp, 6109238.exe, 00000000.00000002.439859566.000000000345A000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://www.sakkal.com6109238.exe, 00000000.00000002.446511442.0000000007452000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown

                                World Map of Contacted IPs

                                ⊘No contacted IP infos

                                General Information

                                Joe Sandbox Version:35.0.0 Citrine
                                Analysis ID:680485
                                Start date and time: 08/08/202217:24:072022-08-08 17:24:07 +02:00
                                Joe Sandbox Product:CloudBasic
                                Overall analysis duration:0h 8m 45s
                                Hypervisor based Inspection enabled:false
                                Report type:light
                                Sample file name:6109238.exe
                                Cookbook file name:default.jbs
                                Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                Number of analysed new started processes analysed:15
                                Number of new started drivers analysed:0
                                Number of existing processes analysed:0
                                Number of existing drivers analysed:0
                                Number of injected processes analysed:1
                                Technologies:
                                • HCA enabled
                                • EGA enabled
                                • HDC enabled
                                • AMSI enabled
                                Analysis Mode:default
                                Analysis stop reason:Timeout
                                Detection:MAL
                                Classification:mal100.troj.evad.winEXE@13/8@0/0
                                EGA Information:
                                • Successful, ratio: 100%
                                HDC Information:
                                • Successful, ratio: 93.2% (good quality ratio 80.9%)
                                • Quality average: 71.5%
                                • Quality standard deviation: 33.6%
                                HCA Information:
                                • Successful, ratio: 99%
                                • Number of executed functions: 0
                                • Number of non-executed functions: 0
                                Cookbook Comments:
                                • Found application associated with file extension: .exe
                                • Adjust boot time
                                • Enable AMSI

                                Warnings

                                • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
                                • Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com
                                • Not all processes where analyzed, report is missing behavior information
                                • Report creation exceeded maximum time and may have missing disassembly code information.
                                • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                • Report size getting too big, too many NtQueryValueKey calls found.
                                • VT rate limit hit for: 6109238.exe

                                Simulations

                                Behavior and APIs

                                TimeTypeDescription
                                17:25:31API Interceptor1x Sleep call for process: 6109238.exe modified
                                17:25:38API Interceptor39x Sleep call for process: powershell.exe modified

                                Joe Sandbox View / Context

                                IPs

                                ⊘No context

                                Domains

                                ⊘No context

                                ASNs

                                ⊘No context

                                JA3 Fingerprints

                                ⊘No context

                                Dropped Files

                                ⊘No context

                                Created / dropped Files

                                C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6109238.exe.log

                                Download File
                                Process:C:\Users\user\Desktop\6109238.exe
                                File Type:ASCII text, with CRLF line terminators
                                Category:modified
                                Size (bytes):1308
                                Entropy (8bit):5.345811588615766
                                Encrypted:false
                                SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84FsXE8:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzu
                                MD5:2E016B886BDB8389D2DD0867BE55F87B
                                SHA1:25D28EF2ACBB41764571E06E11BF4C05DD0E2F8B
                                SHA-256:1D037CF00A8849E6866603297F85D3DABE09535E72EDD2636FB7D0F6C7DA3427
                                SHA-512:C100729153954328AA2A77EECB2A3CBD03CB7E8E23D736000F890B17AAA50BA87745E30FB9E2B0D61E16DCA45694C79B4CE09B9F4475220BEB38CAEA546CFC2A
                                Malicious:true
                                Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):22192
                                Entropy (8bit):5.602774286628419
                                Encrypted:false
                                SSDEEP:384:utCD+0eRZo20g+p3elSBKnEjs/M7nvGL3Ss3YQMtEm+K+AV7bnU5LYI++2YV:QR22H4KEo/bDeKspQ
                                MD5:003DA7014349DC14452BB166F8A2AF7D
                                SHA1:C493FF8D600C343A36E0C291137DEAF67D37E86E
                                SHA-256:4CAFD983380A247DA3841CA842458B0A0399B081AC8077E7962533FB371F1FCC
                                SHA-512:C0AF534E916D7F7BF51649BDF387847809D61481D86232DFB544010DA3DC3F7A9EB0FAD7E2E82AAEBE3DEE895156701CBE6182B2B910A1C2CAFAD00D3202A7EA
                                Malicious:false
                                Preview:@...e...........d.........j.=.1.....A.y..............@..........H...............<@.^.L."My...:P..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_djzcffe1.bda.psm1

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:very short file (no magic)
                                Category:dropped
                                Size (bytes):1
                                Entropy (8bit):0.0
                                Encrypted:false
                                SSDEEP:3:U:U
                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                Malicious:false
                                Preview:1

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kmqndebx.s0u.ps1

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:very short file (no magic)
                                Category:dropped
                                Size (bytes):1
                                Entropy (8bit):0.0
                                Encrypted:false
                                SSDEEP:3:U:U
                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                Malicious:false
                                Preview:1

                                C:\Users\user\AppData\Local\Temp\tmp1585.tmp

                                Download File
                                Process:C:\Users\user\Desktop\6109238.exe
                                File Type:XML 1.0 document, ASCII text
                                Category:dropped
                                Size (bytes):1606
                                Entropy (8bit):5.1199910671225615
                                Encrypted:false
                                SSDEEP:24:2di4+S2qh/S1K2ky1mo2dUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtL0xvn:cgea6YrFdOFzOzN33ODOiDdKrsuTwv
                                MD5:B2C79088E946DE62D82F2E58E5C4FAE7
                                SHA1:0E2C066C76F11AC9667555A595873ABE7F0674D6
                                SHA-256:39CB5732D5B565108FD6473E39447FCD86078EAD8C4D01EB33AD3C9D825D516E
                                SHA-512:E26983344AE2EA7CFB27AADFF50AA43B7498128A94607BB456AED5E7826F39FDF38D79D5977BB3E3A15505F52F4CECC5FCC287BD55C46858CE0CBDA2AA8F7F42
                                Malicious:true
                                Preview:<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>computer\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>computer\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>computer\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailab

                                C:\Users\user\AppData\Roaming\eHkVrJJ.exe

                                Download File
                                Process:C:\Users\user\Desktop\6109238.exe
                                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                Category:dropped
                                Size (bytes):874496
                                Entropy (8bit):7.722977017951353
                                Encrypted:false
                                SSDEEP:24576:QxgV10/5JdIBRMJ0bi7FbjVte9IbUDHDl:ogVWFIBRc0b4FL7U
                                MD5:2AEB09E3B19012D3D2ADD45559422416
                                SHA1:0364E572469A4BFB486C982348C7FA62CCB7E818
                                SHA-256:917E03484856F0980F2150822A231E0F73E3CEF3F074EA1644DCBD1082590399
                                SHA-512:EAC61F118AFEB8F0444EF6623795E4D9201FE13C0EB3C6F4C1800331860E2538A1017B3F09D0B20D6FF8496ADBE3F38BDC7E93C154F82A35A64FB2AAA3C2F77D
                                Malicious:true
                                Antivirus:
                                • Antivirus: Joe Sandbox ML, Detection: 100%
                                • Antivirus: ReversingLabs, Detection: 29%
                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b..............0..P...........n... ........@.. ....................................@.................................pn..K.................................................................................... ............... ..H............text....N... ...P.................. ..`.rsrc................R..............@..@.reloc...............V..............@..B.................n......H........{..............................................................0..........*....0..k..........K...%.r...p.%.r+..p.%.r9..p.}......}.....(.......(......{.....(......{.....(.....~....t.....{....(....&*..0..:........ &\.. cmZQa%..^E................+..(...... ...Z ..%a+.*...0...........*...0................ .7. ...a%....^E............................n.......[...........$...........9.......l.......A.......................8...... ..XQZ X...a8w.....-. ^q.1%+. .q?.%&.. ..

                                C:\Users\user\AppData\Roaming\eHkVrJJ.exe:Zone.Identifier

                                Download File
                                Process:C:\Users\user\Desktop\6109238.exe
                                File Type:ASCII text, with CRLF line terminators
                                Category:dropped
                                Size (bytes):26
                                Entropy (8bit):3.95006375643621
                                Encrypted:false
                                SSDEEP:3:ggPYV:rPYV
                                MD5:187F488E27DB4AF347237FE461A079AD
                                SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                Malicious:true
                                Preview:[ZoneTransfer]....ZoneId=0

                                C:\Users\user\Documents\20220808\PowerShell_transcript.841675.UFlE9n5j.20220808172536.txt

                                Download File
                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                                Category:dropped
                                Size (bytes):5807
                                Entropy (8bit):5.375386426126985
                                Encrypted:false
                                SSDEEP:96:BZPTL/NRqDo1ZdZbTL/NRqDo1Z5l/NjZGTL/NRqDo1ZoQddSZ1:7
                                MD5:8E2A47A69E2C42272669F5CA452E2967
                                SHA1:F1C2A50D71832BEA952FEB45EBAA57C7B16EDEB2
                                SHA-256:234721E3D39262F2111F652946F16B84AA45484C2E9F1F0E48E90AF5204E1391
                                SHA-512:9545CE5A9475A3D9474F57FDE7CF9D48C2B34FE30DAE4691437DF33DFF624A876CD8BE0AD10155E2FB1D40609C58934DD52C5DCC327CAB286CB149D7F4D7515D
                                Malicious:false
                                Preview:.**********************..Windows PowerShell transcript start..Start time: 20220808172537..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 841675 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\eHkVrJJ.exe..Process ID: 5756..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..**********************..**********************..Command start time: 20220808172537..**********************..PS>Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\eHkVrJJ.exe..**********************..Windows PowerShell transcript start..Start time: 20220808173031..Username: computer\user..RunAs User: DESKTOP-716

                                Static File Info

                                General

                                File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                Entropy (8bit):7.722977017951353
                                TrID:
                                • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                • Win32 Executable (generic) a (10002005/4) 49.78%
                                • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                • Generic Win/DOS Executable (2004/3) 0.01%
                                • DOS Executable Generic (2002/1) 0.01%
                                File name:6109238.exe
                                File size:874496
                                MD5:2aeb09e3b19012d3d2add45559422416
                                SHA1:0364e572469a4bfb486c982348c7fa62ccb7e818
                                SHA256:917e03484856f0980f2150822a231e0f73e3cef3f074ea1644dcbd1082590399
                                SHA512:eac61f118afeb8f0444ef6623795e4d9201fe13c0eb3c6f4c1800331860e2538a1017b3f09d0b20d6ff8496adbe3f38bdc7e93c154f82a35a64fb2aaa3c2f77d
                                SSDEEP:24576:QxgV10/5JdIBRMJ0bi7FbjVte9IbUDHDl:ogVWFIBRc0b4FL7U
                                TLSH:6C05AE5BBF10324DC9A7A975DE4B7C61A7F22C2E3226D0766517380E8AFF342DA11076
                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b..............0..P...........n... ........@.. ....................................@................................

                                File Icon

                                Icon Hash:00828e8e8686b000

                                Static PE Info

                                General

                                Entrypoint:0x4d6ebe
                                Entrypoint Section:.text
                                Digitally signed:false
                                Imagebase:0x400000
                                Subsystem:windows gui
                                Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                Time Stamp:0x62F10003 [Mon Aug 8 12:22:27 2022 UTC]
                                TLS Callbacks:
                                CLR (.Net) Version:
                                OS Version Major:4
                                OS Version Minor:0
                                File Version Major:4
                                File Version Minor:0
                                Subsystem Version Major:4
                                Subsystem Version Minor:0
                                Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                Entrypoint Preview

                                Instruction
                                jmp dword ptr [00402000h]
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al

                                Data Directories

                                NameVirtual AddressVirtual Size Is in Section
                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                IMAGE_DIRECTORY_ENTRY_IMPORT0xd6e700x4b.text
                                IMAGE_DIRECTORY_ENTRY_RESOURCE0xd80000x398.rsrc
                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                IMAGE_DIRECTORY_ENTRY_BASERELOC0xda0000xc.reloc
                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                Sections

                                NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                .text0x20000xd4ec40xd5000False0.7882945459213615data7.729019884750608IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                .rsrc0xd80000x3980x400False0.373046875data2.8853098954714IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                .reloc0xda0000xc0x200False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                Resources

                                NameRVASizeTypeLanguageCountry
                                RT_VERSION0xd80580x33cdata

                                Imports

                                DLLImport
                                mscoree.dll_CorExeMain

                                Network Behavior

                                ⊘No network behavior found

                                Code Manipulations

                                User Modules

                                Hook Summary

                                Function NameHook TypeActive in Processes
                                PeekMessageAINLINEexplorer.exe
                                PeekMessageWINLINEexplorer.exe
                                GetMessageWINLINEexplorer.exe
                                GetMessageAINLINEexplorer.exe

                                Processes

                                Process: explorer.exe, Module: user32.dll
                                Function NameHook TypeNew Data
                                PeekMessageAINLINE0x48 0x8B 0xB8 0x8E 0xEE 0xE8
                                PeekMessageWINLINE0x48 0x8B 0xB8 0x86 0x6E 0xE8
                                GetMessageWINLINE0x48 0x8B 0xB8 0x86 0x6E 0xE8
                                GetMessageAINLINE0x48 0x8B 0xB8 0x8E 0xEE 0xE8

                                Statistics

                                Behavior

                                Click to jump to process

                                System Behavior

                                General

                                Target ID:0
                                Start time:17:25:18
                                Start date:08/08/2022
                                Path:C:\Users\user\Desktop\6109238.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Users\user\Desktop\6109238.exe"
                                Imagebase:0xde0000
                                File size:874496 bytes
                                MD5 hash:2AEB09E3B19012D3D2ADD45559422416
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:.Net C# or VB.NET
                                Yara matches:
                                • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.442527217.0000000004305000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000000.00000002.442527217.0000000004305000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.442527217.0000000004305000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.442527217.0000000004305000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.433596561.0000000003225000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.439859566.000000000345A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                Reputation:low

                                General

                                Target ID:1
                                Start time:17:25:34
                                Start date:08/08/2022
                                Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                Wow64 process (32bit):true
                                Commandline:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eHkVrJJ.exe
                                Imagebase:0xf10000
                                File size:430592 bytes
                                MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:.Net C# or VB.NET
                                Reputation:high

                                General

                                Target ID:2
                                Start time:17:25:35
                                Start date:08/08/2022
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff6406f0000
                                File size:625664 bytes
                                MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high

                                General

                                Target ID:3
                                Start time:17:25:35
                                Start date:08/08/2022
                                Path:C:\Windows\SysWOW64\schtasks.exe
                                Wow64 process (32bit):true
                                Commandline:C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eHkVrJJ" /XML "C:\Users\user\AppData\Local\Temp\tmp1585.tmp
                                Imagebase:0xa0000
                                File size:185856 bytes
                                MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high

                                General

                                Target ID:4
                                Start time:17:25:38
                                Start date:08/08/2022
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff6406f0000
                                File size:625664 bytes
                                MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high

                                General

                                Target ID:5
                                Start time:17:25:41
                                Start date:08/08/2022
                                Path:C:\Users\user\Desktop\6109238.exe
                                Wow64 process (32bit):true
                                Commandline:C:\Users\user\Desktop\6109238.exe
                                Imagebase:0xbe0000
                                File size:874496 bytes
                                MD5 hash:2AEB09E3B19012D3D2ADD45559422416
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Yara matches:
                                • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000000.423502729.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000000.423502729.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000000.423502729.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                • Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000000.423502729.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                Reputation:low

                                General

                                Target ID:9
                                Start time:17:25:51
                                Start date:08/08/2022
                                Path:C:\Windows\explorer.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\Explorer.EXE
                                Imagebase:0x7ff77c400000
                                File size:3933184 bytes
                                MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Yara matches:
                                • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000000.498783665.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000000.498783665.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
                                • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000000.498783665.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                • Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000000.498783665.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000000.519597064.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000000.519597064.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
                                • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000000.519597064.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                • Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000000.519597064.000000000D7E0000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                Reputation:high

                                General

                                Target ID:10
                                Start time:17:26:32
                                Start date:08/08/2022
                                Path:C:\Windows\SysWOW64\help.exe
                                Wow64 process (32bit):true
                                Commandline:C:\Windows\SysWOW64\help.exe
                                Imagebase:0x12d0000
                                File size:10240 bytes
                                MD5 hash:09A715036F14D3632AD03B52D1DA6BFF
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Yara matches:
                                • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.640356208.0000000000EC0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.640356208.0000000000EC0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.640356208.0000000000EC0000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.640356208.0000000000EC0000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.640116150.0000000000E80000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.640116150.0000000000E80000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.640116150.0000000000E80000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.640116150.0000000000E80000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.639269207.0000000000C70000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.639269207.0000000000C70000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.639269207.0000000000C70000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.639269207.0000000000C70000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                Reputation:moderate

                                General

                                Target ID:11
                                Start time:17:26:38
                                Start date:08/08/2022
                                Path:C:\Windows\SysWOW64\cmd.exe
                                Wow64 process (32bit):true
                                Commandline:/c del "C:\Users\user\Desktop\6109238.exe"
                                Imagebase:0xed0000
                                File size:232960 bytes
                                MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high

                                General

                                Target ID:12
                                Start time:17:26:39
                                Start date:08/08/2022
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff6406f0000
                                File size:625664 bytes
                                MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high

                                Disassembly

                                ⊘No disassembly