Windows Analysis Report
yKiQrfqhGv.exe

Overview

General Information

Sample Name: yKiQrfqhGv.exe
Original Sample Name: f297b0f6ff8bace56e8bc669a63df2a7.exe
Analysis ID: 1337303
MD5: f297b0f6ff8bace56e8bc669a63df2a7
SHA1: 15ae15975777521f2c396d8d71ce8b8289e6ae5c
SHA256: 8ede431d0ad3096d50b23828dac3e43ac4c05f5154be8e7ccf33b45d7abb118f
Tags: 32exetrojan
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Snort IDS alert for network traffic
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Modifies the prolog of user mode functions (user mode inline hooks)
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Found decision node followed by non-executed suspicious APIs
Queries the volume information (name, serial number etc) of a device
Yara signature match
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Checks if the current process is being debugged
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

AV Detection
barindex
Found malware configuration
Source: 00000000.00000002.2020362394.0000000003CBE000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.iqixuehe.com/4hc5/"], "decoy": ["amandaastburyillustration.com", "7141999.com", "showshoe.info", "sagemarlin.com", "lithuaniandreamtime.com", "therenixgroupllc.com", "avalialooks.shop", "vurporn.com", "lemmy.systems", "2816goldfinch.com", "pacersun.com", "checktrace.com", "loadtransfer.site", "matsuri-jujutsukaisen.com", "iontrapper.science", "5108010.com", "beidixi.com", "21305599.com", "peakvitality.fitness", "osisfeelingfee.com", "hotshark-shop.com", "bollywood.nexus", "stephenplattassociatesllp.com", "bakepreneurs.com", "claudiobarros.online", "akabou-hayasaka.com", "collibrishop.online", "britishfemalevo.com", "prestigesmp.online", "wzmatics.com", "sactribune.com", "slotjitu88.website", "theproactiveexpat.com", "therealnikib.com", "elnoh.life", "tianyan110.com", "tcbbuilds.com", "zhe276.com", "c1405.com", "candicrem.com", "lambdasigmarho.com", "gemwhk.store", "crissmendez.com", "locduongseafood.com", "jessformdsenate.info", "329.bio", "nbgonghe.com", "tr-ij.com", "quailrun-inc.com", "pathlightpropertiesmgt.com", "lpqxmz.site", "castlegrouplt.com", "beautybylily.com", "bernabeicarniceriaygranja.com", "spicax.com", "globalentertainmentservices.com", "modluxenwa.com", "imaswe.com", "hntv6201.top", "homerevamps.today", "motionmixmedia.com", "antojitoslosramos.com", "julieslive.com", "bepnuclasechia.com"]}
Multi AV Scanner detection for submitted file
Source: yKiQrfqhGv.exe ReversingLabs: Detection: 60%
Source: yKiQrfqhGv.exe Virustotal: Detection: 61% Perma Link
Yara detected FormBook
Source: Yara match File source: 3.2.yKiQrfqhGv.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.yKiQrfqhGv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.4480722616.0000000003790000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2020362394.0000000003CBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4481064558.0000000004F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4479931565.0000000002FD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2071486980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: http://www.iqixuehe.com/1-46d0-b6b6-535557bcc5fa Avira URL Cloud: Label: malware
Source: http://www.showshoe.info/4hc5/www.329.bio Avira URL Cloud: Label: malware
Source: https://globalentertainmentservices.com/4hc5/?ARM8mN=fBqdMXc91lnTomnLD Avira URL Cloud: Label: malware
Source: http://www.julieslive.com/4hc5/ Avira URL Cloud: Label: malware
Source: www.iqixuehe.com/4hc5/ Avira URL Cloud: Label: malware
Source: http://www.2816goldfinch.com/4hc5/?ARM8mN=1aQlJJA0XtSA3mmPcz3A13DQhChCZAjZwmZYbKxz88FxQriiwRvfB7iHnJRBFH94mXqC&nfoHn6=xDKpFX0P8 Avira URL Cloud: Label: malware
Source: http://www.loadtransfer.site/4hc5/ Avira URL Cloud: Label: phishing
Source: http://www.julieslive.com/4hc5/?ARM8mN=oyFmEHyfTjUFImcLYldylGTimAAEF1CG98xLBQUzn/97OM/48Y/NyPeznbFeR5DjKoMz&nfoHn6=xDKpFX0P8 Avira URL Cloud: Label: malware
Source: http://www.stephenplattassociatesllp.com/4hc5/ Avira URL Cloud: Label: malware
Source: http://www.prestigesmp.online Avira URL Cloud: Label: malware
Source: http://www.iqixuehe.com/4hc5/www.homerevamps.today Avira URL Cloud: Label: malware
Source: http://www.prestigesmp.online/4hc5/www.showshoe.info Avira URL Cloud: Label: malware
Source: http://www.showshoe.info/4hc5/ Avira URL Cloud: Label: malware
Source: http://www.sactribune.com/4hc5/ Avira URL Cloud: Label: malware
Source: http://www.imaswe.com/4hc5/ Avira URL Cloud: Label: malware
Source: http://www.329.bio/4hc5/ Avira URL Cloud: Label: malware
Source: http://www.iqixuehe.com/ Avira URL Cloud: Label: malware
Source: http://www.2816goldfinch.com/4hc5/www.sactribune.com Avira URL Cloud: Label: malware
Source: http://www.iontrapper.science/4hc5/?ARM8mN=anSewvd4RB15/Bbq0PKQ9CBaazFnJ723ies3SR522J7OLerssEDA72NPyiW98AhHjTDe&nfoHn6=xDKpFX0P8 Avira URL Cloud: Label: malware
Source: http://www.matsuri-jujutsukaisen.com Avira URL Cloud: Label: phishing
Source: http://www.antojitoslosramos.com/4hc5/www.julieslive.com Avira URL Cloud: Label: malware
Source: http://www.globalentertainmentservices.com/4hc5/ Avira URL Cloud: Label: phishing
Source: http://www.iontrapper.science/4hc5/ Avira URL Cloud: Label: malware
Source: http://www.imaswe.com/4hc5/www.antojitoslosramos.com Avira URL Cloud: Label: malware
Source: http://www.matsuri-jujutsukaisen.com/4hc5/ Avira URL Cloud: Label: malware
Source: http://www.antojitoslosramos.com/4hc5/ Avira URL Cloud: Label: malware
Source: http://www.homerevamps.today Avira URL Cloud: Label: malware
Source: http://www.castlegrouplt.com/4hc5/www.prestigesmp.online Avira URL Cloud: Label: malware
Source: http://www.matsuri-jujutsukaisen.com/4hc5/?ARM8mN=QzbL5KXRbKAn2qkAmOj6cUMG12wY2mkeNCi6fYLCIi0wzcLrwY7G+/MD00/L/j10LFBF&nfoHn6=xDKpFX0P8 Avira URL Cloud: Label: malware
Source: http://www.iqixuehe.com/4hc5/?ARM8mN= Avira URL Cloud: Label: malware
Source: http://www.matsuri-jujutsukaisen.com/4hc5/www.2816goldfinch.com Avira URL Cloud: Label: malware
Source: http://www.iqixuehe.com Avira URL Cloud: Label: malware
Source: http://www.sactribune.com Avira URL Cloud: Label: malware
Source: http://www.329.bio/4hc5/d Avira URL Cloud: Label: malware
Source: http://www.julieslive.com/4hc5/www.globalentertainmentservices.com Avira URL Cloud: Label: malware
Source: http://www.329.bio Avira URL Cloud: Label: malware
Source: http://www.castlegrouplt.com Avira URL Cloud: Label: malware
Source: http://www.2816goldfinch.com/4hc5/ Avira URL Cloud: Label: malware
Source: http://www.globalentertainmentservices.com/4hc5/?ARM8mN=fBqdMXc91lnTomnLD+II/MBRUNcxF/X1uRKxmlget9lW8kZY8SYfqQNU/JuXLA7WRFKv&nfoHn6=xDKpFX0P8 Avira URL Cloud: Label: phishing
Source: http://www.iqixuehe.com/4hc5/ Avira URL Cloud: Label: malware
Source: http://www.globalentertainmentservices.com/4hc5/www.loadtransfer.site Avira URL Cloud: Label: phishing
Source: http://www.antojitoslosramos.com Avira URL Cloud: Label: malware
Source: http://www.stephenplattassociatesllp.com/4hc5/www.iontrapper.science Avira URL Cloud: Label: malware
Source: http://www.imaswe.com/4hc5/?ARM8mN=vlz2CAMCo7G9+MeAGV2KInJ+l3tequa9ECvl/VWp7SXyOAinvo6JEsIxN9n7GF2bKDoH&nfoHn6=xDKpFX0P8 Avira URL Cloud: Label: malware
Source: http://www.iqixuehe.com/user Avira URL Cloud: Label: malware
Source: http://www.homerevamps.today/4hc5/ Avira URL Cloud: Label: malware
Source: http://www.castlegrouplt.com/4hc5/ Avira URL Cloud: Label: malware
Source: http://www.globalentertainmentservices.com Avira URL Cloud: Label: phishing
Source: http://www.loadtransfer.site/4hc5/www.castlegrouplt.com Avira URL Cloud: Label: phishing
Source: http://www.showshoe.info Avira URL Cloud: Label: malware
Source: http://www.stephenplattassociatesllp.com/4hc5/?ARM8mN=UayKmV7d8gxWLYhx25JZE6Fwij3S6NgIDFBzj66KTbt8rYl3HB5oHx/yC8JK7pNZTHHf&nfoHn6=xDKpFX0P8 Avira URL Cloud: Label: malware
Source: http://www.prestigesmp.online/4hc5/ Avira URL Cloud: Label: malware
Source: http://www.sactribune.com/4hc5/www.stephenplattassociatesllp.com Avira URL Cloud: Label: malware
Source: http://www.homerevamps.today/4hc5/?ARM8mN=XvAjDK/lhDkYJBq/DY1aj1JXLrWARnjVE4JkqE+/y0dCq4m85zPkIeeB+wmBcyRTe10M&nfoHn6=xDKpFX0P8 Avira URL Cloud: Label: malware
Source: http://www.julieslive.com Avira URL Cloud: Label: phishing
Source: http://www.imaswe.com Avira URL Cloud: Label: malware
Source: http://www.2816goldfinch.com Avira URL Cloud: Label: malware
Source: http://www.iontrapper.science/4hc5/www.imaswe.com Avira URL Cloud: Label: malware
Source: http://www.antojitoslosramos.com/4hc5/?ARM8mN=gdd1QC7Pol5AM6dzWjWj4dPVX3Rx3HE4ioGGFOABGmsVBvyBlq2R0xZfHtXYLxE7PIxr&nfoHn6=xDKpFX0P8 Avira URL Cloud: Label: malware
Source: http://www.homerevamps.today/4hc5/www.matsuri-jujutsukaisen.com Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: imaswe.com Virustotal: Detection: 12% Perma Link
Source: www.julieslive.com Virustotal: Detection: 12% Perma Link
Source: globalentertainmentservices.com Virustotal: Detection: 13% Perma Link
Source: www.antojitoslosramos.com Virustotal: Detection: 11% Perma Link
Source: www.homerevamps.today Virustotal: Detection: 12% Perma Link
Source: www.matsuri-jujutsukaisen.com Virustotal: Detection: 13% Perma Link
Source: 2816goldfinch.com Virustotal: Detection: 13% Perma Link
Source: iontrapper.science Virustotal: Detection: 7% Perma Link
Source: www.iqixuehe.com Virustotal: Detection: 11% Perma Link
Source: www.sactribune.com Virustotal: Detection: 12% Perma Link
Source: www.globalentertainmentservices.com Virustotal: Detection: 13% Perma Link
Source: http://www.julieslive.com/4hc5/ Virustotal: Detection: 8% Perma Link
Source: www.iqixuehe.com/4hc5/ Virustotal: Detection: 8% Perma Link
Source: http://www.iqixuehe.com/4hc5/www.homerevamps.today Virustotal: Detection: 11% Perma Link
Source: http://www.showshoe.info/4hc5/ Virustotal: Detection: 10% Perma Link
Source: http://www.prestigesmp.online Virustotal: Detection: 7% Perma Link
Source: http://www.sactribune.com/4hc5/ Virustotal: Detection: 8% Perma Link
Source: http://www.iqixuehe.com/ Virustotal: Detection: 11% Perma Link
Source: http://www.329.bio/4hc5/ Virustotal: Detection: 7% Perma Link
Machine Learning detection for sample
Source: yKiQrfqhGv.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: yKiQrfqhGv.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: yKiQrfqhGv.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: vbFX.pdbSHA256 source: yKiQrfqhGv.exe
Source: Binary string: wntdll.pdbUGP source: yKiQrfqhGv.exe, 00000003.00000002.2072120390.0000000001530000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000005.00000002.4481362369.00000000052EE000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000005.00000003.2072097466.0000000004DFC000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000005.00000003.2074205367.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000005.00000002.4481362369.0000000005150000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: yKiQrfqhGv.exe, yKiQrfqhGv.exe, 00000003.00000002.2072120390.0000000001530000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, mstsc.exe, 00000005.00000002.4481362369.00000000052EE000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000005.00000003.2072097466.0000000004DFC000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000005.00000003.2074205367.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000005.00000002.4481362369.0000000005150000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: vbFX.pdb source: yKiQrfqhGv.exe
Source: Binary string: mstsc.pdbGCTL source: yKiQrfqhGv.exe, 00000003.00000002.2073567702.0000000003220000.00000040.10000000.00040000.00000000.sdmp, mstsc.exe, 00000005.00000002.4479503820.0000000000D90000.00000040.80000000.00040000.00000000.sdmp
Source: Binary string: mstsc.pdb source: yKiQrfqhGv.exe, 00000003.00000002.2073567702.0000000003220000.00000040.10000000.00040000.00000000.sdmp, mstsc.exe, 00000005.00000002.4479503820.0000000000D90000.00000040.80000000.00040000.00000000.sdmp
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 4x nop then pop ebx 3_2_00407B1C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 4x nop then pop ebx 5_2_02FD7B1C

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 154.205.127.201 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 76.223.105.230 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 15.197.142.173 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 103.224.182.242 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 212.32.237.91 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 157.7.189.188 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 38.40.235.204 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 104.21.41.165 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 192.185.16.134 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 3.33.130.190 80 Jump to behavior
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49720 -> 104.21.41.165:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49723 -> 157.7.189.188:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49724 -> 15.197.142.173:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49725 -> 38.40.235.204:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49726 -> 192.185.16.134:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49727 -> 3.33.130.190:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49728 -> 103.224.182.242:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49729 -> 212.32.237.91:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49730 -> 76.223.105.230:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.iqixuehe.com/4hc5/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: INTERQGMOInternetIncJP INTERQGMOInternetIncJP
Source: Joe Sandbox View ASN Name: COGENT-174US COGENT-174US
Source: Joe Sandbox View ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /4hc5/?ARM8mN=XvAjDK/lhDkYJBq/DY1aj1JXLrWARnjVE4JkqE+/y0dCq4m85zPkIeeB+wmBcyRTe10M&nfoHn6=xDKpFX0P8 HTTP/1.1Host: www.homerevamps.todayConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /4hc5/?ARM8mN=QzbL5KXRbKAn2qkAmOj6cUMG12wY2mkeNCi6fYLCIi0wzcLrwY7G+/MD00/L/j10LFBF&nfoHn6=xDKpFX0P8 HTTP/1.1Host: www.matsuri-jujutsukaisen.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /4hc5/?ARM8mN=1aQlJJA0XtSA3mmPcz3A13DQhChCZAjZwmZYbKxz88FxQriiwRvfB7iHnJRBFH94mXqC&nfoHn6=xDKpFX0P8 HTTP/1.1Host: www.2816goldfinch.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /4hc5/?ARM8mN=UayKmV7d8gxWLYhx25JZE6Fwij3S6NgIDFBzj66KTbt8rYl3HB5oHx/yC8JK7pNZTHHf&nfoHn6=xDKpFX0P8 HTTP/1.1Host: www.stephenplattassociatesllp.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /4hc5/?ARM8mN=anSewvd4RB15/Bbq0PKQ9CBaazFnJ723ies3SR522J7OLerssEDA72NPyiW98AhHjTDe&nfoHn6=xDKpFX0P8 HTTP/1.1Host: www.iontrapper.scienceConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /4hc5/?ARM8mN=vlz2CAMCo7G9+MeAGV2KInJ+l3tequa9ECvl/VWp7SXyOAinvo6JEsIxN9n7GF2bKDoH&nfoHn6=xDKpFX0P8 HTTP/1.1Host: www.imaswe.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /4hc5/?ARM8mN=gdd1QC7Pol5AM6dzWjWj4dPVX3Rx3HE4ioGGFOABGmsVBvyBlq2R0xZfHtXYLxE7PIxr&nfoHn6=xDKpFX0P8 HTTP/1.1Host: www.antojitoslosramos.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /4hc5/?ARM8mN=oyFmEHyfTjUFImcLYldylGTimAAEF1CG98xLBQUzn/97OM/48Y/NyPeznbFeR5DjKoMz&nfoHn6=xDKpFX0P8 HTTP/1.1Host: www.julieslive.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /4hc5/?ARM8mN=fBqdMXc91lnTomnLD+II/MBRUNcxF/X1uRKxmlget9lW8kZY8SYfqQNU/JuXLA7WRFKv&nfoHn6=xDKpFX0P8 HTTP/1.1Host: www.globalentertainmentservices.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 154.205.127.201 154.205.127.201
Source: Joe Sandbox View IP Address: 76.223.105.230 76.223.105.230
Source: Joe Sandbox View IP Address: 76.223.105.230 76.223.105.230
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Sun, 05 Nov 2023 18:30:37 GMTContent-Type: text/htmlContent-Length: 118Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Sun, 05 Nov 2023 18:31:59 GMTContent-Type: text/htmlContent-Length: 291Connection: closeETag: "65271109-123"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=utf-8" /> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon" /> <title>Forbidden</title> </head> <body> <h1>Access Forbidden</h1> </body></html>
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: explorer.exe, 00000004.00000002.4486644135.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094627369.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2029963136.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2029963136.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094627369.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000004.00000000.2022124570.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4479612129.0000000000F13000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.v
Source: explorer.exe, 00000004.00000002.4486644135.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094627369.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2029963136.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2029963136.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094627369.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000004.00000002.4486644135.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094627369.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2029963136.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2029963136.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094627369.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: yKiQrfqhGv.exe String found in binary or memory: http://fit.mta.edu.vn
Source: explorer.exe, 00000004.00000002.4486644135.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094627369.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2029963136.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2029963136.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094627369.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000004.00000003.3094627369.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4486644135.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2029963136.00000000099C0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000004.00000002.4493575689.00000000114AF000.00000004.80000000.00040000.00000000.sdmp, mstsc.exe, 00000005.00000002.4482071569.0000000005B8F000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://push.zhanzhang.baidu.com/push.js
Source: explorer.exe, 00000004.00000002.4486046838.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.4485362059.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.2029341626.0000000008890000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.2816goldfinch.com
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.2816goldfinch.com/4hc5/
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.2816goldfinch.com/4hc5/www.sactribune.com
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.2816goldfinch.comReferer:
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.329.bio
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.329.bio/4hc5/
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.329.bio/4hc5/d
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.329.bioReferer:
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.antojitoslosramos.com
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.antojitoslosramos.com/4hc5/
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.antojitoslosramos.com/4hc5/www.julieslive.com
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.antojitoslosramos.comReferer:
Source: explorer.exe, 00000004.00000000.2033017248.000000000C81C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3096100748.000000000C85F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.castlegrouplt.com
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.castlegrouplt.com/4hc5/
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.castlegrouplt.com/4hc5/www.prestigesmp.online
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.castlegrouplt.comReferer:
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.globalentertainmentservices.com
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.globalentertainmentservices.com/4hc5/
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.globalentertainmentservices.com/4hc5/www.loadtransfer.site
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.globalentertainmentservices.comReferer:
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.homerevamps.today
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.homerevamps.today/4hc5/
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.homerevamps.today/4hc5/www.matsuri-jujutsukaisen.com
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.homerevamps.todayReferer:
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.imaswe.com
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.imaswe.com/4hc5/
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.imaswe.com/4hc5/www.antojitoslosramos.com
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.imaswe.comReferer:
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.iontrapper.science
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.iontrapper.science/4hc5/
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.iontrapper.science/4hc5/www.imaswe.com
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.iontrapper.scienceReferer:
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.iqixuehe.com
Source: mstsc.exe, 00000005.00000002.4480310252.00000000034AB000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000005.00000002.4480310252.00000000034DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.iqixuehe.com/
Source: mstsc.exe, 00000005.00000002.4480310252.00000000034DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.iqixuehe.com/1-46d0-b6b6-535557bcc5fa
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.iqixuehe.com/4hc5/
Source: mstsc.exe, 00000005.00000002.4480310252.00000000034DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.iqixuehe.com/4hc5/?ARM8mN=
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.iqixuehe.com/4hc5/www.homerevamps.today
Source: mstsc.exe, 00000005.00000002.4480310252.00000000034DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.iqixuehe.com/user
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.iqixuehe.comReferer:
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.julieslive.com
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.julieslive.com/4hc5/
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.julieslive.com/4hc5/www.globalentertainmentservices.com
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.julieslive.comReferer:
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.loadtransfer.site
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.loadtransfer.site/4hc5/
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.loadtransfer.site/4hc5/www.castlegrouplt.com
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.loadtransfer.siteReferer:
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.matsuri-jujutsukaisen.com
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.matsuri-jujutsukaisen.com/4hc5/
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.matsuri-jujutsukaisen.com/4hc5/www.2816goldfinch.com
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.matsuri-jujutsukaisen.comReferer:
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.prestigesmp.online
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.prestigesmp.online/4hc5/
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.prestigesmp.online/4hc5/www.showshoe.info
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.prestigesmp.onlineReferer:
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.sactribune.com
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.sactribune.com/4hc5/
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.sactribune.com/4hc5/www.stephenplattassociatesllp.com
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.sactribune.comReferer:
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.showshoe.info
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.showshoe.info/4hc5/
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.showshoe.info/4hc5/www.329.bio
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.showshoe.infoReferer:
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.stephenplattassociatesllp.com
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.stephenplattassociatesllp.com/4hc5/
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.stephenplattassociatesllp.com/4hc5/www.iontrapper.science
Source: explorer.exe, 00000004.00000003.3095700076.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804803758.000000000C8A1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4491906486.000000000C8A8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.stephenplattassociatesllp.comReferer:
Source: explorer.exe, 00000004.00000003.3805585608.000000000C50F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2032484612.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3096667296.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3096151830.000000000C50F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4490394379.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3806146205.000000000C54B000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000004.00000002.4484132632.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2027965673.00000000076F8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000004.00000003.3094627369.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4486644135.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2029963136.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000004.00000002.4484132632.0000000007637000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2027965673.0000000007637000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000004.00000003.3804234691.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4481623124.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2026552401.00000000035FA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://arc.msn.coml
Source: explorer.exe, 00000004.00000003.3806585616.0000000009C21000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3095724288.0000000009B7A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4487673351.0000000009C22000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804829529.0000000009B7A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2029963136.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094627369.0000000009B41000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://excel.office.com
Source: explorer.exe, 00000004.00000002.4493575689.00000000114AF000.00000004.80000000.00040000.00000000.sdmp, mstsc.exe, 00000005.00000002.4482071569.0000000005B8F000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://globalentertainmentservices.com/4hc5/?ARM8mN=fBqdMXc91lnTomnLD
Source: explorer.exe, 00000004.00000003.3094627369.0000000009D42000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4487734533.0000000009C96000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3804829529.0000000009B7A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2029963136.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3805374293.0000000009C92000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000004.00000002.4490394379.000000000C460000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2032484612.000000000C460000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000004.00000003.3094627369.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4486644135.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2029963136.00000000099C0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://wns.windows.com/)s
Source: explorer.exe, 00000004.00000003.3094627369.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4486644135.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2029963136.00000000099C0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://word.office.comon
Source: explorer.exe, 00000004.00000002.4493575689.00000000114AF000.00000004.80000000.00040000.00000000.sdmp, mstsc.exe, 00000005.00000002.4482071569.0000000005B8F000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://zz.bdstatic.com/linksubmit/push.js
Source: unknown DNS traffic detected: queries for: www.iqixuehe.com
Source: C:\Windows\explorer.exe Code function: 4_2_0F766F82 getaddrinfo,setsockopt,recv, 4_2_0F766F82
Source: global traffic HTTP traffic detected: GET /4hc5/?ARM8mN=XvAjDK/lhDkYJBq/DY1aj1JXLrWARnjVE4JkqE+/y0dCq4m85zPkIeeB+wmBcyRTe10M&nfoHn6=xDKpFX0P8 HTTP/1.1Host: www.homerevamps.todayConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /4hc5/?ARM8mN=QzbL5KXRbKAn2qkAmOj6cUMG12wY2mkeNCi6fYLCIi0wzcLrwY7G+/MD00/L/j10LFBF&nfoHn6=xDKpFX0P8 HTTP/1.1Host: www.matsuri-jujutsukaisen.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /4hc5/?ARM8mN=1aQlJJA0XtSA3mmPcz3A13DQhChCZAjZwmZYbKxz88FxQriiwRvfB7iHnJRBFH94mXqC&nfoHn6=xDKpFX0P8 HTTP/1.1Host: www.2816goldfinch.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /4hc5/?ARM8mN=UayKmV7d8gxWLYhx25JZE6Fwij3S6NgIDFBzj66KTbt8rYl3HB5oHx/yC8JK7pNZTHHf&nfoHn6=xDKpFX0P8 HTTP/1.1Host: www.stephenplattassociatesllp.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /4hc5/?ARM8mN=anSewvd4RB15/Bbq0PKQ9CBaazFnJ723ies3SR522J7OLerssEDA72NPyiW98AhHjTDe&nfoHn6=xDKpFX0P8 HTTP/1.1Host: www.iontrapper.scienceConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /4hc5/?ARM8mN=vlz2CAMCo7G9+MeAGV2KInJ+l3tequa9ECvl/VWp7SXyOAinvo6JEsIxN9n7GF2bKDoH&nfoHn6=xDKpFX0P8 HTTP/1.1Host: www.imaswe.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /4hc5/?ARM8mN=gdd1QC7Pol5AM6dzWjWj4dPVX3Rx3HE4ioGGFOABGmsVBvyBlq2R0xZfHtXYLxE7PIxr&nfoHn6=xDKpFX0P8 HTTP/1.1Host: www.antojitoslosramos.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /4hc5/?ARM8mN=oyFmEHyfTjUFImcLYldylGTimAAEF1CG98xLBQUzn/97OM/48Y/NyPeznbFeR5DjKoMz&nfoHn6=xDKpFX0P8 HTTP/1.1Host: www.julieslive.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /4hc5/?ARM8mN=fBqdMXc91lnTomnLD+II/MBRUNcxF/X1uRKxmlget9lW8kZY8SYfqQNU/JuXLA7WRFKv&nfoHn6=xDKpFX0P8 HTTP/1.1Host: www.globalentertainmentservices.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 3.2.yKiQrfqhGv.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.yKiQrfqhGv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.4480722616.0000000003790000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2020362394.0000000003CBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4481064558.0000000004F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4479931565.0000000002FD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2071486980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 3.2.yKiQrfqhGv.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 3.2.yKiQrfqhGv.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.yKiQrfqhGv.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.yKiQrfqhGv.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 3.2.yKiQrfqhGv.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.yKiQrfqhGv.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.4480722616.0000000003790000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.4480722616.0000000003790000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.4480722616.0000000003790000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.4493279537.000000000F77E000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
Source: 00000000.00000002.2020362394.0000000003CBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.2020362394.0000000003CBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.2020362394.0000000003CBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.4481064558.0000000004F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.4481064558.0000000004F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.4481064558.0000000004F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.4479931565.0000000002FD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.4479931565.0000000002FD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.4479931565.0000000002FD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.2071486980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.2071486980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.2071486980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: yKiQrfqhGv.exe PID: 7148, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: yKiQrfqhGv.exe PID: 2212, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: mstsc.exe PID: 4724, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: yKiQrfqhGv.exe
Uses 32bit PE files
Source: yKiQrfqhGv.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 3.2.yKiQrfqhGv.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 3.2.yKiQrfqhGv.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.yKiQrfqhGv.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.yKiQrfqhGv.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 3.2.yKiQrfqhGv.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.yKiQrfqhGv.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.4480722616.0000000003790000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.4480722616.0000000003790000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.4480722616.0000000003790000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.4493279537.000000000F77E000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
Source: 00000000.00000002.2020362394.0000000003CBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.2020362394.0000000003CBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.2020362394.0000000003CBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.4481064558.0000000004F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.4481064558.0000000004F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.4481064558.0000000004F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.4479931565.0000000002FD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.4479931565.0000000002FD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.4479931565.0000000002FD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.2071486980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.2071486980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.2071486980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: yKiQrfqhGv.exe PID: 7148, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: yKiQrfqhGv.exe PID: 2212, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: mstsc.exe PID: 4724, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Detected potential crypto function
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 0_2_02923510 0_2_02923510
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 0_2_0296DC64 0_2_0296DC64
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0041E006 3_2_0041E006
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_00401030 3_2_00401030
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0041D563 3_2_0041D563
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_00402D87 3_2_00402D87
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_00402D90 3_2_00402D90
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_00409E50 3_2_00409E50
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0041DE6A 3_2_0041DE6A
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_00402FB0 3_2_00402FB0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F8158 3_2_015F8158
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01560100 3_2_01560100
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160A118 3_2_0160A118
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_016281CC 3_2_016281CC
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_016241A2 3_2_016241A2
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_016301AA 3_2_016301AA
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01602000 3_2_01602000
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0162A352 3_2_0162A352
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_016303E6 3_2_016303E6
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0157E3F0 3_2_0157E3F0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01610274 3_2_01610274
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F02C0 3_2_015F02C0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570535 3_2_01570535
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01630591 3_2_01630591
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01622446 3_2_01622446
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01614420 3_2_01614420
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0161E4F6 3_2_0161E4F6
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01594750 3_2_01594750
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570770 3_2_01570770
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156C7C0 3_2_0156C7C0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158C6E0 3_2_0158C6E0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01586962 3_2_01586962
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0163A9A6 3_2_0163A9A6
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015729A0 3_2_015729A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01572840 3_2_01572840
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0157A840 3_2_0157A840
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159E8F0 3_2_0159E8F0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015568B8 3_2_015568B8
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0162AB40 3_2_0162AB40
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01626BD7 3_2_01626BD7
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156EA80 3_2_0156EA80
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0157AD00 3_2_0157AD00
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160CD1F 3_2_0160CD1F
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156ADE0 3_2_0156ADE0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01588DBF 3_2_01588DBF
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570C00 3_2_01570C00
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01560CF2 3_2_01560CF2
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01610CB5 3_2_01610CB5
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E4F40 3_2_015E4F40
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01612F30 3_2_01612F30
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01590F30 3_2_01590F30
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015B2F28 3_2_015B2F28
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01562FC8 3_2_01562FC8
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0157CFE0 3_2_0157CFE0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015EEFA0 3_2_015EEFA0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570E59 3_2_01570E59
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0162EE26 3_2_0162EE26
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0162EEDB 3_2_0162EEDB
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01582E90 3_2_01582E90
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0162CE93 3_2_0162CE93
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0163B16B 3_2_0163B16B
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155F172 3_2_0155F172
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A516C 3_2_015A516C
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0157B1B0 3_2_0157B1B0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0162F0E0 3_2_0162F0E0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_016270E9 3_2_016270E9
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015770C0 3_2_015770C0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0161F0CC 3_2_0161F0CC
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155D34C 3_2_0155D34C
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0162132D 3_2_0162132D
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015B739A 3_2_015B739A
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_016112ED 3_2_016112ED
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158B2C0 3_2_0158B2C0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015752A0 3_2_015752A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01627571 3_2_01627571
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_016395C3 3_2_016395C3
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160D5B0 3_2_0160D5B0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01561460 3_2_01561460
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0162F43F 3_2_0162F43F
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0162F7B0 3_2_0162F7B0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015B5630 3_2_015B5630
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_016216CC 3_2_016216CC
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01579950 3_2_01579950
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158B950 3_2_0158B950
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01605910 3_2_01605910
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DD800 3_2_015DD800
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015738E0 3_2_015738E0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0162FB76 3_2_0162FB76
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015ADBF9 3_2_015ADBF9
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E5BF0 3_2_015E5BF0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158FB80 3_2_0158FB80
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01627A46 3_2_01627A46
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0162FA49 3_2_0162FA49
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E3A6C 3_2_015E3A6C
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0161DAC6 3_2_0161DAC6
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01611AA3 3_2_01611AA3
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160DAAC 3_2_0160DAAC
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015B5AA0 3_2_015B5AA0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01627D73 3_2_01627D73
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01573D40 3_2_01573D40
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01621D5A 3_2_01621D5A
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158FDC0 3_2_0158FDC0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E9C32 3_2_015E9C32
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0162FCF2 3_2_0162FCF2
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0162FF09 3_2_0162FF09
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01533FD2 3_2_01533FD2
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01533FD5 3_2_01533FD5
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01571F92 3_2_01571F92
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0162FFB1 3_2_0162FFB1
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01579EB0 3_2_01579EB0
Source: C:\Windows\explorer.exe Code function: 4_2_0E8A9232 4_2_0E8A9232
Source: C:\Windows\explorer.exe Code function: 4_2_0E8A3B32 4_2_0E8A3B32
Source: C:\Windows\explorer.exe Code function: 4_2_0E8A3B30 4_2_0E8A3B30
Source: C:\Windows\explorer.exe Code function: 4_2_0E89F082 4_2_0E89F082
Source: C:\Windows\explorer.exe Code function: 4_2_0E8A8036 4_2_0E8A8036
Source: C:\Windows\explorer.exe Code function: 4_2_0E8AC5CD 4_2_0E8AC5CD
Source: C:\Windows\explorer.exe Code function: 4_2_0E8A0D02 4_2_0E8A0D02
Source: C:\Windows\explorer.exe Code function: 4_2_0E8A6912 4_2_0E8A6912
Source: C:\Windows\explorer.exe Code function: 4_2_0F766232 4_2_0F766232
Source: C:\Windows\explorer.exe Code function: 4_2_0F760B32 4_2_0F760B32
Source: C:\Windows\explorer.exe Code function: 4_2_0F760B30 4_2_0F760B30
Source: C:\Windows\explorer.exe Code function: 4_2_0F763912 4_2_0F763912
Source: C:\Windows\explorer.exe Code function: 4_2_0F75DD02 4_2_0F75DD02
Source: C:\Windows\explorer.exe Code function: 4_2_0F7695CD 4_2_0F7695CD
Source: C:\Windows\explorer.exe Code function: 4_2_0F765036 4_2_0F765036
Source: C:\Windows\explorer.exe Code function: 4_2_0F75C082 4_2_0F75C082
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05190535 5_2_05190535
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05250591 5_2_05250591
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05234420 5_2_05234420
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05242446 5_2_05242446
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0523E4F6 5_2_0523E4F6
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051B4750 5_2_051B4750
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05190770 5_2_05190770
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0518C7C0 5_2_0518C7C0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051AC6E0 5_2_051AC6E0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05180100 5_2_05180100
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0522A118 5_2_0522A118
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05218158 5_2_05218158
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_052441A2 5_2_052441A2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_052501AA 5_2_052501AA
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_052481CC 5_2_052481CC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05222000 5_2_05222000
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0524A352 5_2_0524A352
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_052503E6 5_2_052503E6
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0519E3F0 5_2_0519E3F0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05230274 5_2_05230274
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_052102C0 5_2_052102C0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0519AD00 5_2_0519AD00
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0522CD1F 5_2_0522CD1F
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051A8DBF 5_2_051A8DBF
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0518ADE0 5_2_0518ADE0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05190C00 5_2_05190C00
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05230CB5 5_2_05230CB5
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05180CF2 5_2_05180CF2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05232F30 5_2_05232F30
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051B0F30 5_2_051B0F30
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051D2F28 5_2_051D2F28
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05204F40 5_2_05204F40
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0520EFA0 5_2_0520EFA0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05182FC8 5_2_05182FC8
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0519CFE0 5_2_0519CFE0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0524EE26 5_2_0524EE26
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05190E59 5_2_05190E59
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051A2E90 5_2_051A2E90
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0524CE93 5_2_0524CE93
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0524EEDB 5_2_0524EEDB
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051A6962 5_2_051A6962
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0525A9A6 5_2_0525A9A6
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051929A0 5_2_051929A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0519A840 5_2_0519A840
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05192840 5_2_05192840
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051768B8 5_2_051768B8
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051BE8F0 5_2_051BE8F0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0524AB40 5_2_0524AB40
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05246BD7 5_2_05246BD7
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0518EA80 5_2_0518EA80
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05247571 5_2_05247571
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0522D5B0 5_2_0522D5B0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0524F43F 5_2_0524F43F
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05181460 5_2_05181460
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0524F7B0 5_2_0524F7B0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051D5630 5_2_051D5630
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_052416CC 5_2_052416CC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0525B16B 5_2_0525B16B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0517F172 5_2_0517F172
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C516C 5_2_051C516C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0519B1B0 5_2_0519B1B0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0524F0E0 5_2_0524F0E0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_052470E9 5_2_052470E9
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051970C0 5_2_051970C0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0523F0CC 5_2_0523F0CC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0524132D 5_2_0524132D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0517D34C 5_2_0517D34C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051D739A 5_2_051D739A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051952A0 5_2_051952A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_052312ED 5_2_052312ED
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051AB2C0 5_2_051AB2C0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05247D73 5_2_05247D73
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05193D40 5_2_05193D40
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05241D5A 5_2_05241D5A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051AFDC0 5_2_051AFDC0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05209C32 5_2_05209C32
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0524FCF2 5_2_0524FCF2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0524FF09 5_2_0524FF09
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05191F92 5_2_05191F92
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0524FFB1 5_2_0524FFB1
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05153FD5 5_2_05153FD5
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05153FD2 5_2_05153FD2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05199EB0 5_2_05199EB0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05225910 5_2_05225910
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05199950 5_2_05199950
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051AB950 5_2_051AB950
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051FD800 5_2_051FD800
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051938E0 5_2_051938E0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0524FB76 5_2_0524FB76
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051AFB80 5_2_051AFB80
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05205BF0 5_2_05205BF0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051CDBF9 5_2_051CDBF9
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05203A6C 5_2_05203A6C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05247A46 5_2_05247A46
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0524FA49 5_2_0524FA49
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_05231AA3 5_2_05231AA3
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0522DAAC 5_2_0522DAAC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051D5AA0 5_2_051D5AA0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_0523DAC6 5_2_0523DAC6
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_02FEE006 5_2_02FEE006
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_02FD2FB0 5_2_02FD2FB0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_02FD2D90 5_2_02FD2D90
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_02FD2D87 5_2_02FD2D87
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_02FED563 5_2_02FED563
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_02FEDE6A 5_2_02FEDE6A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_02FD9E50 5_2_02FD9E50
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\mstsc.exe Code function: String function: 0517B970 appears 280 times
Source: C:\Windows\SysWOW64\mstsc.exe Code function: String function: 051C5130 appears 58 times
Source: C:\Windows\SysWOW64\mstsc.exe Code function: String function: 051D7E54 appears 103 times
Source: C:\Windows\SysWOW64\mstsc.exe Code function: String function: 0520F290 appears 105 times
Source: C:\Windows\SysWOW64\mstsc.exe Code function: String function: 051FEA12 appears 86 times
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: String function: 015B7E54 appears 111 times
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: String function: 015EF290 appears 105 times
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: String function: 015A5130 appears 58 times
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: String function: 015DEA12 appears 86 times
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: String function: 0155B970 appears 280 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0041A320 NtCreateFile, 3_2_0041A320
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0041A3D0 NtReadFile, 3_2_0041A3D0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0041A450 NtClose, 3_2_0041A450
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0041A500 NtAllocateVirtualMemory, 3_2_0041A500
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0041A31B NtCreateFile, 3_2_0041A31B
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0041A44A NtReadFile,NtClose, 3_2_0041A44A
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0041A4FB NtAllocateVirtualMemory, 3_2_0041A4FB
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2B60 NtClose,LdrInitializeThunk, 3_2_015A2B60
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 3_2_015A2BF0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2AD0 NtReadFile,LdrInitializeThunk, 3_2_015A2AD0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2D10 NtMapViewOfSection,LdrInitializeThunk, 3_2_015A2D10
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2D30 NtUnmapViewOfSection,LdrInitializeThunk, 3_2_015A2D30
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2DD0 NtDelayExecution,LdrInitializeThunk, 3_2_015A2DD0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2DF0 NtQuerySystemInformation,LdrInitializeThunk, 3_2_015A2DF0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2C70 NtFreeVirtualMemory,LdrInitializeThunk, 3_2_015A2C70
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2CA0 NtQueryInformationToken,LdrInitializeThunk, 3_2_015A2CA0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2F30 NtCreateSection,LdrInitializeThunk, 3_2_015A2F30
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2FE0 NtCreateFile,LdrInitializeThunk, 3_2_015A2FE0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2F90 NtProtectVirtualMemory,LdrInitializeThunk, 3_2_015A2F90
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2FB0 NtResumeThread,LdrInitializeThunk, 3_2_015A2FB0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2E80 NtReadVirtualMemory,LdrInitializeThunk, 3_2_015A2E80
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2EA0 NtAdjustPrivilegesToken,LdrInitializeThunk, 3_2_015A2EA0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A4340 NtSetContextThread, 3_2_015A4340
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A4650 NtSuspendThread, 3_2_015A4650
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2BE0 NtQueryValueKey, 3_2_015A2BE0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2B80 NtQueryInformationFile, 3_2_015A2B80
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2BA0 NtEnumerateValueKey, 3_2_015A2BA0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2AF0 NtWriteFile, 3_2_015A2AF0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2AB0 NtWaitForSingleObject, 3_2_015A2AB0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2D00 NtSetInformationFile, 3_2_015A2D00
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2DB0 NtEnumerateKey, 3_2_015A2DB0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2C60 NtCreateKey, 3_2_015A2C60
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2C00 NtQueryInformationProcess, 3_2_015A2C00
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2CC0 NtQueryVirtualMemory, 3_2_015A2CC0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2CF0 NtOpenProcess, 3_2_015A2CF0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2F60 NtCreateProcessEx, 3_2_015A2F60
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2FA0 NtQuerySection, 3_2_015A2FA0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2E30 NtWriteVirtualMemory, 3_2_015A2E30
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2EE0 NtQueueApcThread, 3_2_015A2EE0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A3010 NtOpenDirectoryObject, 3_2_015A3010
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A3090 NtSetValueKey, 3_2_015A3090
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A35C0 NtCreateMutant, 3_2_015A35C0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A39B0 NtGetContextThread, 3_2_015A39B0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A3D70 NtOpenThread, 3_2_015A3D70
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A3D10 NtOpenProcessToken, 3_2_015A3D10
Source: C:\Windows\explorer.exe Code function: 4_2_0F766232 NtCreateFile, 4_2_0F766232
Source: C:\Windows\explorer.exe Code function: 4_2_0F767E12 NtProtectVirtualMemory, 4_2_0F767E12
Source: C:\Windows\explorer.exe Code function: 4_2_0F767E0A NtProtectVirtualMemory, 4_2_0F767E0A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2D10 NtMapViewOfSection,LdrInitializeThunk, 5_2_051C2D10
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2DD0 NtDelayExecution,LdrInitializeThunk, 5_2_051C2DD0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2DF0 NtQuerySystemInformation,LdrInitializeThunk, 5_2_051C2DF0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2C70 NtFreeVirtualMemory,LdrInitializeThunk, 5_2_051C2C70
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2C60 NtCreateKey,LdrInitializeThunk, 5_2_051C2C60
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2CA0 NtQueryInformationToken,LdrInitializeThunk, 5_2_051C2CA0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2F30 NtCreateSection,LdrInitializeThunk, 5_2_051C2F30
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2FE0 NtCreateFile,LdrInitializeThunk, 5_2_051C2FE0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2EA0 NtAdjustPrivilegesToken,LdrInitializeThunk, 5_2_051C2EA0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2B60 NtClose,LdrInitializeThunk, 5_2_051C2B60
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 5_2_051C2BF0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2BE0 NtQueryValueKey,LdrInitializeThunk, 5_2_051C2BE0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2AD0 NtReadFile,LdrInitializeThunk, 5_2_051C2AD0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C35C0 NtCreateMutant,LdrInitializeThunk, 5_2_051C35C0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C4650 NtSuspendThread, 5_2_051C4650
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C4340 NtSetContextThread, 5_2_051C4340
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2D00 NtSetInformationFile, 5_2_051C2D00
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2D30 NtUnmapViewOfSection, 5_2_051C2D30
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2DB0 NtEnumerateKey, 5_2_051C2DB0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2C00 NtQueryInformationProcess, 5_2_051C2C00
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2CC0 NtQueryVirtualMemory, 5_2_051C2CC0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2CF0 NtOpenProcess, 5_2_051C2CF0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2F60 NtCreateProcessEx, 5_2_051C2F60
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2F90 NtProtectVirtualMemory, 5_2_051C2F90
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2FB0 NtResumeThread, 5_2_051C2FB0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2FA0 NtQuerySection, 5_2_051C2FA0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2E30 NtWriteVirtualMemory, 5_2_051C2E30
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2E80 NtReadVirtualMemory, 5_2_051C2E80
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2EE0 NtQueueApcThread, 5_2_051C2EE0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2B80 NtQueryInformationFile, 5_2_051C2B80
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2BA0 NtEnumerateValueKey, 5_2_051C2BA0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2AB0 NtWaitForSingleObject, 5_2_051C2AB0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C2AF0 NtWriteFile, 5_2_051C2AF0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C3010 NtOpenDirectoryObject, 5_2_051C3010
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C3090 NtSetValueKey, 5_2_051C3090
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C3D10 NtOpenProcessToken, 5_2_051C3D10
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C3D70 NtOpenThread, 5_2_051C3D70
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051C39B0 NtGetContextThread, 5_2_051C39B0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_02FEA3D0 NtReadFile, 5_2_02FEA3D0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_02FEA320 NtCreateFile, 5_2_02FEA320
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_02FEA450 NtClose, 5_2_02FEA450
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_02FEA500 NtAllocateVirtualMemory, 5_2_02FEA500
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_02FEA31B NtCreateFile, 5_2_02FEA31B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_02FEA4FB NtAllocateVirtualMemory, 5_2_02FEA4FB
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_02FEA44A NtReadFile,NtClose, 5_2_02FEA44A
Sample file is different than original file name gathered from version info
Source: yKiQrfqhGv.exe, 00000000.00000002.2020037542.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameBen.dll@ vs yKiQrfqhGv.exe
Source: yKiQrfqhGv.exe, 00000000.00000002.2020362394.0000000003CBE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs yKiQrfqhGv.exe
Source: yKiQrfqhGv.exe, 00000000.00000002.2019382568.0000000000E5E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs yKiQrfqhGv.exe
Source: yKiQrfqhGv.exe, 00000000.00000002.2022270051.0000000005370000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameBen.dll@ vs yKiQrfqhGv.exe
Source: yKiQrfqhGv.exe, 00000000.00000002.2022859965.0000000007660000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs yKiQrfqhGv.exe
Source: yKiQrfqhGv.exe, 00000003.00000002.2073567702.0000000003342000.00000040.10000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenamemstsc.exej% vs yKiQrfqhGv.exe
Source: yKiQrfqhGv.exe, 00000003.00000002.2072120390.000000000165D000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs yKiQrfqhGv.exe
Source: yKiQrfqhGv.exe Binary or memory string: OriginalFilenamevbFX.exe< vs yKiQrfqhGv.exe
Source: yKiQrfqhGv.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: yKiQrfqhGv.exe ReversingLabs: Detection: 60%
Source: yKiQrfqhGv.exe Virustotal: Detection: 61%
Source: yKiQrfqhGv.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\yKiQrfqhGv.exe C:\Users\user\Desktop\yKiQrfqhGv.exe
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process created: C:\Users\user\Desktop\yKiQrfqhGv.exe C:\Users\user\Desktop\yKiQrfqhGv.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\mstsc.exe C:\Windows\SysWOW64\mstsc.exe
Source: C:\Windows\SysWOW64\mstsc.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\yKiQrfqhGv.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process created: C:\Users\user\Desktop\yKiQrfqhGv.exe C:\Users\user\Desktop\yKiQrfqhGv.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\mstsc.exe C:\Windows\SysWOW64\mstsc.exe Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\yKiQrfqhGv.exe" Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\yKiQrfqhGv.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@166/1@12/10
Source: C:\Windows\explorer.exe File read: C:\Users\desktop.ini Jump to behavior
Source: 0.2.yKiQrfqhGv.exe.2b576d4.5.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.yKiQrfqhGv.exe.2b42e18.2.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.yKiQrfqhGv.exe.2b16900.0.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.yKiQrfqhGv.exe.2b1b5d4.6.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, hh3w2w7EyAfqVScQjB.cs Security API names: _0020.SetAccessControl
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, hh3w2w7EyAfqVScQjB.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, hh3w2w7EyAfqVScQjB.cs Security API names: _0020.AddAccessRule
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, yf4mbP3Kj0227frWlw.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, yf4mbP3Kj0227frWlw.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, hh3w2w7EyAfqVScQjB.cs Security API names: _0020.SetAccessControl
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, hh3w2w7EyAfqVScQjB.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, hh3w2w7EyAfqVScQjB.cs Security API names: _0020.AddAccessRule
Source: yKiQrfqhGv.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4128:120:WilError_03
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: yKiQrfqhGv.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: yKiQrfqhGv.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: yKiQrfqhGv.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: vbFX.pdbSHA256 source: yKiQrfqhGv.exe
Source: Binary string: wntdll.pdbUGP source: yKiQrfqhGv.exe, 00000003.00000002.2072120390.0000000001530000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000005.00000002.4481362369.00000000052EE000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000005.00000003.2072097466.0000000004DFC000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000005.00000003.2074205367.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000005.00000002.4481362369.0000000005150000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: yKiQrfqhGv.exe, yKiQrfqhGv.exe, 00000003.00000002.2072120390.0000000001530000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, mstsc.exe, 00000005.00000002.4481362369.00000000052EE000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000005.00000003.2072097466.0000000004DFC000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000005.00000003.2074205367.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000005.00000002.4481362369.0000000005150000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: vbFX.pdb source: yKiQrfqhGv.exe
Source: Binary string: mstsc.pdbGCTL source: yKiQrfqhGv.exe, 00000003.00000002.2073567702.0000000003220000.00000040.10000000.00040000.00000000.sdmp, mstsc.exe, 00000005.00000002.4479503820.0000000000D90000.00000040.80000000.00040000.00000000.sdmp
Source: Binary string: mstsc.pdb source: yKiQrfqhGv.exe, 00000003.00000002.2073567702.0000000003220000.00000040.10000000.00040000.00000000.sdmp, mstsc.exe, 00000005.00000002.4479503820.0000000000D90000.00000040.80000000.00040000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: yKiQrfqhGv.exe, frmLogin.cs .Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, hh3w2w7EyAfqVScQjB.cs .Net Code: SwAl1pXKdT System.Reflection.Assembly.Load(byte[])
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, hh3w2w7EyAfqVScQjB.cs .Net Code: SwAl1pXKdT System.Reflection.Assembly.Load(byte[])
Source: 4.2.explorer.exe.10fbf840.0.raw.unpack, frmLogin.cs .Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: 5.2.mstsc.exe.569f840.3.raw.unpack, frmLogin.cs .Net Code: InitializeComponent System.AppDomain.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 0_2_0296758F pushad ; iretd 0_2_02967599
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0041E006 push dword ptr [DF23F5C2h]; ret 3_2_0041DE68
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_00417953 push ebp; retf 3_2_004179C2
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_004179E5 push cs; iretd 3_2_004179E6
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_004169F1 push esi; ret 3_2_00416A10
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_004179FC push ebp; retf 3_2_004179C2
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_00416982 push esi; ret 3_2_00416A10
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_004169B9 push esi; ret 3_2_00416A10
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0040E2E1 push es; ret 3_2_0040E2E6
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_00417A96 pushfd ; ret 3_2_00417A97
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0041D475 push eax; ret 3_2_0041D4C8
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0041D4C2 push eax; ret 3_2_0041D4C8
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0041D4CB push eax; ret 3_2_0041D532
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0041D563 push dword ptr [DF23F5C2h]; ret 3_2_0041DE68
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0041D52C push eax; ret 3_2_0041D532
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_00406DC1 push cs; retf 3_2_00406DC4
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_004175F2 push 7C54DD51h; iretd 3_2_00417610
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0041EDF5 push 00000063h; ret 3_2_0041EDF7
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0041DE6A push dword ptr [DF23F5C2h]; ret 3_2_0041DE68
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0041EE8D push ebp; iretd 3_2_0041EE8F
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0153225F pushad ; ret 3_2_015327F9
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015327FA pushad ; ret 3_2_015327F9
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015609AD push ecx; mov dword ptr [esp], ecx 3_2_015609B6
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0153283D push eax; iretd 3_2_01532858
Source: C:\Windows\explorer.exe Code function: 4_2_0E8ACB02 push esp; retn 0000h 4_2_0E8ACB03
Source: C:\Windows\explorer.exe Code function: 4_2_0E8ACB1E push esp; retn 0000h 4_2_0E8ACB1F
Source: C:\Windows\explorer.exe Code function: 4_2_0E8AC9B5 push esp; retn 0000h 4_2_0E8ACAE7
Source: C:\Windows\explorer.exe Code function: 4_2_0F769B1E push esp; retn 0000h 4_2_0F769B1F
Source: C:\Windows\explorer.exe Code function: 4_2_0F769B02 push esp; retn 0000h 4_2_0F769B03
Source: C:\Windows\explorer.exe Code function: 4_2_0F7699B5 push esp; retn 0000h 4_2_0F769AE7
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 5_2_051527FA pushad ; ret 5_2_051527F9
Source: initial sample Static PE information: section name: .text entropy: 7.917980394551674
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, DD0iFgzjElC8hb9Ig0.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'MFhXqj4DME', 'XYeXH8FewP', 'amAXanYHP5', 'QKcXrLZdla', 'Ms8XuXpSHq', 'qAhXX5TTMm', 'UJjXtWd74s'
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, j8dhCCN2GYpfcmEwYP.cs High entropy of concatenated method names: 'ToString', 'ev1an6ilRX', 'UnfaGmnaoc', 'Apeaw3NVqK', 'b8qa25Lehm', 'sCRaP0vjCZ', 'z0Ia5Rxcsp', 'pfMaMSSaon', 'tJAaL1kJDY', 'wUwajUJpSV'
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, KgNLRcoWeX5yZQXNw5.cs High entropy of concatenated method names: 'pb2dsbk116', 'y58dKXC1Q0', 'Qr3pwxV0e4', 'grGp2L6k3P', 'eFlpPK6L6t', 'iA5p5f23R4', 'OOOpMCmsqd', 'agapLGYS7T', 'L0bpjY7oDX', 'uB4pmw0Obg'
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, yjpmpFT3JcTwZQAVXm.cs High entropy of concatenated method names: 'Dispose', 'lXwU49MvOL', 'VlKBGb4akJ', 'WkDggRVOBv', 'DefUkWMWCG', 'fpZUzurvwU', 'ProcessDialogKey', 'jiUBRyZ6AL', 'uCYBUIeGFD', 'PAoBB4Df0q'
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, hh3w2w7EyAfqVScQjB.cs High entropy of concatenated method names: 'PdX8vtLeYj', 'Wt18QQU3CB', 'LKp8TbMl9e', 'jId8pQ5yCe', 'mBH8dX2QgU', 'W4v8YuHnpA', 'iiI8hOCM0L', 'fLv87o33tq', 'NdB8I0Bm9p', 'Ap68ZxM9Ia'
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, yf4mbP3Kj0227frWlw.cs High entropy of concatenated method names: 'PptTJBQyoX', 'q2CTW4U1tU', 'pTGTNWfSM5', 'lsrT97AdKI', 'IiRT664IK5', 'jOnTDVrsui', 'qrZTAtlLui', 'xveT0pQxiT', 'tfbT4Orj5U', 'jA6Tkael1j'
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, IMjC0CDO4uNVgwN3s7.cs High entropy of concatenated method names: 'K6Vr0UjjoJ', 'mqcrk3hPm9', 'xRFuRHl9CO', 'zeWuU6S7wB', 'SiZrnSk1DJ', 'mF3rx2oZfD', 'fLIrEnpSGf', 'R23rJxETl3', 'sRXrWwFJcf', 'LgRrNEZSt2'
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, IADeJdU8Sg9mtNiNGun.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'RAltJxwhlr', 'USctWKbqsC', 'zEJtNQxqJh', 'DRJt9k1TqZ', 'cUtt60ejJR', 'McPtDEAjke', 'BSKtAl7qMJ'
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, C8WLXh9ZPkFqsA4gqV.cs High entropy of concatenated method names: 'GL5rZd5Gaj', 'XJ6rc9wsli', 'ToString', 'f1wrQJq6KM', 'FG5rTvC9mE', 'jcWrpHSH1F', 'nXhrdbV1b3', 'LJkrY7o4bn', 'hNnrh3OJ6G', 'AG0r7Y4v2I'
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, loPoWEEGJWplQS5qAN.cs High entropy of concatenated method names: 'qDAq3faqQx', 'BgUqgJ5NU1', 'ox3qS4HltE', 'mDGqGOtfBF', 'U6pq2JoqQ8', 'fsNqP1ICoH', 'HilqMRwFbN', 'jt2qLhVASR', 'gZZqmlVk7c', 'Xf6qn3PSsQ'
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, XDf0qpkyfjIEZH4O6E.cs High entropy of concatenated method names: 'RmiXUAtL5q', 'HsIX8s6s7d', 'fZLXlCyPSr', 'DawXQmRjuY', 'AiaXTgNrI2', 'NOeXdLBf8c', 'riKXYal96R', 'mGLuA6eESL', 'buZu0lRLN8', 'iZCu41X0Hx'
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, ICjxWcURamqRN8sgwgT.cs High entropy of concatenated method names: 'bMcXfllht0', 'kC5XOdd2y3', 'yKTX1HmiZY', 'Ur9Xe352nn', 'qMpXs8cBFh', 'QB8XCVeBVn', 'WA4XKgLDnp', 'JFnX3Z1mrC', 'BK4XgbbgAS', 'q9fXofVgAM'
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, AfWMWC0GTpZurvwUhi.cs High entropy of concatenated method names: 'ulfuQLB6U3', 'lpquTimWnZ', 'QHEupV0L0G', 'vbnudb6r7O', 'Mt9uYVvmFS', 'PQwuhJbcHC', 'sGKu7npepB', 'z0puIQWa52', 'pBBuZXVLHi', 'P8Cuc5xchv'
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, kWtuOFS7hJ2OquXka9.cs High entropy of concatenated method names: 'WM0YvcsJoh', 'MCLYTEWkl5', 'oKVYdKdrZ2', 'WWXYhlgYuU', 'BcGY7nId0e', 'SZKd6PqjWn', 'lxndDWKZQZ', 'IUsdAGgar1', 'o42d0Y5VbM', 'fGZd4SddXX'
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, ytUJZ2lqMLlrj8Xnnk.cs High entropy of concatenated method names: 'EefUhf4mbP', 'Cj0U7227fr', 'OGRUZawuAq', 'JTRUct5gNL', 'fXNUHw57Wt', 'qOFUa7hJ2O', 'QKWt8t6PXoyLAUoQxY', 'YsgqcH2labq2WSX3M4', 'kh1UUbyQRn', 'XLOU8HX1lX'
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, x1Tsb2j095YnRFdkHQ.cs High entropy of concatenated method names: 'zhWhfXNycs', 'IEehOirrxi', 'CX2h1wK6e6', 'b4ZheIHcqE', 'bIZhsX6NXQ', 'SdghCEq7SR', 'lNLhKETkN6', 'aLOh3SMPig', 'hGyhgwPOqJ', 'L0Nho1uPYN'
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, f9TYQngGRawuAqPTRt.cs High entropy of concatenated method names: 'mLvpelC130', 'BBSpCr7Kda', 'psXp32DFsZ', 'z8VpghJQqu', 'ClVpHrVFbj', 'vkBpacOcX0', 'dpcprrZXGB', 'nJrpueBReN', 'exBpXsAnjU', 'yyNptgyfi9'
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, hNaRXRBrOEHBRgaIoi.cs High entropy of concatenated method names: 'Ij81y8CNB', 'V6Ce9RODS', 'p5ACYwpqG', 'lRSKIasAJ', 'heygHinjo', 'm0ooH9baA', 'qfTT1YoEroVNwlaJXo', 'PsMfDMWUYwJ1WTV04G', 'KHsuNGFVS', 'vPltFYHKh'
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, byZ6AL4yCYIeGFDxAo.cs High entropy of concatenated method names: 'zxGuSVpaXY', 'knkuGQkh7d', 'FLruwt0tu2', 'bXVu2l8CR1', 'rDTuJyZsoZ', 'dfwuPSS6dI', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.yKiQrfqhGv.exe.7660000.10.raw.unpack, sIVaq0plWgrZmtgcVu.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Dp4B4bt94t', 'xGOBkTlmrE', 'hrOBztAZ3V', 'SoZ8RSTRrI', 'jxN8UqaiQB', 'E7r8BmmKAy', 'wFh88ut3OT', 'bemvjM5Up39asxMLWuv'
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, DD0iFgzjElC8hb9Ig0.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'MFhXqj4DME', 'XYeXH8FewP', 'amAXanYHP5', 'QKcXrLZdla', 'Ms8XuXpSHq', 'qAhXX5TTMm', 'UJjXtWd74s'
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, j8dhCCN2GYpfcmEwYP.cs High entropy of concatenated method names: 'ToString', 'ev1an6ilRX', 'UnfaGmnaoc', 'Apeaw3NVqK', 'b8qa25Lehm', 'sCRaP0vjCZ', 'z0Ia5Rxcsp', 'pfMaMSSaon', 'tJAaL1kJDY', 'wUwajUJpSV'
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, KgNLRcoWeX5yZQXNw5.cs High entropy of concatenated method names: 'pb2dsbk116', 'y58dKXC1Q0', 'Qr3pwxV0e4', 'grGp2L6k3P', 'eFlpPK6L6t', 'iA5p5f23R4', 'OOOpMCmsqd', 'agapLGYS7T', 'L0bpjY7oDX', 'uB4pmw0Obg'
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, yjpmpFT3JcTwZQAVXm.cs High entropy of concatenated method names: 'Dispose', 'lXwU49MvOL', 'VlKBGb4akJ', 'WkDggRVOBv', 'DefUkWMWCG', 'fpZUzurvwU', 'ProcessDialogKey', 'jiUBRyZ6AL', 'uCYBUIeGFD', 'PAoBB4Df0q'
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, hh3w2w7EyAfqVScQjB.cs High entropy of concatenated method names: 'PdX8vtLeYj', 'Wt18QQU3CB', 'LKp8TbMl9e', 'jId8pQ5yCe', 'mBH8dX2QgU', 'W4v8YuHnpA', 'iiI8hOCM0L', 'fLv87o33tq', 'NdB8I0Bm9p', 'Ap68ZxM9Ia'
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, yf4mbP3Kj0227frWlw.cs High entropy of concatenated method names: 'PptTJBQyoX', 'q2CTW4U1tU', 'pTGTNWfSM5', 'lsrT97AdKI', 'IiRT664IK5', 'jOnTDVrsui', 'qrZTAtlLui', 'xveT0pQxiT', 'tfbT4Orj5U', 'jA6Tkael1j'
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, IMjC0CDO4uNVgwN3s7.cs High entropy of concatenated method names: 'K6Vr0UjjoJ', 'mqcrk3hPm9', 'xRFuRHl9CO', 'zeWuU6S7wB', 'SiZrnSk1DJ', 'mF3rx2oZfD', 'fLIrEnpSGf', 'R23rJxETl3', 'sRXrWwFJcf', 'LgRrNEZSt2'
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, IADeJdU8Sg9mtNiNGun.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'RAltJxwhlr', 'USctWKbqsC', 'zEJtNQxqJh', 'DRJt9k1TqZ', 'cUtt60ejJR', 'McPtDEAjke', 'BSKtAl7qMJ'
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, C8WLXh9ZPkFqsA4gqV.cs High entropy of concatenated method names: 'GL5rZd5Gaj', 'XJ6rc9wsli', 'ToString', 'f1wrQJq6KM', 'FG5rTvC9mE', 'jcWrpHSH1F', 'nXhrdbV1b3', 'LJkrY7o4bn', 'hNnrh3OJ6G', 'AG0r7Y4v2I'
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, loPoWEEGJWplQS5qAN.cs High entropy of concatenated method names: 'qDAq3faqQx', 'BgUqgJ5NU1', 'ox3qS4HltE', 'mDGqGOtfBF', 'U6pq2JoqQ8', 'fsNqP1ICoH', 'HilqMRwFbN', 'jt2qLhVASR', 'gZZqmlVk7c', 'Xf6qn3PSsQ'
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, XDf0qpkyfjIEZH4O6E.cs High entropy of concatenated method names: 'RmiXUAtL5q', 'HsIX8s6s7d', 'fZLXlCyPSr', 'DawXQmRjuY', 'AiaXTgNrI2', 'NOeXdLBf8c', 'riKXYal96R', 'mGLuA6eESL', 'buZu0lRLN8', 'iZCu41X0Hx'
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, ICjxWcURamqRN8sgwgT.cs High entropy of concatenated method names: 'bMcXfllht0', 'kC5XOdd2y3', 'yKTX1HmiZY', 'Ur9Xe352nn', 'qMpXs8cBFh', 'QB8XCVeBVn', 'WA4XKgLDnp', 'JFnX3Z1mrC', 'BK4XgbbgAS', 'q9fXofVgAM'
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, AfWMWC0GTpZurvwUhi.cs High entropy of concatenated method names: 'ulfuQLB6U3', 'lpquTimWnZ', 'QHEupV0L0G', 'vbnudb6r7O', 'Mt9uYVvmFS', 'PQwuhJbcHC', 'sGKu7npepB', 'z0puIQWa52', 'pBBuZXVLHi', 'P8Cuc5xchv'
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, kWtuOFS7hJ2OquXka9.cs High entropy of concatenated method names: 'WM0YvcsJoh', 'MCLYTEWkl5', 'oKVYdKdrZ2', 'WWXYhlgYuU', 'BcGY7nId0e', 'SZKd6PqjWn', 'lxndDWKZQZ', 'IUsdAGgar1', 'o42d0Y5VbM', 'fGZd4SddXX'
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, ytUJZ2lqMLlrj8Xnnk.cs High entropy of concatenated method names: 'EefUhf4mbP', 'Cj0U7227fr', 'OGRUZawuAq', 'JTRUct5gNL', 'fXNUHw57Wt', 'qOFUa7hJ2O', 'QKWt8t6PXoyLAUoQxY', 'YsgqcH2labq2WSX3M4', 'kh1UUbyQRn', 'XLOU8HX1lX'
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, x1Tsb2j095YnRFdkHQ.cs High entropy of concatenated method names: 'zhWhfXNycs', 'IEehOirrxi', 'CX2h1wK6e6', 'b4ZheIHcqE', 'bIZhsX6NXQ', 'SdghCEq7SR', 'lNLhKETkN6', 'aLOh3SMPig', 'hGyhgwPOqJ', 'L0Nho1uPYN'
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, f9TYQngGRawuAqPTRt.cs High entropy of concatenated method names: 'mLvpelC130', 'BBSpCr7Kda', 'psXp32DFsZ', 'z8VpghJQqu', 'ClVpHrVFbj', 'vkBpacOcX0', 'dpcprrZXGB', 'nJrpueBReN', 'exBpXsAnjU', 'yyNptgyfi9'
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, hNaRXRBrOEHBRgaIoi.cs High entropy of concatenated method names: 'Ij81y8CNB', 'V6Ce9RODS', 'p5ACYwpqG', 'lRSKIasAJ', 'heygHinjo', 'm0ooH9baA', 'qfTT1YoEroVNwlaJXo', 'PsMfDMWUYwJ1WTV04G', 'KHsuNGFVS', 'vPltFYHKh'
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, byZ6AL4yCYIeGFDxAo.cs High entropy of concatenated method names: 'zxGuSVpaXY', 'knkuGQkh7d', 'FLruwt0tu2', 'bXVu2l8CR1', 'rDTuJyZsoZ', 'dfwuPSS6dI', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.yKiQrfqhGv.exe.3e75070.7.raw.unpack, sIVaq0plWgrZmtgcVu.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Dp4B4bt94t', 'xGOBkTlmrE', 'hrOBztAZ3V', 'SoZ8RSTRrI', 'jxN8UqaiQB', 'E7r8BmmKAy', 'wFh88ut3OT', 'bemvjM5Up39asxMLWuv'

Hooking and other Techniques for Hiding and Protection
barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x86 0x6E 0xEF
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: yKiQrfqhGv.exe PID: 7148, type: MEMORYSTR
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe RDTSC instruction interceptor: First address: 0000000000409B6E second address: 0000000000409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mstsc.exe RDTSC instruction interceptor: First address: 0000000002FD9904 second address: 0000000002FD990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mstsc.exe RDTSC instruction interceptor: First address: 0000000002FD9B6E second address: 0000000002FD9B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Found decision node followed by non-executed suspicious APIs
Source: C:\Windows\explorer.exe Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe TID: 6556 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 3436 Thread sleep count: 1267 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 3436 Thread sleep time: -2534000s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 3436 Thread sleep count: 8671 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 3436 Thread sleep time: -17342000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 1412 Thread sleep count: 184 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 1412 Thread sleep time: -368000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 1412 Thread sleep count: 9776 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 1412 Thread sleep time: -19552000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\mstsc.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\mstsc.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_00409AA0 rdtsc 3_2_00409AA0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 1267 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 8671 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 871 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 878 Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Window / User API: threadDelayed 9776 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe API coverage: 1.6 %
Source: C:\Windows\SysWOW64\mstsc.exe API coverage: 2.0 %
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 00000004.00000000.2027965673.00000000076F8000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}99105f770555d7dd
Source: explorer.exe, 00000004.00000003.3805374293.0000000009C92000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: explorer.exe, 00000004.00000000.2033017248.000000000C908000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: &735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0cR
Source: explorer.exe, 00000004.00000000.2029963136.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4486644135.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094627369.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW0r
Source: explorer.exe, 00000004.00000003.3094627369.0000000009B41000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: mstsc.exe, 00000005.00000002.4480310252.00000000034F5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWy
Source: explorer.exe, 00000004.00000003.3094627369.0000000009B41000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: NXTcaVMWare
Source: explorer.exe, 00000004.00000003.3805374293.0000000009C92000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000003.3094627369.0000000009B41000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000%
Source: explorer.exe, 00000004.00000000.2026552401.0000000003530000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware, Inc.
Source: explorer.exe, 00000004.00000003.3805374293.0000000009C92000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000004.00000002.4479612129.0000000000F13000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000A
Source: explorer.exe, 00000004.00000000.2026552401.0000000003530000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware-42 27 d9 2e dc 89 72 dX
Source: explorer.exe, 00000004.00000000.2027965673.00000000076F8000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}^
Source: explorer.exe, 00000004.00000003.3094627369.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4486644135.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2029963136.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp, mstsc.exe, 00000005.00000002.4480310252.00000000034AB000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000005.00000002.4480310252.00000000034F5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000004.00000000.2026552401.0000000003530000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware, Inc.NoneVMware-42 27 d9 2e dc 89 72 dX
Source: explorer.exe, 00000004.00000000.2026552401.0000000003530000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware,p
Source: explorer.exe, 00000004.00000003.3805374293.0000000009C92000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}0#{5-
Source: explorer.exe, 00000004.00000003.3094627369.0000000009B41000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000_
Source: explorer.exe, 00000004.00000002.4479612129.0000000000F13000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000004.00000003.3094627369.0000000009B41000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.2027965673.000000000769A000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_00409AA0 rdtsc 3_2_00409AA0
Enables debug privileges
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01566154 mov eax, dword ptr fs:[00000030h] 3_2_01566154
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01566154 mov eax, dword ptr fs:[00000030h] 3_2_01566154
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155C156 mov eax, dword ptr fs:[00000030h] 3_2_0155C156
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F8158 mov eax, dword ptr fs:[00000030h] 3_2_015F8158
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01634164 mov eax, dword ptr fs:[00000030h] 3_2_01634164
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01634164 mov eax, dword ptr fs:[00000030h] 3_2_01634164
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F4144 mov eax, dword ptr fs:[00000030h] 3_2_015F4144
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F4144 mov eax, dword ptr fs:[00000030h] 3_2_015F4144
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F4144 mov ecx, dword ptr fs:[00000030h] 3_2_015F4144
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F4144 mov eax, dword ptr fs:[00000030h] 3_2_015F4144
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F4144 mov eax, dword ptr fs:[00000030h] 3_2_015F4144
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160E10E mov eax, dword ptr fs:[00000030h] 3_2_0160E10E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160E10E mov ecx, dword ptr fs:[00000030h] 3_2_0160E10E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160E10E mov eax, dword ptr fs:[00000030h] 3_2_0160E10E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160E10E mov eax, dword ptr fs:[00000030h] 3_2_0160E10E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160E10E mov ecx, dword ptr fs:[00000030h] 3_2_0160E10E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160E10E mov eax, dword ptr fs:[00000030h] 3_2_0160E10E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160E10E mov eax, dword ptr fs:[00000030h] 3_2_0160E10E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160E10E mov ecx, dword ptr fs:[00000030h] 3_2_0160E10E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160E10E mov eax, dword ptr fs:[00000030h] 3_2_0160E10E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160E10E mov ecx, dword ptr fs:[00000030h] 3_2_0160E10E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01620115 mov eax, dword ptr fs:[00000030h] 3_2_01620115
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160A118 mov ecx, dword ptr fs:[00000030h] 3_2_0160A118
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160A118 mov eax, dword ptr fs:[00000030h] 3_2_0160A118
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160A118 mov eax, dword ptr fs:[00000030h] 3_2_0160A118
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160A118 mov eax, dword ptr fs:[00000030h] 3_2_0160A118
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01590124 mov eax, dword ptr fs:[00000030h] 3_2_01590124
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_016361E5 mov eax, dword ptr fs:[00000030h] 3_2_016361E5
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DE1D0 mov eax, dword ptr fs:[00000030h] 3_2_015DE1D0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DE1D0 mov eax, dword ptr fs:[00000030h] 3_2_015DE1D0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DE1D0 mov ecx, dword ptr fs:[00000030h] 3_2_015DE1D0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DE1D0 mov eax, dword ptr fs:[00000030h] 3_2_015DE1D0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DE1D0 mov eax, dword ptr fs:[00000030h] 3_2_015DE1D0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_016261C3 mov eax, dword ptr fs:[00000030h] 3_2_016261C3
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_016261C3 mov eax, dword ptr fs:[00000030h] 3_2_016261C3
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015901F8 mov eax, dword ptr fs:[00000030h] 3_2_015901F8
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E019F mov eax, dword ptr fs:[00000030h] 3_2_015E019F
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E019F mov eax, dword ptr fs:[00000030h] 3_2_015E019F
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E019F mov eax, dword ptr fs:[00000030h] 3_2_015E019F
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E019F mov eax, dword ptr fs:[00000030h] 3_2_015E019F
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155A197 mov eax, dword ptr fs:[00000030h] 3_2_0155A197
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155A197 mov eax, dword ptr fs:[00000030h] 3_2_0155A197
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155A197 mov eax, dword ptr fs:[00000030h] 3_2_0155A197
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A0185 mov eax, dword ptr fs:[00000030h] 3_2_015A0185
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01604180 mov eax, dword ptr fs:[00000030h] 3_2_01604180
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01604180 mov eax, dword ptr fs:[00000030h] 3_2_01604180
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0161C188 mov eax, dword ptr fs:[00000030h] 3_2_0161C188
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0161C188 mov eax, dword ptr fs:[00000030h] 3_2_0161C188
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01562050 mov eax, dword ptr fs:[00000030h] 3_2_01562050
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E6050 mov eax, dword ptr fs:[00000030h] 3_2_015E6050
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158C073 mov eax, dword ptr fs:[00000030h] 3_2_0158C073
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0157E016 mov eax, dword ptr fs:[00000030h] 3_2_0157E016
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0157E016 mov eax, dword ptr fs:[00000030h] 3_2_0157E016
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0157E016 mov eax, dword ptr fs:[00000030h] 3_2_0157E016
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0157E016 mov eax, dword ptr fs:[00000030h] 3_2_0157E016
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E4000 mov ecx, dword ptr fs:[00000030h] 3_2_015E4000
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01602000 mov eax, dword ptr fs:[00000030h] 3_2_01602000
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01602000 mov eax, dword ptr fs:[00000030h] 3_2_01602000
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01602000 mov eax, dword ptr fs:[00000030h] 3_2_01602000
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01602000 mov eax, dword ptr fs:[00000030h] 3_2_01602000
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01602000 mov eax, dword ptr fs:[00000030h] 3_2_01602000
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01602000 mov eax, dword ptr fs:[00000030h] 3_2_01602000
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01602000 mov eax, dword ptr fs:[00000030h] 3_2_01602000
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01602000 mov eax, dword ptr fs:[00000030h] 3_2_01602000
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F6030 mov eax, dword ptr fs:[00000030h] 3_2_015F6030
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155A020 mov eax, dword ptr fs:[00000030h] 3_2_0155A020
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155C020 mov eax, dword ptr fs:[00000030h] 3_2_0155C020
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E20DE mov eax, dword ptr fs:[00000030h] 3_2_015E20DE
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155C0F0 mov eax, dword ptr fs:[00000030h] 3_2_0155C0F0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A20F0 mov ecx, dword ptr fs:[00000030h] 3_2_015A20F0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155A0E3 mov ecx, dword ptr fs:[00000030h] 3_2_0155A0E3
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E60E0 mov eax, dword ptr fs:[00000030h] 3_2_015E60E0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015680E9 mov eax, dword ptr fs:[00000030h] 3_2_015680E9
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_016260B8 mov eax, dword ptr fs:[00000030h] 3_2_016260B8
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_016260B8 mov ecx, dword ptr fs:[00000030h] 3_2_016260B8
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156208A mov eax, dword ptr fs:[00000030h] 3_2_0156208A
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015580A0 mov eax, dword ptr fs:[00000030h] 3_2_015580A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F80A8 mov eax, dword ptr fs:[00000030h] 3_2_015F80A8
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E035C mov eax, dword ptr fs:[00000030h] 3_2_015E035C
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E035C mov eax, dword ptr fs:[00000030h] 3_2_015E035C
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E035C mov eax, dword ptr fs:[00000030h] 3_2_015E035C
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E035C mov ecx, dword ptr fs:[00000030h] 3_2_015E035C
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E035C mov eax, dword ptr fs:[00000030h] 3_2_015E035C
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E035C mov eax, dword ptr fs:[00000030h] 3_2_015E035C
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E2349 mov eax, dword ptr fs:[00000030h] 3_2_015E2349
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E2349 mov eax, dword ptr fs:[00000030h] 3_2_015E2349
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E2349 mov eax, dword ptr fs:[00000030h] 3_2_015E2349
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E2349 mov eax, dword ptr fs:[00000030h] 3_2_015E2349
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E2349 mov eax, dword ptr fs:[00000030h] 3_2_015E2349
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E2349 mov eax, dword ptr fs:[00000030h] 3_2_015E2349
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E2349 mov eax, dword ptr fs:[00000030h] 3_2_015E2349
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E2349 mov eax, dword ptr fs:[00000030h] 3_2_015E2349
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E2349 mov eax, dword ptr fs:[00000030h] 3_2_015E2349
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E2349 mov eax, dword ptr fs:[00000030h] 3_2_015E2349
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E2349 mov eax, dword ptr fs:[00000030h] 3_2_015E2349
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E2349 mov eax, dword ptr fs:[00000030h] 3_2_015E2349
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E2349 mov eax, dword ptr fs:[00000030h] 3_2_015E2349
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E2349 mov eax, dword ptr fs:[00000030h] 3_2_015E2349
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E2349 mov eax, dword ptr fs:[00000030h] 3_2_015E2349
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160437C mov eax, dword ptr fs:[00000030h] 3_2_0160437C
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0163634F mov eax, dword ptr fs:[00000030h] 3_2_0163634F
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0162A352 mov eax, dword ptr fs:[00000030h] 3_2_0162A352
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01608350 mov ecx, dword ptr fs:[00000030h] 3_2_01608350
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155C310 mov ecx, dword ptr fs:[00000030h] 3_2_0155C310
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01638324 mov eax, dword ptr fs:[00000030h] 3_2_01638324
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01638324 mov ecx, dword ptr fs:[00000030h] 3_2_01638324
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01638324 mov eax, dword ptr fs:[00000030h] 3_2_01638324
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01638324 mov eax, dword ptr fs:[00000030h] 3_2_01638324
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01580310 mov ecx, dword ptr fs:[00000030h] 3_2_01580310
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159A30B mov eax, dword ptr fs:[00000030h] 3_2_0159A30B
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159A30B mov eax, dword ptr fs:[00000030h] 3_2_0159A30B
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159A30B mov eax, dword ptr fs:[00000030h] 3_2_0159A30B
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015683C0 mov eax, dword ptr fs:[00000030h] 3_2_015683C0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015683C0 mov eax, dword ptr fs:[00000030h] 3_2_015683C0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015683C0 mov eax, dword ptr fs:[00000030h] 3_2_015683C0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015683C0 mov eax, dword ptr fs:[00000030h] 3_2_015683C0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156A3C0 mov eax, dword ptr fs:[00000030h] 3_2_0156A3C0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156A3C0 mov eax, dword ptr fs:[00000030h] 3_2_0156A3C0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156A3C0 mov eax, dword ptr fs:[00000030h] 3_2_0156A3C0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156A3C0 mov eax, dword ptr fs:[00000030h] 3_2_0156A3C0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156A3C0 mov eax, dword ptr fs:[00000030h] 3_2_0156A3C0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156A3C0 mov eax, dword ptr fs:[00000030h] 3_2_0156A3C0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E63C0 mov eax, dword ptr fs:[00000030h] 3_2_015E63C0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015963FF mov eax, dword ptr fs:[00000030h] 3_2_015963FF
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0157E3F0 mov eax, dword ptr fs:[00000030h] 3_2_0157E3F0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0157E3F0 mov eax, dword ptr fs:[00000030h] 3_2_0157E3F0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0157E3F0 mov eax, dword ptr fs:[00000030h] 3_2_0157E3F0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0161C3CD mov eax, dword ptr fs:[00000030h] 3_2_0161C3CD
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_016043D4 mov eax, dword ptr fs:[00000030h] 3_2_016043D4
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_016043D4 mov eax, dword ptr fs:[00000030h] 3_2_016043D4
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160E3DB mov eax, dword ptr fs:[00000030h] 3_2_0160E3DB
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160E3DB mov eax, dword ptr fs:[00000030h] 3_2_0160E3DB
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160E3DB mov ecx, dword ptr fs:[00000030h] 3_2_0160E3DB
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160E3DB mov eax, dword ptr fs:[00000030h] 3_2_0160E3DB
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015703E9 mov eax, dword ptr fs:[00000030h] 3_2_015703E9
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015703E9 mov eax, dword ptr fs:[00000030h] 3_2_015703E9
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015703E9 mov eax, dword ptr fs:[00000030h] 3_2_015703E9
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015703E9 mov eax, dword ptr fs:[00000030h] 3_2_015703E9
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015703E9 mov eax, dword ptr fs:[00000030h] 3_2_015703E9
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015703E9 mov eax, dword ptr fs:[00000030h] 3_2_015703E9
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015703E9 mov eax, dword ptr fs:[00000030h] 3_2_015703E9
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015703E9 mov eax, dword ptr fs:[00000030h] 3_2_015703E9
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01558397 mov eax, dword ptr fs:[00000030h] 3_2_01558397
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01558397 mov eax, dword ptr fs:[00000030h] 3_2_01558397
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01558397 mov eax, dword ptr fs:[00000030h] 3_2_01558397
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158438F mov eax, dword ptr fs:[00000030h] 3_2_0158438F
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158438F mov eax, dword ptr fs:[00000030h] 3_2_0158438F
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155E388 mov eax, dword ptr fs:[00000030h] 3_2_0155E388
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155E388 mov eax, dword ptr fs:[00000030h] 3_2_0155E388
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155E388 mov eax, dword ptr fs:[00000030h] 3_2_0155E388
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155A250 mov eax, dword ptr fs:[00000030h] 3_2_0155A250
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01566259 mov eax, dword ptr fs:[00000030h] 3_2_01566259
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01610274 mov eax, dword ptr fs:[00000030h] 3_2_01610274
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01610274 mov eax, dword ptr fs:[00000030h] 3_2_01610274
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01610274 mov eax, dword ptr fs:[00000030h] 3_2_01610274
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01610274 mov eax, dword ptr fs:[00000030h] 3_2_01610274
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01610274 mov eax, dword ptr fs:[00000030h] 3_2_01610274
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01610274 mov eax, dword ptr fs:[00000030h] 3_2_01610274
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01610274 mov eax, dword ptr fs:[00000030h] 3_2_01610274
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01610274 mov eax, dword ptr fs:[00000030h] 3_2_01610274
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01610274 mov eax, dword ptr fs:[00000030h] 3_2_01610274
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01610274 mov eax, dword ptr fs:[00000030h] 3_2_01610274
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01610274 mov eax, dword ptr fs:[00000030h] 3_2_01610274
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01610274 mov eax, dword ptr fs:[00000030h] 3_2_01610274
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E8243 mov eax, dword ptr fs:[00000030h] 3_2_015E8243
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E8243 mov ecx, dword ptr fs:[00000030h] 3_2_015E8243
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0161A250 mov eax, dword ptr fs:[00000030h] 3_2_0161A250
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0161A250 mov eax, dword ptr fs:[00000030h] 3_2_0161A250
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01564260 mov eax, dword ptr fs:[00000030h] 3_2_01564260
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01564260 mov eax, dword ptr fs:[00000030h] 3_2_01564260
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01564260 mov eax, dword ptr fs:[00000030h] 3_2_01564260
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155826B mov eax, dword ptr fs:[00000030h] 3_2_0155826B
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0163625D mov eax, dword ptr fs:[00000030h] 3_2_0163625D
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155823B mov eax, dword ptr fs:[00000030h] 3_2_0155823B
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156A2C3 mov eax, dword ptr fs:[00000030h] 3_2_0156A2C3
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156A2C3 mov eax, dword ptr fs:[00000030h] 3_2_0156A2C3
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156A2C3 mov eax, dword ptr fs:[00000030h] 3_2_0156A2C3
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156A2C3 mov eax, dword ptr fs:[00000030h] 3_2_0156A2C3
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156A2C3 mov eax, dword ptr fs:[00000030h] 3_2_0156A2C3
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_016362D6 mov eax, dword ptr fs:[00000030h] 3_2_016362D6
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015702E1 mov eax, dword ptr fs:[00000030h] 3_2_015702E1
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015702E1 mov eax, dword ptr fs:[00000030h] 3_2_015702E1
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015702E1 mov eax, dword ptr fs:[00000030h] 3_2_015702E1
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E0283 mov eax, dword ptr fs:[00000030h] 3_2_015E0283
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E0283 mov eax, dword ptr fs:[00000030h] 3_2_015E0283
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E0283 mov eax, dword ptr fs:[00000030h] 3_2_015E0283
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159E284 mov eax, dword ptr fs:[00000030h] 3_2_0159E284
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159E284 mov eax, dword ptr fs:[00000030h] 3_2_0159E284
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015702A0 mov eax, dword ptr fs:[00000030h] 3_2_015702A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015702A0 mov eax, dword ptr fs:[00000030h] 3_2_015702A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F62A0 mov eax, dword ptr fs:[00000030h] 3_2_015F62A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F62A0 mov ecx, dword ptr fs:[00000030h] 3_2_015F62A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F62A0 mov eax, dword ptr fs:[00000030h] 3_2_015F62A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F62A0 mov eax, dword ptr fs:[00000030h] 3_2_015F62A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F62A0 mov eax, dword ptr fs:[00000030h] 3_2_015F62A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F62A0 mov eax, dword ptr fs:[00000030h] 3_2_015F62A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01568550 mov eax, dword ptr fs:[00000030h] 3_2_01568550
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01568550 mov eax, dword ptr fs:[00000030h] 3_2_01568550
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159656A mov eax, dword ptr fs:[00000030h] 3_2_0159656A
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159656A mov eax, dword ptr fs:[00000030h] 3_2_0159656A
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159656A mov eax, dword ptr fs:[00000030h] 3_2_0159656A
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F6500 mov eax, dword ptr fs:[00000030h] 3_2_015F6500
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570535 mov eax, dword ptr fs:[00000030h] 3_2_01570535
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570535 mov eax, dword ptr fs:[00000030h] 3_2_01570535
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570535 mov eax, dword ptr fs:[00000030h] 3_2_01570535
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570535 mov eax, dword ptr fs:[00000030h] 3_2_01570535
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570535 mov eax, dword ptr fs:[00000030h] 3_2_01570535
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570535 mov eax, dword ptr fs:[00000030h] 3_2_01570535
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01634500 mov eax, dword ptr fs:[00000030h] 3_2_01634500
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01634500 mov eax, dword ptr fs:[00000030h] 3_2_01634500
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01634500 mov eax, dword ptr fs:[00000030h] 3_2_01634500
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01634500 mov eax, dword ptr fs:[00000030h] 3_2_01634500
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01634500 mov eax, dword ptr fs:[00000030h] 3_2_01634500
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01634500 mov eax, dword ptr fs:[00000030h] 3_2_01634500
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01634500 mov eax, dword ptr fs:[00000030h] 3_2_01634500
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158E53E mov eax, dword ptr fs:[00000030h] 3_2_0158E53E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158E53E mov eax, dword ptr fs:[00000030h] 3_2_0158E53E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158E53E mov eax, dword ptr fs:[00000030h] 3_2_0158E53E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158E53E mov eax, dword ptr fs:[00000030h] 3_2_0158E53E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158E53E mov eax, dword ptr fs:[00000030h] 3_2_0158E53E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015665D0 mov eax, dword ptr fs:[00000030h] 3_2_015665D0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159A5D0 mov eax, dword ptr fs:[00000030h] 3_2_0159A5D0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159A5D0 mov eax, dword ptr fs:[00000030h] 3_2_0159A5D0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159E5CF mov eax, dword ptr fs:[00000030h] 3_2_0159E5CF
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159E5CF mov eax, dword ptr fs:[00000030h] 3_2_0159E5CF
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159C5ED mov eax, dword ptr fs:[00000030h] 3_2_0159C5ED
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159C5ED mov eax, dword ptr fs:[00000030h] 3_2_0159C5ED
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015625E0 mov eax, dword ptr fs:[00000030h] 3_2_015625E0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0158E5E7
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0158E5E7
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0158E5E7
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0158E5E7
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0158E5E7
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0158E5E7
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0158E5E7
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158E5E7 mov eax, dword ptr fs:[00000030h] 3_2_0158E5E7
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159E59C mov eax, dword ptr fs:[00000030h] 3_2_0159E59C
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01594588 mov eax, dword ptr fs:[00000030h] 3_2_01594588
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01562582 mov eax, dword ptr fs:[00000030h] 3_2_01562582
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01562582 mov ecx, dword ptr fs:[00000030h] 3_2_01562582
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015845B1 mov eax, dword ptr fs:[00000030h] 3_2_015845B1
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015845B1 mov eax, dword ptr fs:[00000030h] 3_2_015845B1
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E05A7 mov eax, dword ptr fs:[00000030h] 3_2_015E05A7
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E05A7 mov eax, dword ptr fs:[00000030h] 3_2_015E05A7
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E05A7 mov eax, dword ptr fs:[00000030h] 3_2_015E05A7
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158245A mov eax, dword ptr fs:[00000030h] 3_2_0158245A
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155645D mov eax, dword ptr fs:[00000030h] 3_2_0155645D
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159E443 mov eax, dword ptr fs:[00000030h] 3_2_0159E443
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159E443 mov eax, dword ptr fs:[00000030h] 3_2_0159E443
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159E443 mov eax, dword ptr fs:[00000030h] 3_2_0159E443
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159E443 mov eax, dword ptr fs:[00000030h] 3_2_0159E443
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159E443 mov eax, dword ptr fs:[00000030h] 3_2_0159E443
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159E443 mov eax, dword ptr fs:[00000030h] 3_2_0159E443
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159E443 mov eax, dword ptr fs:[00000030h] 3_2_0159E443
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159E443 mov eax, dword ptr fs:[00000030h] 3_2_0159E443
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158A470 mov eax, dword ptr fs:[00000030h] 3_2_0158A470
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158A470 mov eax, dword ptr fs:[00000030h] 3_2_0158A470
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158A470 mov eax, dword ptr fs:[00000030h] 3_2_0158A470
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0161A456 mov eax, dword ptr fs:[00000030h] 3_2_0161A456
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015EC460 mov ecx, dword ptr fs:[00000030h] 3_2_015EC460
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01598402 mov eax, dword ptr fs:[00000030h] 3_2_01598402
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01598402 mov eax, dword ptr fs:[00000030h] 3_2_01598402
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01598402 mov eax, dword ptr fs:[00000030h] 3_2_01598402
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159A430 mov eax, dword ptr fs:[00000030h] 3_2_0159A430
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155C427 mov eax, dword ptr fs:[00000030h] 3_2_0155C427
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155E420 mov eax, dword ptr fs:[00000030h] 3_2_0155E420
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155E420 mov eax, dword ptr fs:[00000030h] 3_2_0155E420
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155E420 mov eax, dword ptr fs:[00000030h] 3_2_0155E420
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E6420 mov eax, dword ptr fs:[00000030h] 3_2_015E6420
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E6420 mov eax, dword ptr fs:[00000030h] 3_2_015E6420
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E6420 mov eax, dword ptr fs:[00000030h] 3_2_015E6420
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E6420 mov eax, dword ptr fs:[00000030h] 3_2_015E6420
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E6420 mov eax, dword ptr fs:[00000030h] 3_2_015E6420
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E6420 mov eax, dword ptr fs:[00000030h] 3_2_015E6420
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E6420 mov eax, dword ptr fs:[00000030h] 3_2_015E6420
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015604E5 mov ecx, dword ptr fs:[00000030h] 3_2_015604E5
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015944B0 mov ecx, dword ptr fs:[00000030h] 3_2_015944B0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015EA4B0 mov eax, dword ptr fs:[00000030h] 3_2_015EA4B0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0161A49A mov eax, dword ptr fs:[00000030h] 3_2_0161A49A
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015664AB mov eax, dword ptr fs:[00000030h] 3_2_015664AB
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015EE75D mov eax, dword ptr fs:[00000030h] 3_2_015EE75D
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01560750 mov eax, dword ptr fs:[00000030h] 3_2_01560750
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2750 mov eax, dword ptr fs:[00000030h] 3_2_015A2750
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2750 mov eax, dword ptr fs:[00000030h] 3_2_015A2750
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E4755 mov eax, dword ptr fs:[00000030h] 3_2_015E4755
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159674D mov esi, dword ptr fs:[00000030h] 3_2_0159674D
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159674D mov eax, dword ptr fs:[00000030h] 3_2_0159674D
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159674D mov eax, dword ptr fs:[00000030h] 3_2_0159674D
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01568770 mov eax, dword ptr fs:[00000030h] 3_2_01568770
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570770 mov eax, dword ptr fs:[00000030h] 3_2_01570770
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570770 mov eax, dword ptr fs:[00000030h] 3_2_01570770
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570770 mov eax, dword ptr fs:[00000030h] 3_2_01570770
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570770 mov eax, dword ptr fs:[00000030h] 3_2_01570770
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570770 mov eax, dword ptr fs:[00000030h] 3_2_01570770
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570770 mov eax, dword ptr fs:[00000030h] 3_2_01570770
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570770 mov eax, dword ptr fs:[00000030h] 3_2_01570770
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570770 mov eax, dword ptr fs:[00000030h] 3_2_01570770
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570770 mov eax, dword ptr fs:[00000030h] 3_2_01570770
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570770 mov eax, dword ptr fs:[00000030h] 3_2_01570770
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570770 mov eax, dword ptr fs:[00000030h] 3_2_01570770
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570770 mov eax, dword ptr fs:[00000030h] 3_2_01570770
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01560710 mov eax, dword ptr fs:[00000030h] 3_2_01560710
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01590710 mov eax, dword ptr fs:[00000030h] 3_2_01590710
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159C700 mov eax, dword ptr fs:[00000030h] 3_2_0159C700
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159273C mov eax, dword ptr fs:[00000030h] 3_2_0159273C
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159273C mov ecx, dword ptr fs:[00000030h] 3_2_0159273C
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159273C mov eax, dword ptr fs:[00000030h] 3_2_0159273C
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DC730 mov eax, dword ptr fs:[00000030h] 3_2_015DC730
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159C720 mov eax, dword ptr fs:[00000030h] 3_2_0159C720
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159C720 mov eax, dword ptr fs:[00000030h] 3_2_0159C720
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156C7C0 mov eax, dword ptr fs:[00000030h] 3_2_0156C7C0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E07C3 mov eax, dword ptr fs:[00000030h] 3_2_015E07C3
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015647FB mov eax, dword ptr fs:[00000030h] 3_2_015647FB
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015647FB mov eax, dword ptr fs:[00000030h] 3_2_015647FB
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015827ED mov eax, dword ptr fs:[00000030h] 3_2_015827ED
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015827ED mov eax, dword ptr fs:[00000030h] 3_2_015827ED
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015827ED mov eax, dword ptr fs:[00000030h] 3_2_015827ED
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015EE7E1 mov eax, dword ptr fs:[00000030h] 3_2_015EE7E1
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_016147A0 mov eax, dword ptr fs:[00000030h] 3_2_016147A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160678E mov eax, dword ptr fs:[00000030h] 3_2_0160678E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015607AF mov eax, dword ptr fs:[00000030h] 3_2_015607AF
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0162866E mov eax, dword ptr fs:[00000030h] 3_2_0162866E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0162866E mov eax, dword ptr fs:[00000030h] 3_2_0162866E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0157C640 mov eax, dword ptr fs:[00000030h] 3_2_0157C640
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01592674 mov eax, dword ptr fs:[00000030h] 3_2_01592674
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159A660 mov eax, dword ptr fs:[00000030h] 3_2_0159A660
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159A660 mov eax, dword ptr fs:[00000030h] 3_2_0159A660
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A2619 mov eax, dword ptr fs:[00000030h] 3_2_015A2619
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DE609 mov eax, dword ptr fs:[00000030h] 3_2_015DE609
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0157260B mov eax, dword ptr fs:[00000030h] 3_2_0157260B
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0157260B mov eax, dword ptr fs:[00000030h] 3_2_0157260B
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0157260B mov eax, dword ptr fs:[00000030h] 3_2_0157260B
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0157260B mov eax, dword ptr fs:[00000030h] 3_2_0157260B
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0157260B mov eax, dword ptr fs:[00000030h] 3_2_0157260B
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0157260B mov eax, dword ptr fs:[00000030h] 3_2_0157260B
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0157260B mov eax, dword ptr fs:[00000030h] 3_2_0157260B
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0157E627 mov eax, dword ptr fs:[00000030h] 3_2_0157E627
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01596620 mov eax, dword ptr fs:[00000030h] 3_2_01596620
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01598620 mov eax, dword ptr fs:[00000030h] 3_2_01598620
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156262C mov eax, dword ptr fs:[00000030h] 3_2_0156262C
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159A6C7 mov ebx, dword ptr fs:[00000030h] 3_2_0159A6C7
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159A6C7 mov eax, dword ptr fs:[00000030h] 3_2_0159A6C7
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E06F1 mov eax, dword ptr fs:[00000030h] 3_2_015E06F1
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E06F1 mov eax, dword ptr fs:[00000030h] 3_2_015E06F1
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DE6F2 mov eax, dword ptr fs:[00000030h] 3_2_015DE6F2
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DE6F2 mov eax, dword ptr fs:[00000030h] 3_2_015DE6F2
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DE6F2 mov eax, dword ptr fs:[00000030h] 3_2_015DE6F2
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DE6F2 mov eax, dword ptr fs:[00000030h] 3_2_015DE6F2
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01564690 mov eax, dword ptr fs:[00000030h] 3_2_01564690
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01564690 mov eax, dword ptr fs:[00000030h] 3_2_01564690
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015966B0 mov eax, dword ptr fs:[00000030h] 3_2_015966B0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159C6A6 mov eax, dword ptr fs:[00000030h] 3_2_0159C6A6
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E0946 mov eax, dword ptr fs:[00000030h] 3_2_015E0946
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01604978 mov eax, dword ptr fs:[00000030h] 3_2_01604978
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01604978 mov eax, dword ptr fs:[00000030h] 3_2_01604978
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015EC97C mov eax, dword ptr fs:[00000030h] 3_2_015EC97C
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01634940 mov eax, dword ptr fs:[00000030h] 3_2_01634940
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A096E mov eax, dword ptr fs:[00000030h] 3_2_015A096E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A096E mov edx, dword ptr fs:[00000030h] 3_2_015A096E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015A096E mov eax, dword ptr fs:[00000030h] 3_2_015A096E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01586962 mov eax, dword ptr fs:[00000030h] 3_2_01586962
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01586962 mov eax, dword ptr fs:[00000030h] 3_2_01586962
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01586962 mov eax, dword ptr fs:[00000030h] 3_2_01586962
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015EC912 mov eax, dword ptr fs:[00000030h] 3_2_015EC912
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01558918 mov eax, dword ptr fs:[00000030h] 3_2_01558918
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01558918 mov eax, dword ptr fs:[00000030h] 3_2_01558918
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DE908 mov eax, dword ptr fs:[00000030h] 3_2_015DE908
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DE908 mov eax, dword ptr fs:[00000030h] 3_2_015DE908
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E892A mov eax, dword ptr fs:[00000030h] 3_2_015E892A
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F892B mov eax, dword ptr fs:[00000030h] 3_2_015F892B
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156A9D0 mov eax, dword ptr fs:[00000030h] 3_2_0156A9D0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156A9D0 mov eax, dword ptr fs:[00000030h] 3_2_0156A9D0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156A9D0 mov eax, dword ptr fs:[00000030h] 3_2_0156A9D0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156A9D0 mov eax, dword ptr fs:[00000030h] 3_2_0156A9D0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156A9D0 mov eax, dword ptr fs:[00000030h] 3_2_0156A9D0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156A9D0 mov eax, dword ptr fs:[00000030h] 3_2_0156A9D0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015949D0 mov eax, dword ptr fs:[00000030h] 3_2_015949D0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F69C0 mov eax, dword ptr fs:[00000030h] 3_2_015F69C0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015929F9 mov eax, dword ptr fs:[00000030h] 3_2_015929F9
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015929F9 mov eax, dword ptr fs:[00000030h] 3_2_015929F9
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0162A9D3 mov eax, dword ptr fs:[00000030h] 3_2_0162A9D3
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015EE9E0 mov eax, dword ptr fs:[00000030h] 3_2_015EE9E0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E89B3 mov esi, dword ptr fs:[00000030h] 3_2_015E89B3
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E89B3 mov eax, dword ptr fs:[00000030h] 3_2_015E89B3
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015E89B3 mov eax, dword ptr fs:[00000030h] 3_2_015E89B3
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015729A0 mov eax, dword ptr fs:[00000030h] 3_2_015729A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015729A0 mov eax, dword ptr fs:[00000030h] 3_2_015729A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015729A0 mov eax, dword ptr fs:[00000030h] 3_2_015729A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015729A0 mov eax, dword ptr fs:[00000030h] 3_2_015729A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015729A0 mov eax, dword ptr fs:[00000030h] 3_2_015729A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015729A0 mov eax, dword ptr fs:[00000030h] 3_2_015729A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015729A0 mov eax, dword ptr fs:[00000030h] 3_2_015729A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015729A0 mov eax, dword ptr fs:[00000030h] 3_2_015729A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015729A0 mov eax, dword ptr fs:[00000030h] 3_2_015729A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015729A0 mov eax, dword ptr fs:[00000030h] 3_2_015729A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015729A0 mov eax, dword ptr fs:[00000030h] 3_2_015729A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015729A0 mov eax, dword ptr fs:[00000030h] 3_2_015729A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015729A0 mov eax, dword ptr fs:[00000030h] 3_2_015729A0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015609AD mov eax, dword ptr fs:[00000030h] 3_2_015609AD
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015609AD mov eax, dword ptr fs:[00000030h] 3_2_015609AD
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01590854 mov eax, dword ptr fs:[00000030h] 3_2_01590854
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01564859 mov eax, dword ptr fs:[00000030h] 3_2_01564859
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01564859 mov eax, dword ptr fs:[00000030h] 3_2_01564859
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01572840 mov ecx, dword ptr fs:[00000030h] 3_2_01572840
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015EE872 mov eax, dword ptr fs:[00000030h] 3_2_015EE872
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015EE872 mov eax, dword ptr fs:[00000030h] 3_2_015EE872
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F6870 mov eax, dword ptr fs:[00000030h] 3_2_015F6870
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F6870 mov eax, dword ptr fs:[00000030h] 3_2_015F6870
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015EC810 mov eax, dword ptr fs:[00000030h] 3_2_015EC810
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160483A mov eax, dword ptr fs:[00000030h] 3_2_0160483A
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160483A mov eax, dword ptr fs:[00000030h] 3_2_0160483A
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159A830 mov eax, dword ptr fs:[00000030h] 3_2_0159A830
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01582835 mov eax, dword ptr fs:[00000030h] 3_2_01582835
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01582835 mov eax, dword ptr fs:[00000030h] 3_2_01582835
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01582835 mov eax, dword ptr fs:[00000030h] 3_2_01582835
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01582835 mov ecx, dword ptr fs:[00000030h] 3_2_01582835
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01582835 mov eax, dword ptr fs:[00000030h] 3_2_01582835
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01582835 mov eax, dword ptr fs:[00000030h] 3_2_01582835
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0162A8E4 mov eax, dword ptr fs:[00000030h] 3_2_0162A8E4
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158E8C0 mov eax, dword ptr fs:[00000030h] 3_2_0158E8C0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159C8F9 mov eax, dword ptr fs:[00000030h] 3_2_0159C8F9
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159C8F9 mov eax, dword ptr fs:[00000030h] 3_2_0159C8F9
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_016308C0 mov eax, dword ptr fs:[00000030h] 3_2_016308C0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015EC89D mov eax, dword ptr fs:[00000030h] 3_2_015EC89D
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01560887 mov eax, dword ptr fs:[00000030h] 3_2_01560887
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01558B50 mov eax, dword ptr fs:[00000030h] 3_2_01558B50
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F6B40 mov eax, dword ptr fs:[00000030h] 3_2_015F6B40
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015F6B40 mov eax, dword ptr fs:[00000030h] 3_2_015F6B40
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0162AB40 mov eax, dword ptr fs:[00000030h] 3_2_0162AB40
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01608B42 mov eax, dword ptr fs:[00000030h] 3_2_01608B42
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01614B4B mov eax, dword ptr fs:[00000030h] 3_2_01614B4B
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01614B4B mov eax, dword ptr fs:[00000030h] 3_2_01614B4B
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0155CB7E mov eax, dword ptr fs:[00000030h] 3_2_0155CB7E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160EB50 mov eax, dword ptr fs:[00000030h] 3_2_0160EB50
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01632B57 mov eax, dword ptr fs:[00000030h] 3_2_01632B57
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01632B57 mov eax, dword ptr fs:[00000030h] 3_2_01632B57
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01632B57 mov eax, dword ptr fs:[00000030h] 3_2_01632B57
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01632B57 mov eax, dword ptr fs:[00000030h] 3_2_01632B57
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DEB1D mov eax, dword ptr fs:[00000030h] 3_2_015DEB1D
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DEB1D mov eax, dword ptr fs:[00000030h] 3_2_015DEB1D
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DEB1D mov eax, dword ptr fs:[00000030h] 3_2_015DEB1D
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DEB1D mov eax, dword ptr fs:[00000030h] 3_2_015DEB1D
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DEB1D mov eax, dword ptr fs:[00000030h] 3_2_015DEB1D
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DEB1D mov eax, dword ptr fs:[00000030h] 3_2_015DEB1D
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DEB1D mov eax, dword ptr fs:[00000030h] 3_2_015DEB1D
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DEB1D mov eax, dword ptr fs:[00000030h] 3_2_015DEB1D
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DEB1D mov eax, dword ptr fs:[00000030h] 3_2_015DEB1D
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01628B28 mov eax, dword ptr fs:[00000030h] 3_2_01628B28
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01628B28 mov eax, dword ptr fs:[00000030h] 3_2_01628B28
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01634B00 mov eax, dword ptr fs:[00000030h] 3_2_01634B00
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158EB20 mov eax, dword ptr fs:[00000030h] 3_2_0158EB20
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158EB20 mov eax, dword ptr fs:[00000030h] 3_2_0158EB20
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01580BCB mov eax, dword ptr fs:[00000030h] 3_2_01580BCB
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01580BCB mov eax, dword ptr fs:[00000030h] 3_2_01580BCB
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01580BCB mov eax, dword ptr fs:[00000030h] 3_2_01580BCB
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01560BCD mov eax, dword ptr fs:[00000030h] 3_2_01560BCD
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01560BCD mov eax, dword ptr fs:[00000030h] 3_2_01560BCD
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01560BCD mov eax, dword ptr fs:[00000030h] 3_2_01560BCD
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158EBFC mov eax, dword ptr fs:[00000030h] 3_2_0158EBFC
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01568BF0 mov eax, dword ptr fs:[00000030h] 3_2_01568BF0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01568BF0 mov eax, dword ptr fs:[00000030h] 3_2_01568BF0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01568BF0 mov eax, dword ptr fs:[00000030h] 3_2_01568BF0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015ECBF0 mov eax, dword ptr fs:[00000030h] 3_2_015ECBF0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160EBD0 mov eax, dword ptr fs:[00000030h] 3_2_0160EBD0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01614BB0 mov eax, dword ptr fs:[00000030h] 3_2_01614BB0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01614BB0 mov eax, dword ptr fs:[00000030h] 3_2_01614BB0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570BBE mov eax, dword ptr fs:[00000030h] 3_2_01570BBE
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570BBE mov eax, dword ptr fs:[00000030h] 3_2_01570BBE
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0160EA60 mov eax, dword ptr fs:[00000030h] 3_2_0160EA60
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01566A50 mov eax, dword ptr fs:[00000030h] 3_2_01566A50
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01566A50 mov eax, dword ptr fs:[00000030h] 3_2_01566A50
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01566A50 mov eax, dword ptr fs:[00000030h] 3_2_01566A50
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01566A50 mov eax, dword ptr fs:[00000030h] 3_2_01566A50
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01566A50 mov eax, dword ptr fs:[00000030h] 3_2_01566A50
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01566A50 mov eax, dword ptr fs:[00000030h] 3_2_01566A50
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01566A50 mov eax, dword ptr fs:[00000030h] 3_2_01566A50
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570A5B mov eax, dword ptr fs:[00000030h] 3_2_01570A5B
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01570A5B mov eax, dword ptr fs:[00000030h] 3_2_01570A5B
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DCA72 mov eax, dword ptr fs:[00000030h] 3_2_015DCA72
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015DCA72 mov eax, dword ptr fs:[00000030h] 3_2_015DCA72
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159CA6F mov eax, dword ptr fs:[00000030h] 3_2_0159CA6F
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159CA6F mov eax, dword ptr fs:[00000030h] 3_2_0159CA6F
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159CA6F mov eax, dword ptr fs:[00000030h] 3_2_0159CA6F
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015ECA11 mov eax, dword ptr fs:[00000030h] 3_2_015ECA11
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159CA38 mov eax, dword ptr fs:[00000030h] 3_2_0159CA38
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01584A35 mov eax, dword ptr fs:[00000030h] 3_2_01584A35
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01584A35 mov eax, dword ptr fs:[00000030h] 3_2_01584A35
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0158EA2E mov eax, dword ptr fs:[00000030h] 3_2_0158EA2E
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159CA24 mov eax, dword ptr fs:[00000030h] 3_2_0159CA24
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01560AD0 mov eax, dword ptr fs:[00000030h] 3_2_01560AD0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01594AD0 mov eax, dword ptr fs:[00000030h] 3_2_01594AD0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01594AD0 mov eax, dword ptr fs:[00000030h] 3_2_01594AD0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015B6ACC mov eax, dword ptr fs:[00000030h] 3_2_015B6ACC
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015B6ACC mov eax, dword ptr fs:[00000030h] 3_2_015B6ACC
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_015B6ACC mov eax, dword ptr fs:[00000030h] 3_2_015B6ACC
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159AAEE mov eax, dword ptr fs:[00000030h] 3_2_0159AAEE
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0159AAEE mov eax, dword ptr fs:[00000030h] 3_2_0159AAEE
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_01598A90 mov edx, dword ptr fs:[00000030h] 3_2_01598A90
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156EA80 mov eax, dword ptr fs:[00000030h] 3_2_0156EA80
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0156EA80 mov eax, dword ptr fs:[00000030h] 3_2_0156EA80
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Code function: 3_2_0040ACE0 LdrLoadDll, 3_2_0040ACE0
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 154.205.127.201 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 76.223.105.230 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 15.197.142.173 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 103.224.182.242 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 212.32.237.91 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 157.7.189.188 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 38.40.235.204 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 104.21.41.165 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 192.185.16.134 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 3.33.130.190 80 Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Section unmapped: C:\Windows\SysWOW64\mstsc.exe base address: D90000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Section loaded: unknown target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Section loaded: unknown target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Memory written: C:\Users\user\Desktop\yKiQrfqhGv.exe base: 400000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Thread register set: target process: 1028 Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Thread register set: target process: 1028 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Process created: C:\Users\user\Desktop\yKiQrfqhGv.exe C:\Users\user\Desktop\yKiQrfqhGv.exe Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\yKiQrfqhGv.exe" Jump to behavior
Source: explorer.exe, 00000004.00000003.3806585616.0000000009C21000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3095724288.0000000009B7A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4487673351.0000000009C22000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd=
Source: explorer.exe, 00000004.00000000.2022881430.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.4480555913.0000000001731000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000004.00000002.4483881233.0000000004B00000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2022881430.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.4480555913.0000000001731000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000000.2022881430.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.4480555913.0000000001731000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000004.00000000.2022881430.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.4480555913.0000000001731000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000004.00000000.2022124570.0000000000EF8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4479612129.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: PProgman
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Queries volume information: C:\Users\user\Desktop\yKiQrfqhGv.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\yKiQrfqhGv.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 3.2.yKiQrfqhGv.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.yKiQrfqhGv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.4480722616.0000000003790000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2020362394.0000000003CBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4481064558.0000000004F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4479931565.0000000002FD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2071486980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 3.2.yKiQrfqhGv.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.yKiQrfqhGv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.4480722616.0000000003790000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2020362394.0000000003CBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4481064558.0000000004F80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4479931565.0000000002FD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2071486980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1337303 Sample: yKiQrfqhGv.exe Startdate: 05/11/2023 Architecture: WINDOWS Score: 100 34 www.stephenplattassociatesllp.com 2->34 36 www.sactribune.com 2->36 38 13 other IPs or domains 2->38 42 Snort IDS alert for network traffic 2->42 44 Multi AV Scanner detection for domain / URL 2->44 46 Found malware configuration 2->46 48 10 other signatures 2->48 11 yKiQrfqhGv.exe 3 2->11         started        signatures3 process4 signatures5 56 Tries to detect virtualization through RDTSC time measurements 11->56 58 Injects a PE file into a foreign processes 11->58 14 yKiQrfqhGv.exe 11->14         started        process6 signatures7 60 Modifies the context of a thread in another process (thread injection) 14->60 62 Maps a DLL or memory area into another process 14->62 64 Sample uses process hollowing technique 14->64 66 Queues an APC in another process (thread injection) 14->66 17 explorer.exe 45 7 14->17 injected process8 dnsIp9 28 iontrapper.science 192.185.16.134, 49726, 80 UNIFIEDLAYER-AS-1US United States 17->28 30 www.antojitoslosramos.com 103.224.182.242, 49728, 80 TRELLIAN-AS-APTrellianPtyLimitedAU Australia 17->30 32 8 other IPs or domains 17->32 40 System process connects to network (likely due to code injection or exploit) 17->40 21 mstsc.exe 12 17->21         started        signatures10 process11 signatures12 50 Modifies the context of a thread in another process (thread injection) 21->50 52 Maps a DLL or memory area into another process 21->52 54 Tries to detect virtualization through RDTSC time measurements 21->54 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
157.7.189.188
 www.matsuri-jujutsukaisen.com Japan 7506 INTERQGMOInternetIncJP true
38.40.235.204
 www.stephenplattassociatesllp.com United States
174 COGENT-174US true
154.205.127.201
 www.iqixuehe.com Seychelles
8100 ASN-QUADRANET-GLOBALUS true
104.21.41.165
 www.homerevamps.today United States
13335 CLOUDFLARENETUS true
76.223.105.230
 globalentertainmentservices.com United States
16509 AMAZON-02US true
192.185.16.134
 iontrapper.science United States
46606 UNIFIEDLAYER-AS-1US true
15.197.142.173
 2816goldfinch.com United States
7430 TANDEMUS true
103.224.182.242
 www.antojitoslosramos.com Australia
133618 TRELLIAN-AS-APTrellianPtyLimitedAU true
3.33.130.190
 imaswe.com United States
8987 AMAZONEXPANSIONGB true
212.32.237.91
 www.julieslive.com Netherlands
60781 LEASEWEB-NL-AMS-01NetherlandsNL true

Contacted Domains

Name IP Active
imaswe.com 3.33.130.190 true
www.julieslive.com 212.32.237.91 true
globalentertainmentservices.com 76.223.105.230 true
www.stephenplattassociatesllp.com 38.40.235.204 true
www.antojitoslosramos.com 103.224.182.242 true
www.homerevamps.today 104.21.41.165 true
www.matsuri-jujutsukaisen.com 157.7.189.188 true
2816goldfinch.com 15.197.142.173 true
iontrapper.science 192.185.16.134 true
www.iqixuehe.com 154.205.127.201 true
www.2816goldfinch.com unknown unknown
www.sactribune.com unknown unknown
www.globalentertainmentservices.com unknown unknown
www.iontrapper.science unknown unknown
www.imaswe.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.iqixuehe.com/4hc5/ true
  • 9%, Virustotal, Browse
  • Avira URL Cloud: malware
 low
http://www.2816goldfinch.com/4hc5/?ARM8mN=1aQlJJA0XtSA3mmPcz3A13DQhChCZAjZwmZYbKxz88FxQriiwRvfB7iHnJRBFH94mXqC&nfoHn6=xDKpFX0P8 true
  • Avira URL Cloud: malware
 unknown
http://www.julieslive.com/4hc5/?ARM8mN=oyFmEHyfTjUFImcLYldylGTimAAEF1CG98xLBQUzn/97OM/48Y/NyPeznbFeR5DjKoMz&nfoHn6=xDKpFX0P8 true
  • Avira URL Cloud: malware
 unknown
http://www.iontrapper.science/4hc5/?ARM8mN=anSewvd4RB15/Bbq0PKQ9CBaazFnJ723ies3SR522J7OLerssEDA72NPyiW98AhHjTDe&nfoHn6=xDKpFX0P8 true
  • Avira URL Cloud: malware
 unknown
http://www.matsuri-jujutsukaisen.com/4hc5/?ARM8mN=QzbL5KXRbKAn2qkAmOj6cUMG12wY2mkeNCi6fYLCIi0wzcLrwY7G+/MD00/L/j10LFBF&nfoHn6=xDKpFX0P8 true
  • Avira URL Cloud: malware
 unknown
http://www.globalentertainmentservices.com/4hc5/?ARM8mN=fBqdMXc91lnTomnLD+II/MBRUNcxF/X1uRKxmlget9lW8kZY8SYfqQNU/JuXLA7WRFKv&nfoHn6=xDKpFX0P8 true
  • Avira URL Cloud: phishing
 unknown
http://www.imaswe.com/4hc5/?ARM8mN=vlz2CAMCo7G9+MeAGV2KInJ+l3tequa9ECvl/VWp7SXyOAinvo6JEsIxN9n7GF2bKDoH&nfoHn6=xDKpFX0P8 true
  • Avira URL Cloud: malware
 unknown
http://www.stephenplattassociatesllp.com/4hc5/?ARM8mN=UayKmV7d8gxWLYhx25JZE6Fwij3S6NgIDFBzj66KTbt8rYl3HB5oHx/yC8JK7pNZTHHf&nfoHn6=xDKpFX0P8 true
  • Avira URL Cloud: malware
 unknown
http://www.homerevamps.today/4hc5/?ARM8mN=XvAjDK/lhDkYJBq/DY1aj1JXLrWARnjVE4JkqE+/y0dCq4m85zPkIeeB+wmBcyRTe10M&nfoHn6=xDKpFX0P8 true
  • Avira URL Cloud: malware
 unknown
http://www.antojitoslosramos.com/4hc5/?ARM8mN=gdd1QC7Pol5AM6dzWjWj4dPVX3Rx3HE4ioGGFOABGmsVBvyBlq2R0xZfHtXYLxE7PIxr&nfoHn6=xDKpFX0P8 true
  • Avira URL Cloud: malware
 unknown