Windows Analysis Report
VzJM9stirU.exe

AV Detection

Source: VzJM9stirU.exe

Avira: detected

Source: VzJM9stirU.exe

ReversingLabs: Detection: 60%

Source: Yara match	File source: 0.2.VzJM9stirU.exe.e50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2463684553.0000000001520000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2463423251.0000000000E51000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: VzJM9stirU.exe

Joe Sandbox ML: detected

Compliance

Source: VzJM9stirU.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: VzJM9stirU.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: wntdll.pdbUGP source: VzJM9stirU.exe, 00000000.00000003.2136143179.0000000001852000.00000004.00000020.00020000.00000000.sdmp, VzJM9stirU.exe, 00000000.00000002.2463882910.0000000001B9E000.00000040.00001000.00020000.00000000.sdmp, VzJM9stirU.exe, 00000000.00000002.2463882910.0000000001A00000.00000040.00001000.00020000.00000000.sdmp, VzJM9stirU.exe, 00000000.00000003.2134026601.00000000016AC000.00000004.00000020.00020000.00000000.sdmp

Source:

Binary string: wntdll.pdb source: VzJM9stirU.exe, VzJM9stirU.exe, 00000000.00000003.2136143179.0000000001852000.00000004.00000020.00020000.00000000.sdmp, VzJM9stirU.exe, 00000000.00000002.2463882910.0000000001B9E000.00000040.00001000.00020000.00000000.sdmp, VzJM9stirU.exe, 00000000.00000002.2463882910.0000000001A00000.00000040.00001000.00020000.00000000.sdmp, VzJM9stirU.exe, 00000000.00000003.2134026601.00000000016AC000.00000004.00000020.00020000.00000000.sdmp

E-Banking Fraud

Source: Yara match	File source: 0.2.VzJM9stirU.exe.e50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2463684553.0000000001520000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2463423251.0000000000E51000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

System Summary

Source: 0.2.VzJM9stirU.exe.e50000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.2463684553.0000000001520000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.2463423251.0000000000E51000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E7C283 NtClose,		0_2_00E7C283
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E51A40 NtProtectVirtualMemory,NtProtectVirtualMemory,		0_2_00E51A40
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72B60 NtClose,LdrInitializeThunk,		0_2_01A72B60
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72DF0 NtQuerySystemInformation,LdrInitializeThunk,		0_2_01A72DF0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72C70 NtFreeVirtualMemory,LdrInitializeThunk,		0_2_01A72C70
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A735C0 NtCreateMutant,LdrInitializeThunk,		0_2_01A735C0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A74340 NtSetContextThread,		0_2_01A74340
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A74650 NtSuspendThread,		0_2_01A74650
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72BA0 NtEnumerateValueKey,		0_2_01A72BA0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72B80 NtQueryInformationFile,		0_2_01A72B80
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72BE0 NtQueryValueKey,		0_2_01A72BE0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72BF0 NtAllocateVirtualMemory,		0_2_01A72BF0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72AB0 NtWaitForSingleObject,		0_2_01A72AB0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72AF0 NtWriteFile,		0_2_01A72AF0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72AD0 NtReadFile,		0_2_01A72AD0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72DB0 NtEnumerateKey,		0_2_01A72DB0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72DD0 NtDelayExecution,		0_2_01A72DD0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72D30 NtUnmapViewOfSection,		0_2_01A72D30
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72D00 NtSetInformationFile,		0_2_01A72D00
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72D10 NtMapViewOfSection,		0_2_01A72D10
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72CA0 NtQueryInformationToken,		0_2_01A72CA0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72CF0 NtOpenProcess,		0_2_01A72CF0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72CC0 NtQueryVirtualMemory,		0_2_01A72CC0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72C00 NtQueryInformationProcess,		0_2_01A72C00
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72C60 NtCreateKey,		0_2_01A72C60
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72FA0 NtQuerySection,		0_2_01A72FA0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72FB0 NtResumeThread,		0_2_01A72FB0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72F90 NtProtectVirtualMemory,		0_2_01A72F90
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72FE0 NtCreateFile,		0_2_01A72FE0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72F30 NtCreateSection,		0_2_01A72F30
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72F60 NtCreateProcessEx,		0_2_01A72F60
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72EA0 NtAdjustPrivilegesToken,		0_2_01A72EA0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72E80 NtReadVirtualMemory,		0_2_01A72E80
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72EE0 NtQueueApcThread,		0_2_01A72EE0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72E30 NtWriteVirtualMemory,		0_2_01A72E30
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A73090 NtSetValueKey,		0_2_01A73090
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A73010 NtOpenDirectoryObject,		0_2_01A73010
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A739B0 NtGetContextThread,		0_2_01A739B0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A73D10 NtOpenProcessToken,		0_2_01A73D10
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A73D70 NtOpenThread,		0_2_01A73D70

Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E7E8E3		0_2_00E7E8E3
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E51260		0_2_00E51260
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E5FA41		0_2_00E5FA41
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E5FA43		0_2_00E5FA43
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E663EE		0_2_00E663EE
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E663F3		0_2_00E663F3
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E523D0		0_2_00E523D0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E514E0		0_2_00E514E0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E5DCE3		0_2_00E5DCE3
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E5FC63		0_2_00E5FC63
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E52F50		0_2_00E52F50
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E52730		0_2_00E52730
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AF41A2		0_2_01AF41A2
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B001AA		0_2_01B001AA
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AF81CC		0_2_01AF81CC
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A30100		0_2_01A30100
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADA118		0_2_01ADA118
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC8158		0_2_01AC8158
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD2000		0_2_01AD2000
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A4E3F0		0_2_01A4E3F0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B003E6		0_2_01B003E6
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AFA352		0_2_01AFA352
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC02C0		0_2_01AC02C0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE0274		0_2_01AE0274
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B00591		0_2_01B00591
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40535		0_2_01A40535
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AEE4F6		0_2_01AEE4F6
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE4420		0_2_01AE4420
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AF2446		0_2_01AF2446
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3C7C0		0_2_01A3C7C0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40770		0_2_01A40770
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A64750		0_2_01A64750
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5C6E0		0_2_01A5C6E0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A429A0		0_2_01A429A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B0A9A6		0_2_01B0A9A6
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A56962		0_2_01A56962
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A268B8		0_2_01A268B8
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6E8F0		0_2_01A6E8F0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A4A840		0_2_01A4A840
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A42840		0_2_01A42840
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AF6BD7		0_2_01AF6BD7
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AFAB40		0_2_01AFAB40
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3EA80		0_2_01A3EA80
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A58DBF		0_2_01A58DBF
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3ADE0		0_2_01A3ADE0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A4AD00		0_2_01A4AD00
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADCD1F		0_2_01ADCD1F
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE0CB5		0_2_01AE0CB5
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A30CF2		0_2_01A30CF2
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40C00		0_2_01A40C00
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ABEFA0		0_2_01ABEFA0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A4CFE0		0_2_01A4CFE0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A32FC8		0_2_01A32FC8
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A82F28		0_2_01A82F28
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A60F30		0_2_01A60F30
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE2F30		0_2_01AE2F30
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB4F40		0_2_01AB4F40
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A52E90		0_2_01A52E90
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AFCE93		0_2_01AFCE93
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AFEEDB		0_2_01AFEEDB
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AFEE26		0_2_01AFEE26
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40E59		0_2_01A40E59
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A4B1B0		0_2_01A4B1B0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A7516C		0_2_01A7516C
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2F172		0_2_01A2F172
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B0B16B		0_2_01B0B16B
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AF70E9		0_2_01AF70E9
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AFF0E0		0_2_01AFF0E0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AEF0CC		0_2_01AEF0CC
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A470C0		0_2_01A470C0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A8739A		0_2_01A8739A
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AF132D		0_2_01AF132D
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2D34C		0_2_01A2D34C
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A452A0		0_2_01A452A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE12ED		0_2_01AE12ED
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5B2C0		0_2_01A5B2C0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADD5B0		0_2_01ADD5B0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B095C3		0_2_01B095C3
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AF7571		0_2_01AF7571
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AFF43F		0_2_01AFF43F
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A31460		0_2_01A31460
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AFF7B0		0_2_01AFF7B0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AF16CC		0_2_01AF16CC
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A85630		0_2_01A85630
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD5910		0_2_01AD5910
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A49950		0_2_01A49950
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5B950		0_2_01A5B950
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A438E0		0_2_01A438E0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAD800		0_2_01AAD800
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5FB80		0_2_01A5FB80
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB5BF0		0_2_01AB5BF0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A7DBF9		0_2_01A7DBF9
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AFFB76		0_2_01AFFB76
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADDAAC		0_2_01ADDAAC
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A85AA0		0_2_01A85AA0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE1AA3		0_2_01AE1AA3
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AEDAC6		0_2_01AEDAC6
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB3A6C		0_2_01AB3A6C
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AFFA49		0_2_01AFFA49
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AF7A46		0_2_01AF7A46
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5FDC0		0_2_01A5FDC0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AF7D73		0_2_01AF7D73
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A43D40		0_2_01A43D40
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AF1D5A		0_2_01AF1D5A
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AFFCF2		0_2_01AFFCF2
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB9C32		0_2_01AB9C32
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AFFFB1		0_2_01AFFFB1
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A41F92		0_2_01A41F92
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A03FD2		0_2_01A03FD2
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A03FD5		0_2_01A03FD5
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AFFF09		0_2_01AFFF09
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A49EB0		0_2_01A49EB0

Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: String function: 01A75130 appears 58 times
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: String function: 01A87E54 appears 111 times
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: String function: 01A2B970 appears 280 times
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: String function: 01ABF290 appears 105 times
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: String function: 01AAEA12 appears 86 times

Source: VzJM9stirU.exe

Static PE information: No import functions for PE file found

Source: VzJM9stirU.exe, 00000000.00000002.2463882910.0000000001CD1000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs VzJM9stirU.exe
Source: VzJM9stirU.exe, 00000000.00000003.2136143179.000000000197F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs VzJM9stirU.exe
Source: VzJM9stirU.exe, 00000000.00000003.2134026601.00000000017CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs VzJM9stirU.exe

Source: VzJM9stirU.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.VzJM9stirU.exe.e50000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.2463684553.0000000001520000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.2463423251.0000000000E51000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: VzJM9stirU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: VzJM9stirU.exe

Static PE information: Section .text

Source: classification engine

Classification label: mal80.troj.winEXE@1/0@0/0

Source: VzJM9stirU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\VzJM9stirU.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: VzJM9stirU.exe

ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\VzJM9stirU.exe

Section loaded: apphelp.dll

Jump to behavior

Source: VzJM9stirU.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: wntdll.pdbUGP source: VzJM9stirU.exe, 00000000.00000003.2136143179.0000000001852000.00000004.00000020.00020000.00000000.sdmp, VzJM9stirU.exe, 00000000.00000002.2463882910.0000000001B9E000.00000040.00001000.00020000.00000000.sdmp, VzJM9stirU.exe, 00000000.00000002.2463882910.0000000001A00000.00000040.00001000.00020000.00000000.sdmp, VzJM9stirU.exe, 00000000.00000003.2134026601.00000000016AC000.00000004.00000020.00020000.00000000.sdmp

Source:

Binary string: wntdll.pdb source: VzJM9stirU.exe, VzJM9stirU.exe, 00000000.00000003.2136143179.0000000001852000.00000004.00000020.00020000.00000000.sdmp, VzJM9stirU.exe, 00000000.00000002.2463882910.0000000001B9E000.00000040.00001000.00020000.00000000.sdmp, VzJM9stirU.exe, 00000000.00000002.2463882910.0000000001A00000.00000040.00001000.00020000.00000000.sdmp, VzJM9stirU.exe, 00000000.00000003.2134026601.00000000016AC000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E6A87D push esp; retf		0_2_00E6A87E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E531D0 push eax; ret		0_2_00E531D2
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E73923 push esi; retf		0_2_00E7392E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E5710D pushfd ; retf		0_2_00E5710E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E73916 push esi; retf		0_2_00E7392E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E643E3 push edi; iretd		0_2_00E643EF
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E6A3C1 push edi; retf		0_2_00E6A3C7
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E68B76 push ebx; retf		0_2_00E68B77
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E73B35 push cs; retf		0_2_00E73B36
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E73C2F push C67CA722h; ret		0_2_00E73C34
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E61DA3 push edi; iretd		0_2_00E61DAF
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E747A8 push edi; ret		0_2_00E747AC
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_00E74700 push ecx; retf		0_2_00E74749
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A0225F pushad ; ret		0_2_01A027F9
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A027FA pushad ; ret		0_2_01A027F9
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A309AD push ecx; mov dword ptr [esp], ecx		0_2_01A309B6
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A0283D push eax; iretd		0_2_01A02858
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A01366 push eax; iretd		0_2_01A01369

Source: VzJM9stirU.exe

Static PE information: section name: .text entropy: 7.996363503608476

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\VzJM9stirU.exe

Code function: 0_2_01A7096E rdtsc

0_2_01A7096E

Source: C:\Users\user\Desktop\VzJM9stirU.exe

API coverage: 0.7 %

Source: C:\Users\user\Desktop\VzJM9stirU.exe TID: 2472

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\VzJM9stirU.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Source: C:\Users\user\Desktop\VzJM9stirU.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\VzJM9stirU.exe

Code function: 0_2_01A7096E rdtsc

0_2_01A7096E

Source: C:\Users\user\Desktop\VzJM9stirU.exe

Code function: 0_2_00E673A3 LdrLoadDll,

0_2_00E673A3

Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A70185 mov eax, dword ptr fs:[00000030h]		0_2_01A70185
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AEC188 mov eax, dword ptr fs:[00000030h]		0_2_01AEC188
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AEC188 mov eax, dword ptr fs:[00000030h]		0_2_01AEC188
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD4180 mov eax, dword ptr fs:[00000030h]		0_2_01AD4180
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD4180 mov eax, dword ptr fs:[00000030h]		0_2_01AD4180
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB019F mov eax, dword ptr fs:[00000030h]		0_2_01AB019F
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB019F mov eax, dword ptr fs:[00000030h]		0_2_01AB019F
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB019F mov eax, dword ptr fs:[00000030h]		0_2_01AB019F
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB019F mov eax, dword ptr fs:[00000030h]		0_2_01AB019F
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2A197 mov eax, dword ptr fs:[00000030h]		0_2_01A2A197
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2A197 mov eax, dword ptr fs:[00000030h]		0_2_01A2A197
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2A197 mov eax, dword ptr fs:[00000030h]		0_2_01A2A197
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B061E5 mov eax, dword ptr fs:[00000030h]		0_2_01B061E5
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A601F8 mov eax, dword ptr fs:[00000030h]		0_2_01A601F8
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AF61C3 mov eax, dword ptr fs:[00000030h]		0_2_01AF61C3
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AF61C3 mov eax, dword ptr fs:[00000030h]		0_2_01AF61C3
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAE1D0 mov eax, dword ptr fs:[00000030h]		0_2_01AAE1D0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAE1D0 mov eax, dword ptr fs:[00000030h]		0_2_01AAE1D0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAE1D0 mov ecx, dword ptr fs:[00000030h]		0_2_01AAE1D0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAE1D0 mov eax, dword ptr fs:[00000030h]		0_2_01AAE1D0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAE1D0 mov eax, dword ptr fs:[00000030h]		0_2_01AAE1D0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A60124 mov eax, dword ptr fs:[00000030h]		0_2_01A60124
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADE10E mov eax, dword ptr fs:[00000030h]		0_2_01ADE10E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADE10E mov ecx, dword ptr fs:[00000030h]		0_2_01ADE10E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADE10E mov eax, dword ptr fs:[00000030h]		0_2_01ADE10E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADE10E mov eax, dword ptr fs:[00000030h]		0_2_01ADE10E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADE10E mov ecx, dword ptr fs:[00000030h]		0_2_01ADE10E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADE10E mov eax, dword ptr fs:[00000030h]		0_2_01ADE10E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADE10E mov eax, dword ptr fs:[00000030h]		0_2_01ADE10E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADE10E mov ecx, dword ptr fs:[00000030h]		0_2_01ADE10E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADE10E mov eax, dword ptr fs:[00000030h]		0_2_01ADE10E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADE10E mov ecx, dword ptr fs:[00000030h]		0_2_01ADE10E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADA118 mov ecx, dword ptr fs:[00000030h]		0_2_01ADA118
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADA118 mov eax, dword ptr fs:[00000030h]		0_2_01ADA118
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADA118 mov eax, dword ptr fs:[00000030h]		0_2_01ADA118
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADA118 mov eax, dword ptr fs:[00000030h]		0_2_01ADA118
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AF0115 mov eax, dword ptr fs:[00000030h]		0_2_01AF0115
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B04164 mov eax, dword ptr fs:[00000030h]		0_2_01B04164
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B04164 mov eax, dword ptr fs:[00000030h]		0_2_01B04164
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC4144 mov eax, dword ptr fs:[00000030h]		0_2_01AC4144
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC4144 mov eax, dword ptr fs:[00000030h]		0_2_01AC4144
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC4144 mov ecx, dword ptr fs:[00000030h]		0_2_01AC4144
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC4144 mov eax, dword ptr fs:[00000030h]		0_2_01AC4144
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC4144 mov eax, dword ptr fs:[00000030h]		0_2_01AC4144
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2C156 mov eax, dword ptr fs:[00000030h]		0_2_01A2C156
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC8158 mov eax, dword ptr fs:[00000030h]		0_2_01AC8158
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A36154 mov eax, dword ptr fs:[00000030h]		0_2_01A36154
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A36154 mov eax, dword ptr fs:[00000030h]		0_2_01A36154
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A280A0 mov eax, dword ptr fs:[00000030h]		0_2_01A280A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC80A8 mov eax, dword ptr fs:[00000030h]		0_2_01AC80A8
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AF60B8 mov eax, dword ptr fs:[00000030h]		0_2_01AF60B8
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AF60B8 mov ecx, dword ptr fs:[00000030h]		0_2_01AF60B8
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3208A mov eax, dword ptr fs:[00000030h]		0_2_01A3208A
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2A0E3 mov ecx, dword ptr fs:[00000030h]		0_2_01A2A0E3
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A380E9 mov eax, dword ptr fs:[00000030h]		0_2_01A380E9
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB60E0 mov eax, dword ptr fs:[00000030h]		0_2_01AB60E0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2C0F0 mov eax, dword ptr fs:[00000030h]		0_2_01A2C0F0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A720F0 mov ecx, dword ptr fs:[00000030h]		0_2_01A720F0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB20DE mov eax, dword ptr fs:[00000030h]		0_2_01AB20DE
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2A020 mov eax, dword ptr fs:[00000030h]		0_2_01A2A020
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2C020 mov eax, dword ptr fs:[00000030h]		0_2_01A2C020
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC6030 mov eax, dword ptr fs:[00000030h]		0_2_01AC6030
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB4000 mov ecx, dword ptr fs:[00000030h]		0_2_01AB4000
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD2000 mov eax, dword ptr fs:[00000030h]		0_2_01AD2000
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD2000 mov eax, dword ptr fs:[00000030h]		0_2_01AD2000
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD2000 mov eax, dword ptr fs:[00000030h]		0_2_01AD2000
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD2000 mov eax, dword ptr fs:[00000030h]		0_2_01AD2000
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD2000 mov eax, dword ptr fs:[00000030h]		0_2_01AD2000
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD2000 mov eax, dword ptr fs:[00000030h]		0_2_01AD2000
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD2000 mov eax, dword ptr fs:[00000030h]		0_2_01AD2000
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD2000 mov eax, dword ptr fs:[00000030h]		0_2_01AD2000
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A4E016 mov eax, dword ptr fs:[00000030h]		0_2_01A4E016
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A4E016 mov eax, dword ptr fs:[00000030h]		0_2_01A4E016
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A4E016 mov eax, dword ptr fs:[00000030h]		0_2_01A4E016
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A4E016 mov eax, dword ptr fs:[00000030h]		0_2_01A4E016
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5C073 mov eax, dword ptr fs:[00000030h]		0_2_01A5C073
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A32050 mov eax, dword ptr fs:[00000030h]		0_2_01A32050
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB6050 mov eax, dword ptr fs:[00000030h]		0_2_01AB6050
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2E388 mov eax, dword ptr fs:[00000030h]		0_2_01A2E388
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2E388 mov eax, dword ptr fs:[00000030h]		0_2_01A2E388
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2E388 mov eax, dword ptr fs:[00000030h]		0_2_01A2E388
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5438F mov eax, dword ptr fs:[00000030h]		0_2_01A5438F
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5438F mov eax, dword ptr fs:[00000030h]		0_2_01A5438F
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A28397 mov eax, dword ptr fs:[00000030h]		0_2_01A28397
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A28397 mov eax, dword ptr fs:[00000030h]		0_2_01A28397
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A28397 mov eax, dword ptr fs:[00000030h]		0_2_01A28397
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A403E9 mov eax, dword ptr fs:[00000030h]		0_2_01A403E9
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A403E9 mov eax, dword ptr fs:[00000030h]		0_2_01A403E9
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A403E9 mov eax, dword ptr fs:[00000030h]		0_2_01A403E9
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A403E9 mov eax, dword ptr fs:[00000030h]		0_2_01A403E9
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A403E9 mov eax, dword ptr fs:[00000030h]		0_2_01A403E9
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A403E9 mov eax, dword ptr fs:[00000030h]		0_2_01A403E9
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A403E9 mov eax, dword ptr fs:[00000030h]		0_2_01A403E9
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A403E9 mov eax, dword ptr fs:[00000030h]		0_2_01A403E9
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A4E3F0 mov eax, dword ptr fs:[00000030h]		0_2_01A4E3F0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A4E3F0 mov eax, dword ptr fs:[00000030h]		0_2_01A4E3F0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A4E3F0 mov eax, dword ptr fs:[00000030h]		0_2_01A4E3F0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A663FF mov eax, dword ptr fs:[00000030h]		0_2_01A663FF
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AEC3CD mov eax, dword ptr fs:[00000030h]		0_2_01AEC3CD
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3A3C0 mov eax, dword ptr fs:[00000030h]		0_2_01A3A3C0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3A3C0 mov eax, dword ptr fs:[00000030h]		0_2_01A3A3C0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3A3C0 mov eax, dword ptr fs:[00000030h]		0_2_01A3A3C0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3A3C0 mov eax, dword ptr fs:[00000030h]		0_2_01A3A3C0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3A3C0 mov eax, dword ptr fs:[00000030h]		0_2_01A3A3C0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3A3C0 mov eax, dword ptr fs:[00000030h]		0_2_01A3A3C0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A383C0 mov eax, dword ptr fs:[00000030h]		0_2_01A383C0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A383C0 mov eax, dword ptr fs:[00000030h]		0_2_01A383C0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A383C0 mov eax, dword ptr fs:[00000030h]		0_2_01A383C0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A383C0 mov eax, dword ptr fs:[00000030h]		0_2_01A383C0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB63C0 mov eax, dword ptr fs:[00000030h]		0_2_01AB63C0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADE3DB mov eax, dword ptr fs:[00000030h]		0_2_01ADE3DB
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADE3DB mov eax, dword ptr fs:[00000030h]		0_2_01ADE3DB
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADE3DB mov ecx, dword ptr fs:[00000030h]		0_2_01ADE3DB
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADE3DB mov eax, dword ptr fs:[00000030h]		0_2_01ADE3DB
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD43D4 mov eax, dword ptr fs:[00000030h]		0_2_01AD43D4
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD43D4 mov eax, dword ptr fs:[00000030h]		0_2_01AD43D4
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B08324 mov eax, dword ptr fs:[00000030h]		0_2_01B08324
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B08324 mov ecx, dword ptr fs:[00000030h]		0_2_01B08324
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B08324 mov eax, dword ptr fs:[00000030h]		0_2_01B08324
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B08324 mov eax, dword ptr fs:[00000030h]		0_2_01B08324
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6A30B mov eax, dword ptr fs:[00000030h]		0_2_01A6A30B
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6A30B mov eax, dword ptr fs:[00000030h]		0_2_01A6A30B
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6A30B mov eax, dword ptr fs:[00000030h]		0_2_01A6A30B
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2C310 mov ecx, dword ptr fs:[00000030h]		0_2_01A2C310
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A50310 mov ecx, dword ptr fs:[00000030h]		0_2_01A50310
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD437C mov eax, dword ptr fs:[00000030h]		0_2_01AD437C
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB2349 mov eax, dword ptr fs:[00000030h]		0_2_01AB2349
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB2349 mov eax, dword ptr fs:[00000030h]		0_2_01AB2349
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB2349 mov eax, dword ptr fs:[00000030h]		0_2_01AB2349
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB2349 mov eax, dword ptr fs:[00000030h]		0_2_01AB2349
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB2349 mov eax, dword ptr fs:[00000030h]		0_2_01AB2349
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB2349 mov eax, dword ptr fs:[00000030h]		0_2_01AB2349
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB2349 mov eax, dword ptr fs:[00000030h]		0_2_01AB2349
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB2349 mov eax, dword ptr fs:[00000030h]		0_2_01AB2349
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB2349 mov eax, dword ptr fs:[00000030h]		0_2_01AB2349
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB2349 mov eax, dword ptr fs:[00000030h]		0_2_01AB2349
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB2349 mov eax, dword ptr fs:[00000030h]		0_2_01AB2349
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB2349 mov eax, dword ptr fs:[00000030h]		0_2_01AB2349
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB2349 mov eax, dword ptr fs:[00000030h]		0_2_01AB2349
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB2349 mov eax, dword ptr fs:[00000030h]		0_2_01AB2349
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB2349 mov eax, dword ptr fs:[00000030h]		0_2_01AB2349
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB035C mov eax, dword ptr fs:[00000030h]		0_2_01AB035C
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB035C mov eax, dword ptr fs:[00000030h]		0_2_01AB035C
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB035C mov eax, dword ptr fs:[00000030h]		0_2_01AB035C
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB035C mov ecx, dword ptr fs:[00000030h]		0_2_01AB035C
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB035C mov eax, dword ptr fs:[00000030h]		0_2_01AB035C
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB035C mov eax, dword ptr fs:[00000030h]		0_2_01AB035C
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AFA352 mov eax, dword ptr fs:[00000030h]		0_2_01AFA352
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD8350 mov ecx, dword ptr fs:[00000030h]		0_2_01AD8350
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B0634F mov eax, dword ptr fs:[00000030h]		0_2_01B0634F
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A402A0 mov eax, dword ptr fs:[00000030h]		0_2_01A402A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A402A0 mov eax, dword ptr fs:[00000030h]		0_2_01A402A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC62A0 mov eax, dword ptr fs:[00000030h]		0_2_01AC62A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC62A0 mov ecx, dword ptr fs:[00000030h]		0_2_01AC62A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC62A0 mov eax, dword ptr fs:[00000030h]		0_2_01AC62A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC62A0 mov eax, dword ptr fs:[00000030h]		0_2_01AC62A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC62A0 mov eax, dword ptr fs:[00000030h]		0_2_01AC62A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC62A0 mov eax, dword ptr fs:[00000030h]		0_2_01AC62A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6E284 mov eax, dword ptr fs:[00000030h]		0_2_01A6E284
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6E284 mov eax, dword ptr fs:[00000030h]		0_2_01A6E284
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB0283 mov eax, dword ptr fs:[00000030h]		0_2_01AB0283
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB0283 mov eax, dword ptr fs:[00000030h]		0_2_01AB0283
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB0283 mov eax, dword ptr fs:[00000030h]		0_2_01AB0283
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A402E1 mov eax, dword ptr fs:[00000030h]		0_2_01A402E1
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A402E1 mov eax, dword ptr fs:[00000030h]		0_2_01A402E1
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A402E1 mov eax, dword ptr fs:[00000030h]		0_2_01A402E1
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3A2C3 mov eax, dword ptr fs:[00000030h]		0_2_01A3A2C3
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3A2C3 mov eax, dword ptr fs:[00000030h]		0_2_01A3A2C3
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3A2C3 mov eax, dword ptr fs:[00000030h]		0_2_01A3A2C3
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3A2C3 mov eax, dword ptr fs:[00000030h]		0_2_01A3A2C3
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3A2C3 mov eax, dword ptr fs:[00000030h]		0_2_01A3A2C3
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B062D6 mov eax, dword ptr fs:[00000030h]		0_2_01B062D6
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2823B mov eax, dword ptr fs:[00000030h]		0_2_01A2823B
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A34260 mov eax, dword ptr fs:[00000030h]		0_2_01A34260
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A34260 mov eax, dword ptr fs:[00000030h]		0_2_01A34260
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A34260 mov eax, dword ptr fs:[00000030h]		0_2_01A34260
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2826B mov eax, dword ptr fs:[00000030h]		0_2_01A2826B
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE0274 mov eax, dword ptr fs:[00000030h]		0_2_01AE0274
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE0274 mov eax, dword ptr fs:[00000030h]		0_2_01AE0274
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE0274 mov eax, dword ptr fs:[00000030h]		0_2_01AE0274
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE0274 mov eax, dword ptr fs:[00000030h]		0_2_01AE0274
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE0274 mov eax, dword ptr fs:[00000030h]		0_2_01AE0274
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE0274 mov eax, dword ptr fs:[00000030h]		0_2_01AE0274
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE0274 mov eax, dword ptr fs:[00000030h]		0_2_01AE0274
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE0274 mov eax, dword ptr fs:[00000030h]		0_2_01AE0274
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE0274 mov eax, dword ptr fs:[00000030h]		0_2_01AE0274
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE0274 mov eax, dword ptr fs:[00000030h]		0_2_01AE0274
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE0274 mov eax, dword ptr fs:[00000030h]		0_2_01AE0274
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE0274 mov eax, dword ptr fs:[00000030h]		0_2_01AE0274
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB8243 mov eax, dword ptr fs:[00000030h]		0_2_01AB8243
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB8243 mov ecx, dword ptr fs:[00000030h]		0_2_01AB8243
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B0625D mov eax, dword ptr fs:[00000030h]		0_2_01B0625D
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2A250 mov eax, dword ptr fs:[00000030h]		0_2_01A2A250
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A36259 mov eax, dword ptr fs:[00000030h]		0_2_01A36259
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AEA250 mov eax, dword ptr fs:[00000030h]		0_2_01AEA250
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AEA250 mov eax, dword ptr fs:[00000030h]		0_2_01AEA250
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB05A7 mov eax, dword ptr fs:[00000030h]		0_2_01AB05A7
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB05A7 mov eax, dword ptr fs:[00000030h]		0_2_01AB05A7
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB05A7 mov eax, dword ptr fs:[00000030h]		0_2_01AB05A7
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A545B1 mov eax, dword ptr fs:[00000030h]		0_2_01A545B1
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A545B1 mov eax, dword ptr fs:[00000030h]		0_2_01A545B1
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A32582 mov eax, dword ptr fs:[00000030h]		0_2_01A32582
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A32582 mov ecx, dword ptr fs:[00000030h]		0_2_01A32582
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A64588 mov eax, dword ptr fs:[00000030h]		0_2_01A64588
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6E59C mov eax, dword ptr fs:[00000030h]		0_2_01A6E59C
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5E5E7 mov eax, dword ptr fs:[00000030h]		0_2_01A5E5E7
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5E5E7 mov eax, dword ptr fs:[00000030h]		0_2_01A5E5E7
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5E5E7 mov eax, dword ptr fs:[00000030h]		0_2_01A5E5E7
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5E5E7 mov eax, dword ptr fs:[00000030h]		0_2_01A5E5E7
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5E5E7 mov eax, dword ptr fs:[00000030h]		0_2_01A5E5E7
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5E5E7 mov eax, dword ptr fs:[00000030h]		0_2_01A5E5E7
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5E5E7 mov eax, dword ptr fs:[00000030h]		0_2_01A5E5E7
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5E5E7 mov eax, dword ptr fs:[00000030h]		0_2_01A5E5E7
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A325E0 mov eax, dword ptr fs:[00000030h]		0_2_01A325E0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6C5ED mov eax, dword ptr fs:[00000030h]		0_2_01A6C5ED
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6C5ED mov eax, dword ptr fs:[00000030h]		0_2_01A6C5ED
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6E5CF mov eax, dword ptr fs:[00000030h]		0_2_01A6E5CF
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6E5CF mov eax, dword ptr fs:[00000030h]		0_2_01A6E5CF
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A365D0 mov eax, dword ptr fs:[00000030h]		0_2_01A365D0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6A5D0 mov eax, dword ptr fs:[00000030h]		0_2_01A6A5D0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6A5D0 mov eax, dword ptr fs:[00000030h]		0_2_01A6A5D0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40535 mov eax, dword ptr fs:[00000030h]		0_2_01A40535
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40535 mov eax, dword ptr fs:[00000030h]		0_2_01A40535
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40535 mov eax, dword ptr fs:[00000030h]		0_2_01A40535
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40535 mov eax, dword ptr fs:[00000030h]		0_2_01A40535
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40535 mov eax, dword ptr fs:[00000030h]		0_2_01A40535
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40535 mov eax, dword ptr fs:[00000030h]		0_2_01A40535
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5E53E mov eax, dword ptr fs:[00000030h]		0_2_01A5E53E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5E53E mov eax, dword ptr fs:[00000030h]		0_2_01A5E53E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5E53E mov eax, dword ptr fs:[00000030h]		0_2_01A5E53E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5E53E mov eax, dword ptr fs:[00000030h]		0_2_01A5E53E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5E53E mov eax, dword ptr fs:[00000030h]		0_2_01A5E53E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC6500 mov eax, dword ptr fs:[00000030h]		0_2_01AC6500
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B04500 mov eax, dword ptr fs:[00000030h]		0_2_01B04500
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B04500 mov eax, dword ptr fs:[00000030h]		0_2_01B04500
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B04500 mov eax, dword ptr fs:[00000030h]		0_2_01B04500
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B04500 mov eax, dword ptr fs:[00000030h]		0_2_01B04500
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B04500 mov eax, dword ptr fs:[00000030h]		0_2_01B04500
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B04500 mov eax, dword ptr fs:[00000030h]		0_2_01B04500
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B04500 mov eax, dword ptr fs:[00000030h]		0_2_01B04500
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6656A mov eax, dword ptr fs:[00000030h]		0_2_01A6656A
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6656A mov eax, dword ptr fs:[00000030h]		0_2_01A6656A
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6656A mov eax, dword ptr fs:[00000030h]		0_2_01A6656A
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A38550 mov eax, dword ptr fs:[00000030h]		0_2_01A38550
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A38550 mov eax, dword ptr fs:[00000030h]		0_2_01A38550
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A364AB mov eax, dword ptr fs:[00000030h]		0_2_01A364AB
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A644B0 mov ecx, dword ptr fs:[00000030h]		0_2_01A644B0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ABA4B0 mov eax, dword ptr fs:[00000030h]		0_2_01ABA4B0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AEA49A mov eax, dword ptr fs:[00000030h]		0_2_01AEA49A
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A304E5 mov ecx, dword ptr fs:[00000030h]		0_2_01A304E5
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2E420 mov eax, dword ptr fs:[00000030h]		0_2_01A2E420
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2E420 mov eax, dword ptr fs:[00000030h]		0_2_01A2E420
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2E420 mov eax, dword ptr fs:[00000030h]		0_2_01A2E420
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2C427 mov eax, dword ptr fs:[00000030h]		0_2_01A2C427
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB6420 mov eax, dword ptr fs:[00000030h]		0_2_01AB6420
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB6420 mov eax, dword ptr fs:[00000030h]		0_2_01AB6420
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB6420 mov eax, dword ptr fs:[00000030h]		0_2_01AB6420
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB6420 mov eax, dword ptr fs:[00000030h]		0_2_01AB6420
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB6420 mov eax, dword ptr fs:[00000030h]		0_2_01AB6420
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB6420 mov eax, dword ptr fs:[00000030h]		0_2_01AB6420
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB6420 mov eax, dword ptr fs:[00000030h]		0_2_01AB6420
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6A430 mov eax, dword ptr fs:[00000030h]		0_2_01A6A430
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A68402 mov eax, dword ptr fs:[00000030h]		0_2_01A68402
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A68402 mov eax, dword ptr fs:[00000030h]		0_2_01A68402
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A68402 mov eax, dword ptr fs:[00000030h]		0_2_01A68402
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ABC460 mov ecx, dword ptr fs:[00000030h]		0_2_01ABC460
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5A470 mov eax, dword ptr fs:[00000030h]		0_2_01A5A470
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5A470 mov eax, dword ptr fs:[00000030h]		0_2_01A5A470
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5A470 mov eax, dword ptr fs:[00000030h]		0_2_01A5A470
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6E443 mov eax, dword ptr fs:[00000030h]		0_2_01A6E443
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6E443 mov eax, dword ptr fs:[00000030h]		0_2_01A6E443
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6E443 mov eax, dword ptr fs:[00000030h]		0_2_01A6E443
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6E443 mov eax, dword ptr fs:[00000030h]		0_2_01A6E443
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6E443 mov eax, dword ptr fs:[00000030h]		0_2_01A6E443
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6E443 mov eax, dword ptr fs:[00000030h]		0_2_01A6E443
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6E443 mov eax, dword ptr fs:[00000030h]		0_2_01A6E443
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6E443 mov eax, dword ptr fs:[00000030h]		0_2_01A6E443
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AEA456 mov eax, dword ptr fs:[00000030h]		0_2_01AEA456
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2645D mov eax, dword ptr fs:[00000030h]		0_2_01A2645D
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5245A mov eax, dword ptr fs:[00000030h]		0_2_01A5245A
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A307AF mov eax, dword ptr fs:[00000030h]		0_2_01A307AF
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE47A0 mov eax, dword ptr fs:[00000030h]		0_2_01AE47A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD678E mov eax, dword ptr fs:[00000030h]		0_2_01AD678E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A527ED mov eax, dword ptr fs:[00000030h]		0_2_01A527ED
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A527ED mov eax, dword ptr fs:[00000030h]		0_2_01A527ED
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A527ED mov eax, dword ptr fs:[00000030h]		0_2_01A527ED
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ABE7E1 mov eax, dword ptr fs:[00000030h]		0_2_01ABE7E1
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A347FB mov eax, dword ptr fs:[00000030h]		0_2_01A347FB
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A347FB mov eax, dword ptr fs:[00000030h]		0_2_01A347FB
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3C7C0 mov eax, dword ptr fs:[00000030h]		0_2_01A3C7C0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB07C3 mov eax, dword ptr fs:[00000030h]		0_2_01AB07C3
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6C720 mov eax, dword ptr fs:[00000030h]		0_2_01A6C720
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6C720 mov eax, dword ptr fs:[00000030h]		0_2_01A6C720
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6273C mov eax, dword ptr fs:[00000030h]		0_2_01A6273C
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6273C mov ecx, dword ptr fs:[00000030h]		0_2_01A6273C
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6273C mov eax, dword ptr fs:[00000030h]		0_2_01A6273C
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAC730 mov eax, dword ptr fs:[00000030h]		0_2_01AAC730
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6C700 mov eax, dword ptr fs:[00000030h]		0_2_01A6C700
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A30710 mov eax, dword ptr fs:[00000030h]		0_2_01A30710
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A60710 mov eax, dword ptr fs:[00000030h]		0_2_01A60710
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A38770 mov eax, dword ptr fs:[00000030h]		0_2_01A38770
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40770 mov eax, dword ptr fs:[00000030h]		0_2_01A40770
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40770 mov eax, dword ptr fs:[00000030h]		0_2_01A40770
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40770 mov eax, dword ptr fs:[00000030h]		0_2_01A40770
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40770 mov eax, dword ptr fs:[00000030h]		0_2_01A40770
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40770 mov eax, dword ptr fs:[00000030h]		0_2_01A40770
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40770 mov eax, dword ptr fs:[00000030h]		0_2_01A40770
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40770 mov eax, dword ptr fs:[00000030h]		0_2_01A40770
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40770 mov eax, dword ptr fs:[00000030h]		0_2_01A40770
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40770 mov eax, dword ptr fs:[00000030h]		0_2_01A40770
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40770 mov eax, dword ptr fs:[00000030h]		0_2_01A40770
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40770 mov eax, dword ptr fs:[00000030h]		0_2_01A40770
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40770 mov eax, dword ptr fs:[00000030h]		0_2_01A40770
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6674D mov esi, dword ptr fs:[00000030h]		0_2_01A6674D
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6674D mov eax, dword ptr fs:[00000030h]		0_2_01A6674D
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6674D mov eax, dword ptr fs:[00000030h]		0_2_01A6674D
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A30750 mov eax, dword ptr fs:[00000030h]		0_2_01A30750
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ABE75D mov eax, dword ptr fs:[00000030h]		0_2_01ABE75D
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72750 mov eax, dword ptr fs:[00000030h]		0_2_01A72750
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72750 mov eax, dword ptr fs:[00000030h]		0_2_01A72750
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB4755 mov eax, dword ptr fs:[00000030h]		0_2_01AB4755
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6C6A6 mov eax, dword ptr fs:[00000030h]		0_2_01A6C6A6
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A666B0 mov eax, dword ptr fs:[00000030h]		0_2_01A666B0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A34690 mov eax, dword ptr fs:[00000030h]		0_2_01A34690
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A34690 mov eax, dword ptr fs:[00000030h]		0_2_01A34690
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAE6F2 mov eax, dword ptr fs:[00000030h]		0_2_01AAE6F2
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAE6F2 mov eax, dword ptr fs:[00000030h]		0_2_01AAE6F2
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAE6F2 mov eax, dword ptr fs:[00000030h]		0_2_01AAE6F2
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAE6F2 mov eax, dword ptr fs:[00000030h]		0_2_01AAE6F2
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB06F1 mov eax, dword ptr fs:[00000030h]		0_2_01AB06F1
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB06F1 mov eax, dword ptr fs:[00000030h]		0_2_01AB06F1
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6A6C7 mov ebx, dword ptr fs:[00000030h]		0_2_01A6A6C7
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6A6C7 mov eax, dword ptr fs:[00000030h]		0_2_01A6A6C7
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A4E627 mov eax, dword ptr fs:[00000030h]		0_2_01A4E627
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A66620 mov eax, dword ptr fs:[00000030h]		0_2_01A66620
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A68620 mov eax, dword ptr fs:[00000030h]		0_2_01A68620
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3262C mov eax, dword ptr fs:[00000030h]		0_2_01A3262C
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAE609 mov eax, dword ptr fs:[00000030h]		0_2_01AAE609
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A4260B mov eax, dword ptr fs:[00000030h]		0_2_01A4260B
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A4260B mov eax, dword ptr fs:[00000030h]		0_2_01A4260B
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A4260B mov eax, dword ptr fs:[00000030h]		0_2_01A4260B
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A4260B mov eax, dword ptr fs:[00000030h]		0_2_01A4260B
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A4260B mov eax, dword ptr fs:[00000030h]		0_2_01A4260B
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A4260B mov eax, dword ptr fs:[00000030h]		0_2_01A4260B
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A4260B mov eax, dword ptr fs:[00000030h]		0_2_01A4260B
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A72619 mov eax, dword ptr fs:[00000030h]		0_2_01A72619
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AF866E mov eax, dword ptr fs:[00000030h]		0_2_01AF866E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AF866E mov eax, dword ptr fs:[00000030h]		0_2_01AF866E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6A660 mov eax, dword ptr fs:[00000030h]		0_2_01A6A660
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6A660 mov eax, dword ptr fs:[00000030h]		0_2_01A6A660
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A62674 mov eax, dword ptr fs:[00000030h]		0_2_01A62674
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A4C640 mov eax, dword ptr fs:[00000030h]		0_2_01A4C640
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A429A0 mov eax, dword ptr fs:[00000030h]		0_2_01A429A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A429A0 mov eax, dword ptr fs:[00000030h]		0_2_01A429A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A429A0 mov eax, dword ptr fs:[00000030h]		0_2_01A429A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A429A0 mov eax, dword ptr fs:[00000030h]		0_2_01A429A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A429A0 mov eax, dword ptr fs:[00000030h]		0_2_01A429A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A429A0 mov eax, dword ptr fs:[00000030h]		0_2_01A429A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A429A0 mov eax, dword ptr fs:[00000030h]		0_2_01A429A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A429A0 mov eax, dword ptr fs:[00000030h]		0_2_01A429A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A429A0 mov eax, dword ptr fs:[00000030h]		0_2_01A429A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A429A0 mov eax, dword ptr fs:[00000030h]		0_2_01A429A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A429A0 mov eax, dword ptr fs:[00000030h]		0_2_01A429A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A429A0 mov eax, dword ptr fs:[00000030h]		0_2_01A429A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A429A0 mov eax, dword ptr fs:[00000030h]		0_2_01A429A0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A309AD mov eax, dword ptr fs:[00000030h]		0_2_01A309AD
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A309AD mov eax, dword ptr fs:[00000030h]		0_2_01A309AD
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB89B3 mov esi, dword ptr fs:[00000030h]		0_2_01AB89B3
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB89B3 mov eax, dword ptr fs:[00000030h]		0_2_01AB89B3
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB89B3 mov eax, dword ptr fs:[00000030h]		0_2_01AB89B3
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ABE9E0 mov eax, dword ptr fs:[00000030h]		0_2_01ABE9E0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A629F9 mov eax, dword ptr fs:[00000030h]		0_2_01A629F9
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A629F9 mov eax, dword ptr fs:[00000030h]		0_2_01A629F9
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC69C0 mov eax, dword ptr fs:[00000030h]		0_2_01AC69C0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3A9D0 mov eax, dword ptr fs:[00000030h]		0_2_01A3A9D0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3A9D0 mov eax, dword ptr fs:[00000030h]		0_2_01A3A9D0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3A9D0 mov eax, dword ptr fs:[00000030h]		0_2_01A3A9D0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3A9D0 mov eax, dword ptr fs:[00000030h]		0_2_01A3A9D0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3A9D0 mov eax, dword ptr fs:[00000030h]		0_2_01A3A9D0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3A9D0 mov eax, dword ptr fs:[00000030h]		0_2_01A3A9D0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A649D0 mov eax, dword ptr fs:[00000030h]		0_2_01A649D0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AFA9D3 mov eax, dword ptr fs:[00000030h]		0_2_01AFA9D3
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB892A mov eax, dword ptr fs:[00000030h]		0_2_01AB892A
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC892B mov eax, dword ptr fs:[00000030h]		0_2_01AC892B
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAE908 mov eax, dword ptr fs:[00000030h]		0_2_01AAE908
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAE908 mov eax, dword ptr fs:[00000030h]		0_2_01AAE908
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ABC912 mov eax, dword ptr fs:[00000030h]		0_2_01ABC912
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A28918 mov eax, dword ptr fs:[00000030h]		0_2_01A28918
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A28918 mov eax, dword ptr fs:[00000030h]		0_2_01A28918
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A56962 mov eax, dword ptr fs:[00000030h]		0_2_01A56962
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A56962 mov eax, dword ptr fs:[00000030h]		0_2_01A56962
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A56962 mov eax, dword ptr fs:[00000030h]		0_2_01A56962
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A7096E mov eax, dword ptr fs:[00000030h]		0_2_01A7096E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A7096E mov edx, dword ptr fs:[00000030h]		0_2_01A7096E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A7096E mov eax, dword ptr fs:[00000030h]		0_2_01A7096E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD4978 mov eax, dword ptr fs:[00000030h]		0_2_01AD4978
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD4978 mov eax, dword ptr fs:[00000030h]		0_2_01AD4978
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ABC97C mov eax, dword ptr fs:[00000030h]		0_2_01ABC97C
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AB0946 mov eax, dword ptr fs:[00000030h]		0_2_01AB0946
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B04940 mov eax, dword ptr fs:[00000030h]		0_2_01B04940
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A30887 mov eax, dword ptr fs:[00000030h]		0_2_01A30887
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ABC89D mov eax, dword ptr fs:[00000030h]		0_2_01ABC89D
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AFA8E4 mov eax, dword ptr fs:[00000030h]		0_2_01AFA8E4
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6C8F9 mov eax, dword ptr fs:[00000030h]		0_2_01A6C8F9
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6C8F9 mov eax, dword ptr fs:[00000030h]		0_2_01A6C8F9
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5E8C0 mov eax, dword ptr fs:[00000030h]		0_2_01A5E8C0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B008C0 mov eax, dword ptr fs:[00000030h]		0_2_01B008C0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A52835 mov eax, dword ptr fs:[00000030h]		0_2_01A52835
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A52835 mov eax, dword ptr fs:[00000030h]		0_2_01A52835
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A52835 mov eax, dword ptr fs:[00000030h]		0_2_01A52835
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A52835 mov ecx, dword ptr fs:[00000030h]		0_2_01A52835
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A52835 mov eax, dword ptr fs:[00000030h]		0_2_01A52835
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A52835 mov eax, dword ptr fs:[00000030h]		0_2_01A52835
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6A830 mov eax, dword ptr fs:[00000030h]		0_2_01A6A830
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD483A mov eax, dword ptr fs:[00000030h]		0_2_01AD483A
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD483A mov eax, dword ptr fs:[00000030h]		0_2_01AD483A
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ABC810 mov eax, dword ptr fs:[00000030h]		0_2_01ABC810
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ABE872 mov eax, dword ptr fs:[00000030h]		0_2_01ABE872
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ABE872 mov eax, dword ptr fs:[00000030h]		0_2_01ABE872
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC6870 mov eax, dword ptr fs:[00000030h]		0_2_01AC6870
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC6870 mov eax, dword ptr fs:[00000030h]		0_2_01AC6870
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A42840 mov ecx, dword ptr fs:[00000030h]		0_2_01A42840
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A60854 mov eax, dword ptr fs:[00000030h]		0_2_01A60854
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A34859 mov eax, dword ptr fs:[00000030h]		0_2_01A34859
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A34859 mov eax, dword ptr fs:[00000030h]		0_2_01A34859
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40BBE mov eax, dword ptr fs:[00000030h]		0_2_01A40BBE
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A40BBE mov eax, dword ptr fs:[00000030h]		0_2_01A40BBE
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE4BB0 mov eax, dword ptr fs:[00000030h]		0_2_01AE4BB0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE4BB0 mov eax, dword ptr fs:[00000030h]		0_2_01AE4BB0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A38BF0 mov eax, dword ptr fs:[00000030h]		0_2_01A38BF0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A38BF0 mov eax, dword ptr fs:[00000030h]		0_2_01A38BF0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A38BF0 mov eax, dword ptr fs:[00000030h]		0_2_01A38BF0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5EBFC mov eax, dword ptr fs:[00000030h]		0_2_01A5EBFC
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ABCBF0 mov eax, dword ptr fs:[00000030h]		0_2_01ABCBF0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A50BCB mov eax, dword ptr fs:[00000030h]		0_2_01A50BCB
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A50BCB mov eax, dword ptr fs:[00000030h]		0_2_01A50BCB
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A50BCB mov eax, dword ptr fs:[00000030h]		0_2_01A50BCB
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A30BCD mov eax, dword ptr fs:[00000030h]		0_2_01A30BCD
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A30BCD mov eax, dword ptr fs:[00000030h]		0_2_01A30BCD
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A30BCD mov eax, dword ptr fs:[00000030h]		0_2_01A30BCD
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADEBD0 mov eax, dword ptr fs:[00000030h]		0_2_01ADEBD0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5EB20 mov eax, dword ptr fs:[00000030h]		0_2_01A5EB20
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5EB20 mov eax, dword ptr fs:[00000030h]		0_2_01A5EB20
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AF8B28 mov eax, dword ptr fs:[00000030h]		0_2_01AF8B28
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AF8B28 mov eax, dword ptr fs:[00000030h]		0_2_01AF8B28
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B04B00 mov eax, dword ptr fs:[00000030h]		0_2_01B04B00
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAEB1D mov eax, dword ptr fs:[00000030h]		0_2_01AAEB1D
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAEB1D mov eax, dword ptr fs:[00000030h]		0_2_01AAEB1D
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAEB1D mov eax, dword ptr fs:[00000030h]		0_2_01AAEB1D
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAEB1D mov eax, dword ptr fs:[00000030h]		0_2_01AAEB1D
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAEB1D mov eax, dword ptr fs:[00000030h]		0_2_01AAEB1D
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAEB1D mov eax, dword ptr fs:[00000030h]		0_2_01AAEB1D
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAEB1D mov eax, dword ptr fs:[00000030h]		0_2_01AAEB1D
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAEB1D mov eax, dword ptr fs:[00000030h]		0_2_01AAEB1D
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AAEB1D mov eax, dword ptr fs:[00000030h]		0_2_01AAEB1D
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A2CB7E mov eax, dword ptr fs:[00000030h]		0_2_01A2CB7E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE4B4B mov eax, dword ptr fs:[00000030h]		0_2_01AE4B4B
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AE4B4B mov eax, dword ptr fs:[00000030h]		0_2_01AE4B4B
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B02B57 mov eax, dword ptr fs:[00000030h]		0_2_01B02B57
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B02B57 mov eax, dword ptr fs:[00000030h]		0_2_01B02B57
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B02B57 mov eax, dword ptr fs:[00000030h]		0_2_01B02B57
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B02B57 mov eax, dword ptr fs:[00000030h]		0_2_01B02B57
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC6B40 mov eax, dword ptr fs:[00000030h]		0_2_01AC6B40
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AC6B40 mov eax, dword ptr fs:[00000030h]		0_2_01AC6B40
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AFAB40 mov eax, dword ptr fs:[00000030h]		0_2_01AFAB40
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01AD8B42 mov eax, dword ptr fs:[00000030h]		0_2_01AD8B42
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A28B50 mov eax, dword ptr fs:[00000030h]		0_2_01A28B50
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADEB50 mov eax, dword ptr fs:[00000030h]		0_2_01ADEB50
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A38AA0 mov eax, dword ptr fs:[00000030h]		0_2_01A38AA0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A38AA0 mov eax, dword ptr fs:[00000030h]		0_2_01A38AA0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A86AA4 mov eax, dword ptr fs:[00000030h]		0_2_01A86AA4
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3EA80 mov eax, dword ptr fs:[00000030h]		0_2_01A3EA80
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3EA80 mov eax, dword ptr fs:[00000030h]		0_2_01A3EA80
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3EA80 mov eax, dword ptr fs:[00000030h]		0_2_01A3EA80
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3EA80 mov eax, dword ptr fs:[00000030h]		0_2_01A3EA80
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3EA80 mov eax, dword ptr fs:[00000030h]		0_2_01A3EA80
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3EA80 mov eax, dword ptr fs:[00000030h]		0_2_01A3EA80
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3EA80 mov eax, dword ptr fs:[00000030h]		0_2_01A3EA80
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3EA80 mov eax, dword ptr fs:[00000030h]		0_2_01A3EA80
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A3EA80 mov eax, dword ptr fs:[00000030h]		0_2_01A3EA80
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01B04A80 mov eax, dword ptr fs:[00000030h]		0_2_01B04A80
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A68A90 mov edx, dword ptr fs:[00000030h]		0_2_01A68A90
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6AAEE mov eax, dword ptr fs:[00000030h]		0_2_01A6AAEE
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6AAEE mov eax, dword ptr fs:[00000030h]		0_2_01A6AAEE
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A86ACC mov eax, dword ptr fs:[00000030h]		0_2_01A86ACC
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A86ACC mov eax, dword ptr fs:[00000030h]		0_2_01A86ACC
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A86ACC mov eax, dword ptr fs:[00000030h]		0_2_01A86ACC
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A30AD0 mov eax, dword ptr fs:[00000030h]		0_2_01A30AD0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A64AD0 mov eax, dword ptr fs:[00000030h]		0_2_01A64AD0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A64AD0 mov eax, dword ptr fs:[00000030h]		0_2_01A64AD0
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6CA24 mov eax, dword ptr fs:[00000030h]		0_2_01A6CA24
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A5EA2E mov eax, dword ptr fs:[00000030h]		0_2_01A5EA2E
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A54A35 mov eax, dword ptr fs:[00000030h]		0_2_01A54A35
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A54A35 mov eax, dword ptr fs:[00000030h]		0_2_01A54A35
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6CA38 mov eax, dword ptr fs:[00000030h]		0_2_01A6CA38
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ABCA11 mov eax, dword ptr fs:[00000030h]		0_2_01ABCA11
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6CA6F mov eax, dword ptr fs:[00000030h]		0_2_01A6CA6F
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6CA6F mov eax, dword ptr fs:[00000030h]		0_2_01A6CA6F
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01A6CA6F mov eax, dword ptr fs:[00000030h]		0_2_01A6CA6F
Source: C:\Users\user\Desktop\VzJM9stirU.exe	Code function: 0_2_01ADEA60 mov eax, dword ptr fs:[00000030h]		0_2_01ADEA60

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Stealing of Sensitive Information

Source: Yara match	File source: 0.2.VzJM9stirU.exe.e50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2463684553.0000000001520000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2463423251.0000000000E51000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Remote Access Functionality

Source: Yara match	File source: 0.2.VzJM9stirU.exe.e50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2463684553.0000000001520000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2463423251.0000000000E51000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY