Analysis Report PO98765.exe

AV Detection:

Multi AV Scanner detection for submitted file

Source: PO98765.exe	Virustotal: Detection: 14%			Perma Link
Source: PO98765.exe	ReversingLabs: Detection: 10%

Yara detected FormBook

Source: Yara match	File source: 00000003.00000002.923055372.0000000000F40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.923022023.0000000000F10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.679040055.0000000003741000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.715786451.0000000001040000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.922790825.0000000000C70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.715956692.00000000013F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.714949083.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.PO98765.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PO98765.exe.400000.0.raw.unpack, type: UNPACKEDPE

Antivirus or Machine Learning detection for unpacked file

Source: 1.2.PO98765.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\Desktop\PO98765.exe	Code function: 4x nop then jmp 05BA779Ch		0_2_05BA76F2
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h		0_2_05BA85F9
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h		0_2_05BA8608

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 1201 ATTACK-RESPONSES 403 Forbidden 34.102.136.180:80 -> 192.168.2.4:49709
Source: Traffic	Snort IDS: 1201 ATTACK-RESPONSES 403 Forbidden 23.227.38.74:80 -> 192.168.2.4:49712

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /sbmh/?4hLtM4=7c1Yf2hXTdqRFKk5H17xFHcZtn6ZaViryhouZ8x83IEcsjPhhroi25cpiHSX6hk8gWCa&n0DXRn=xPJxZNG0xPz HTTP/1.1Host: www.westhighlandwaytours.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /sbmh/?4hLtM4=skYwVssfaMrhlhDh0By1+2yNFudwvP+0WfyEru4f7dWeU3QH+Wh99HLFJYHhc5Wxp3Js&n0DXRn=xPJxZNG0xPz HTTP/1.1Host: www.bloochy.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 34.102.136.180 34.102.136.180

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: CLAYERLIMITED-AS-APClayerLimitedHK CLAYERLIMITED-AS-APClayerLimitedHK
Source: Joe Sandbox View	ASN Name: GOOGLEUS GOOGLEUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /sbmh/?4hLtM4=7c1Yf2hXTdqRFKk5H17xFHcZtn6ZaViryhouZ8x83IEcsjPhhroi25cpiHSX6hk8gWCa&n0DXRn=xPJxZNG0xPz HTTP/1.1Host: www.westhighlandwaytours.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /sbmh/?4hLtM4=skYwVssfaMrhlhDh0By1+2yNFudwvP+0WfyEru4f7dWeU3QH+Wh99HLFJYHhc5Wxp3Js&n0DXRn=xPJxZNG0xPz HTTP/1.1Host: www.bloochy.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: www.westhighlandwaytours.com

Urls found in memory or binary data

Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: PO98765.exe, 00000000.00000002.678398737.0000000002741000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 00000002.00000002.924230430.0000000002B50000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000002.00000000.701874161.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 00000003.00000002.923055372.0000000000F40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.923022023.0000000000F10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.679040055.0000000003741000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.715786451.0000000001040000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.922790825.0000000000C70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.715956692.00000000013F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.714949083.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.PO98765.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PO98765.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: 00000003.00000002.923055372.0000000000F40000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.923055372.0000000000F40000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.923022023.0000000000F10000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.923022023.0000000000F10000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.679040055.0000000003741000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.679040055.0000000003741000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.715786451.0000000001040000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.715786451.0000000001040000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.922790825.0000000000C70000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.922790825.0000000000C70000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.715956692.00000000013F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.715956692.00000000013F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.714949083.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.714949083.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.PO98765.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.PO98765.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.PO98765.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.PO98765.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Contains functionality to call native functions

Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0041A050 NtClose,		1_2_0041A050
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0041A100 NtAllocateVirtualMemory,		1_2_0041A100
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_00419F20 NtCreateFile,		1_2_00419F20
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_00419FD0 NtReadFile,		1_2_00419FD0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_00419FCA NtReadFile,		1_2_00419FCA
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519910 NtAdjustPrivilegesToken,LdrInitializeThunk,		1_2_01519910
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015199A0 NtCreateSection,LdrInitializeThunk,		1_2_015199A0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519840 NtDelayExecution,LdrInitializeThunk,		1_2_01519840
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519860 NtQuerySystemInformation,LdrInitializeThunk,		1_2_01519860
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015198F0 NtReadVirtualMemory,LdrInitializeThunk,		1_2_015198F0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519A50 NtCreateFile,LdrInitializeThunk,		1_2_01519A50
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519A00 NtProtectVirtualMemory,LdrInitializeThunk,		1_2_01519A00
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519A20 NtResumeThread,LdrInitializeThunk,		1_2_01519A20
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519540 NtReadFile,LdrInitializeThunk,		1_2_01519540
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015195D0 NtClose,LdrInitializeThunk,		1_2_015195D0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519710 NtQueryInformationToken,LdrInitializeThunk,		1_2_01519710
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519780 NtMapViewOfSection,LdrInitializeThunk,		1_2_01519780
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015197A0 NtUnmapViewOfSection,LdrInitializeThunk,		1_2_015197A0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519660 NtAllocateVirtualMemory,LdrInitializeThunk,		1_2_01519660
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015196E0 NtFreeVirtualMemory,LdrInitializeThunk,		1_2_015196E0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519950 NtQueueApcThread,		1_2_01519950
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015199D0 NtCreateProcessEx,		1_2_015199D0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0151B040 NtSuspendThread,		1_2_0151B040
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519820 NtEnumerateKey,		1_2_01519820
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015198A0 NtWriteVirtualMemory,		1_2_015198A0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519B00 NtSetValueKey,		1_2_01519B00
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0151A3B0 NtGetContextThread,		1_2_0151A3B0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519A10 NtQuerySection,		1_2_01519A10
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519A80 NtOpenDirectoryObject,		1_2_01519A80
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519560 NtWriteFile,		1_2_01519560
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0151AD30 NtSetContextThread,		1_2_0151AD30
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519520 NtWaitForSingleObject,		1_2_01519520
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015195F0 NtQueryInformationFile,		1_2_015195F0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0151A770 NtOpenThread,		1_2_0151A770
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519770 NtSetInformationFile,		1_2_01519770
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519760 NtOpenProcess,		1_2_01519760
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0151A710 NtOpenProcessToken,		1_2_0151A710
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519730 NtQueryVirtualMemory,		1_2_01519730
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519FE0 NtCreateMutant,		1_2_01519FE0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519650 NtQueryValueKey,		1_2_01519650
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519670 NtQueryInformationProcess,		1_2_01519670
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01519610 NtEnumerateValueKey,		1_2_01519610
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015196D0 NtCreateKey,		1_2_015196D0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149540 NtReadFile,LdrInitializeThunk,		3_2_05149540
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051495D0 NtClose,LdrInitializeThunk,		3_2_051495D0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149710 NtQueryInformationToken,LdrInitializeThunk,		3_2_05149710
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149780 NtMapViewOfSection,LdrInitializeThunk,		3_2_05149780
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149FE0 NtCreateMutant,LdrInitializeThunk,		3_2_05149FE0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149650 NtQueryValueKey,LdrInitializeThunk,		3_2_05149650
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149660 NtAllocateVirtualMemory,LdrInitializeThunk,		3_2_05149660
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051496D0 NtCreateKey,LdrInitializeThunk,		3_2_051496D0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051496E0 NtFreeVirtualMemory,LdrInitializeThunk,		3_2_051496E0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149910 NtAdjustPrivilegesToken,LdrInitializeThunk,		3_2_05149910
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051499A0 NtCreateSection,LdrInitializeThunk,		3_2_051499A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149840 NtDelayExecution,LdrInitializeThunk,		3_2_05149840
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149860 NtQuerySystemInformation,LdrInitializeThunk,		3_2_05149860
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149A50 NtCreateFile,LdrInitializeThunk,		3_2_05149A50
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0514AD30 NtSetContextThread,		3_2_0514AD30
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149520 NtWaitForSingleObject,		3_2_05149520
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149560 NtWriteFile,		3_2_05149560
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051495F0 NtQueryInformationFile,		3_2_051495F0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0514A710 NtOpenProcessToken,		3_2_0514A710
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149730 NtQueryVirtualMemory,		3_2_05149730
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0514A770 NtOpenThread,		3_2_0514A770
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149770 NtSetInformationFile,		3_2_05149770
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149760 NtOpenProcess,		3_2_05149760
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051497A0 NtUnmapViewOfSection,		3_2_051497A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149610 NtEnumerateValueKey,		3_2_05149610
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149670 NtQueryInformationProcess,		3_2_05149670
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149950 NtQueueApcThread,		3_2_05149950
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051499D0 NtCreateProcessEx,		3_2_051499D0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149820 NtEnumerateKey,		3_2_05149820
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0514B040 NtSuspendThread,		3_2_0514B040
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051498A0 NtWriteVirtualMemory,		3_2_051498A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051498F0 NtReadVirtualMemory,		3_2_051498F0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149B00 NtSetValueKey,		3_2_05149B00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0514A3B0 NtGetContextThread,		3_2_0514A3B0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149A10 NtQuerySection,		3_2_05149A10
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149A00 NtProtectVirtualMemory,		3_2_05149A00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149A20 NtResumeThread,		3_2_05149A20
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05149A80 NtOpenDirectoryObject,		3_2_05149A80
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C8A050 NtClose,		3_2_00C8A050
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C8A100 NtAllocateVirtualMemory,		3_2_00C8A100
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C89FD0 NtReadFile,		3_2_00C89FD0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C89F20 NtCreateFile,		3_2_00C89F20
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C89FCA NtReadFile,		3_2_00C89FCA

Detected potential crypto function

Source: C:\Users\user\Desktop\PO98765.exe	Code function: 0_2_0266B264		0_2_0266B264
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 0_2_0266C2B0		0_2_0266C2B0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 0_2_02669998		0_2_02669998
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 0_2_0266DF73		0_2_0266DF73
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 0_2_05BA17B0		0_2_05BA17B0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 0_2_05BA3798		0_2_05BA3798
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 0_2_05BA8EF8		0_2_05BA8EF8
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 0_2_05BA2080		0_2_05BA2080
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 0_2_05BA1468		0_2_05BA1468
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 0_2_05BBBF38		0_2_05BBBF38
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 0_2_05BBB530		0_2_05BBB530
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 0_2_003567E9		0_2_003567E9
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0041D853		1_2_0041D853
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_00401030		1_2_00401030
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0041D38E		1_2_0041D38E
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_00402D88		1_2_00402D88
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_00402D90		1_2_00402D90
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_00409E30		1_2_00409E30
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0041E73A		1_2_0041E73A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_00402FB0		1_2_00402FB0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014DF900		1_2_014DF900
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014F4120		1_2_014F4120
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01591002		1_2_01591002
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015AE824		1_2_015AE824
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A28EC		1_2_015A28EC
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014EB090		1_2_014EB090
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015020A0		1_2_015020A0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A20A8		1_2_015A20A8
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A2B28		1_2_015A2B28
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015903DA		1_2_015903DA
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0159DBD2		1_2_0159DBD2
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150EBB0		1_2_0150EBB0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A22AE		1_2_015A22AE
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A1D55		1_2_015A1D55
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A2D07		1_2_015A2D07
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D0D20		1_2_014D0D20
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A25DD		1_2_015A25DD
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014ED5E0		1_2_014ED5E0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01502581		1_2_01502581
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0159D466		1_2_0159D466
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E841F		1_2_014E841F
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015ADFCE		1_2_015ADFCE
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A1FF1		1_2_015A1FF1
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0159D616		1_2_0159D616
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014F6E30		1_2_014F6E30
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A2EF7		1_2_015A2EF7
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_00AB67E9		1_2_00AB67E9
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D2D07		3_2_051D2D07
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05100D20		3_2_05100D20
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D1D55		3_2_051D1D55
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05132581		3_2_05132581
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D25DD		3_2_051D25DD
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0511D5E0		3_2_0511D5E0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0511841F		3_2_0511841F
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051CD466		3_2_051CD466
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D1FF1		3_2_051D1FF1
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051CD616		3_2_051CD616
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05126E30		3_2_05126E30
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D2EF7		3_2_051D2EF7
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0510F900		3_2_0510F900
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05124120		3_2_05124120
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051C1002		3_2_051C1002
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0511B090		3_2_0511B090
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051320A0		3_2_051320A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D20A8		3_2_051D20A8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D28EC		3_2_051D28EC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D2B28		3_2_051D2B28
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513EBB0		3_2_0513EBB0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051CDBD2		3_2_051CDBD2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D22AE		3_2_051D22AE
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C8D853		3_2_00C8D853
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C8D816		3_2_00C8D816
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C8D38E		3_2_00C8D38E
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C72D88		3_2_00C72D88
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C72D90		3_2_00C72D90
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C79E30		3_2_00C79E30
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C72FB0		3_2_00C72FB0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C8E73A		3_2_00C8E73A

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\PO98765.exe	Code function: String function: 014DB150 appears 45 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 0510B150 appears 35 times

Sample file is different than original file name gathered from version info

Source: PO98765.exe	Binary or memory string: OriginalFilename vs PO98765.exe
Source: PO98765.exe, 00000000.00000002.677683735.0000000000352000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameBfRf.exe@ vs PO98765.exe
Source: PO98765.exe, 00000000.00000002.679040055.0000000003741000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameKedermister.dllT vs PO98765.exe
Source: PO98765.exe	Binary or memory string: OriginalFilename vs PO98765.exe
Source: PO98765.exe, 00000001.00000002.715044726.0000000000AB2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameBfRf.exe@ vs PO98765.exe
Source: PO98765.exe, 00000001.00000002.717371551.0000000003263000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamemstsc.exej% vs PO98765.exe
Source: PO98765.exe, 00000001.00000002.716576209.00000000015CF000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PO98765.exe
Source: PO98765.exe	Binary or memory string: OriginalFilenameBfRf.exe@ vs PO98765.exe

Yara signature match

Source: 00000003.00000002.923055372.0000000000F40000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.923055372.0000000000F40000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.923022023.0000000000F10000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.923022023.0000000000F10000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.679040055.0000000003741000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.679040055.0000000003741000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.715786451.0000000001040000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.715786451.0000000001040000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.922790825.0000000000C70000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.922790825.0000000000C70000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.715956692.00000000013F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.715956692.00000000013F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.714949083.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.714949083.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.PO98765.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.PO98765.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.PO98765.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.PO98765.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: PO98765.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/1@5/3

Creates files inside the user directory

Source: C:\Users\user\Desktop\PO98765.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO98765.exe.log

Jump to behavior

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4484:120:WilError_01

PE file has an executable .text section and no other executable section

Source: PO98765.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\PO98765.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\PO98765.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: PO98765.exe	Virustotal: Detection: 14%
Source: PO98765.exe	ReversingLabs: Detection: 10%

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\PO98765.exe 'C:\Users\user\Desktop\PO98765.exe'
Source: unknown	Process created: C:\Users\user\Desktop\PO98765.exe C:\Users\user\Desktop\PO98765.exe
Source: unknown	Process created: C:\Windows\SysWOW64\mstsc.exe C:\Windows\SysWOW64\mstsc.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO98765.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO98765.exe	Process created: C:\Users\user\Desktop\PO98765.exe C:\Users\user\Desktop\PO98765.exe			Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO98765.exe'			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\PO98765.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Uses Microsoft Silverlight

Source: C:\Users\user\Desktop\PO98765.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE file contains a COM descriptor data directory

Source: PO98765.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: PO98765.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000002.00000002.933997672.0000000005A00000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: PO98765.exe, 00000001.00000002.716163299.00000000014B0000.00000040.00000001.sdmp, mstsc.exe, 00000003.00000002.924756958.00000000051FF000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: PO98765.exe, mstsc.exe
Source:	Binary string: mstsc.pdbGCTL source: PO98765.exe, 00000001.00000002.717167933.0000000003140000.00000040.00000001.sdmp
Source:	Binary string: mstsc.pdb source: PO98765.exe, 00000001.00000002.717167933.0000000003140000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000002.00000002.933997672.0000000005A00000.00000002.00000001.sdmp

Data Obfuscation:

.NET source code contains potential unpacker

Source: PO98765.exe, erSe.cs	.Net Code: x1 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.PO98765.exe.350000.0.unpack, erSe.cs	.Net Code: x1 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.PO98765.exe.350000.0.unpack, erSe.cs	.Net Code: x1 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.PO98765.exe.ab0000.1.unpack, erSe.cs	.Net Code: x1 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.PO98765.exe.ab0000.0.unpack, erSe.cs	.Net Code: x1 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\PO98765.exe	Code function: 0_2_02666408 push 8B5500CBh; retf		0_2_02666416
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 0_2_02666550 pushad ; retf		0_2_0266655D
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 0_2_05BB6DDC pushad ; ret		0_2_05BB6DDD
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 0_2_05BB4C0F pushfd ; retf		0_2_05BB4C10
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 0_2_05BB4BC7 push es; retf		0_2_05BB4BC8
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0041D075 push eax; ret		1_2_0041D0C8
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0041C802 push esi; iretd		1_2_0041C803
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0041D0C2 push eax; ret		1_2_0041D0C8
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0041D0CB push eax; ret		1_2_0041D132
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0041E172 pushfd ; ret		1_2_0041E174
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0041D12C push eax; ret		1_2_0041D132
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_004182CC push cs; retf		1_2_004182CE
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0041E4F5 push dword ptr [537421FAh]; ret		1_2_0041E515
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_00419C92 pushfd ; iretd		1_2_00419C98
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0041674D push 8EAE14C8h; iretd		1_2_00416753
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_004167AE push C6E9D42Ah; ret		1_2_004167C2
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0152D0D1 push ecx; ret		1_2_0152D0E4
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0515D0D1 push ecx; ret		3_2_0515D0E4
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C8D0CB push eax; ret		3_2_00C8D132
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C8D0C2 push eax; ret		3_2_00C8D0C8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C8D075 push eax; ret		3_2_00C8D0C8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C8C802 push esi; iretd		3_2_00C8C803
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C8E172 pushfd ; ret		3_2_00C8E174
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C8D12C push eax; ret		3_2_00C8D132
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C882CC push cs; retf		3_2_00C882CE
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C8E4F5 push dword ptr [537421FAh]; ret		3_2_00C8E515
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C89C92 pushfd ; iretd		3_2_00C89C98
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C867AE push C6E9D42Ah; ret		3_2_00C867C2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_00C8674D push 8EAE14C8h; iretd		3_2_00C86753

Binary may include packed or encrypted code

Source: initial sample

Static PE information: section name: .text entropy: 7.32069962776

Hooking and other Techniques for Hiding and Protection:

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x87 0x7E 0xE3

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM_3

Source: Yara match	File source: 00000000.00000002.678398737.0000000002741000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO98765.exe PID: 484, type: MEMORY

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\PO98765.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: PO98765.exe, 00000000.00000002.678398737.0000000002741000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: PO98765.exe, 00000000.00000002.678398737.0000000002741000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: PO98765.exe, 00000000.00000002.678398737.0000000002741000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\PO98765.exe	RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\PO98765.exe	RDTSC instruction interceptor: First address: 0000000000409B4E second address: 0000000000409B54 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mstsc.exe	RDTSC instruction interceptor: First address: 0000000000C798E4 second address: 0000000000C798EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mstsc.exe	RDTSC instruction interceptor: First address: 0000000000C79B4E second address: 0000000000C79B54 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Contains capabilities to detect virtual machines

Source: C:\Users\user\Desktop\PO98765.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum name: 0			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\PO98765.exe

Code function: 1_2_00409A80 rdtsc

1_2_00409A80

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\PO98765.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\PO98765.exe TID: 2740	Thread sleep time: -1844674407370954s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe TID: 4868	Thread sleep time: -52388s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe TID: 6068	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\explorer.exe TID: 2016	Thread sleep time: -56000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 4600	Thread sleep time: -48000s >= -30000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\SysWOW64\mstsc.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\mstsc.exe	Last function: Thread delayed

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: PO98765.exe, 00000000.00000002.682453988.0000000006220000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: PO98765.exe, 00000000.00000002.678398737.0000000002741000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000002.00000000.696403684.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000002.00000000.700168754.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: PO98765.exe, 00000000.00000002.678398737.0000000002741000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: PO98765.exe, 00000000.00000002.678398737.0000000002741000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II|update users set password = @password where user_id = @user_id
Source: PO98765.exe, 00000000.00000002.678398737.0000000002741000.00000004.00000001.sdmp	Binary or memory string: l%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000002.00000000.696931835.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.700168754.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: PO98765.exe, 00000000.00000002.678398737.0000000002741000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: explorer.exe, 00000002.00000000.700882472.000000000A897000.00000004.00000001.sdmp	Binary or memory string: War&Prod_VMware_SATAb
Source: explorer.exe, 00000002.00000002.931560810.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: PO98765.exe, 00000000.00000002.682453988.0000000006220000.00000004.00000001.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareNC9EE2_AWin32_VideoController3K4TF8KSVideoController120060621000000.000000-000410.6620display.infMSBDAUK5GLFXWPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsD5XYEX9V
Source: explorer.exe, 00000002.00000000.696403684.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000002.00000000.700351269.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000002.00000000.696403684.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: PO98765.exe, 00000000.00000002.678398737.0000000002741000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: explorer.exe, 00000002.00000000.700414904.000000000A784000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: PO98765.exe, 00000000.00000002.678398737.0000000002741000.00000004.00000001.sdmp	Binary or memory string: l"SOFTWARE\VMware, Inc.\VMware Tools
Source: PO98765.exe, 00000000.00000002.678398737.0000000002741000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000002.00000000.696403684.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Queries a list of all running processes

Source: C:\Users\user\Desktop\PO98765.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\PO98765.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process queried: DebugPort			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\PO98765.exe

Code function: 1_2_00409A80 rdtsc

1_2_00409A80

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\PO98765.exe

Code function: 1_2_0040ACC0 LdrLoadDll,

1_2_0040ACC0

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014FB944 mov eax, dword ptr fs:[00000030h]		1_2_014FB944
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014FB944 mov eax, dword ptr fs:[00000030h]		1_2_014FB944
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014DC962 mov eax, dword ptr fs:[00000030h]		1_2_014DC962
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014DB171 mov eax, dword ptr fs:[00000030h]		1_2_014DB171
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014DB171 mov eax, dword ptr fs:[00000030h]		1_2_014DB171
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D9100 mov eax, dword ptr fs:[00000030h]		1_2_014D9100
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D9100 mov eax, dword ptr fs:[00000030h]		1_2_014D9100
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D9100 mov eax, dword ptr fs:[00000030h]		1_2_014D9100
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150513A mov eax, dword ptr fs:[00000030h]		1_2_0150513A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150513A mov eax, dword ptr fs:[00000030h]		1_2_0150513A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014F4120 mov eax, dword ptr fs:[00000030h]		1_2_014F4120
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014F4120 mov eax, dword ptr fs:[00000030h]		1_2_014F4120
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014F4120 mov eax, dword ptr fs:[00000030h]		1_2_014F4120
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014F4120 mov eax, dword ptr fs:[00000030h]		1_2_014F4120
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014F4120 mov ecx, dword ptr fs:[00000030h]		1_2_014F4120
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014DB1E1 mov eax, dword ptr fs:[00000030h]		1_2_014DB1E1
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014DB1E1 mov eax, dword ptr fs:[00000030h]		1_2_014DB1E1
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014DB1E1 mov eax, dword ptr fs:[00000030h]		1_2_014DB1E1
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015641E8 mov eax, dword ptr fs:[00000030h]		1_2_015641E8
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01502990 mov eax, dword ptr fs:[00000030h]		1_2_01502990
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014FC182 mov eax, dword ptr fs:[00000030h]		1_2_014FC182
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150A185 mov eax, dword ptr fs:[00000030h]		1_2_0150A185
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015551BE mov eax, dword ptr fs:[00000030h]		1_2_015551BE
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015551BE mov eax, dword ptr fs:[00000030h]		1_2_015551BE
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015551BE mov eax, dword ptr fs:[00000030h]		1_2_015551BE
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015551BE mov eax, dword ptr fs:[00000030h]		1_2_015551BE
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015061A0 mov eax, dword ptr fs:[00000030h]		1_2_015061A0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015061A0 mov eax, dword ptr fs:[00000030h]		1_2_015061A0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015569A6 mov eax, dword ptr fs:[00000030h]		1_2_015569A6
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015949A4 mov eax, dword ptr fs:[00000030h]		1_2_015949A4
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015949A4 mov eax, dword ptr fs:[00000030h]		1_2_015949A4
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015949A4 mov eax, dword ptr fs:[00000030h]		1_2_015949A4
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015949A4 mov eax, dword ptr fs:[00000030h]		1_2_015949A4
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014F0050 mov eax, dword ptr fs:[00000030h]		1_2_014F0050
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014F0050 mov eax, dword ptr fs:[00000030h]		1_2_014F0050
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01592073 mov eax, dword ptr fs:[00000030h]		1_2_01592073
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A1074 mov eax, dword ptr fs:[00000030h]		1_2_015A1074
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01557016 mov eax, dword ptr fs:[00000030h]		1_2_01557016
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01557016 mov eax, dword ptr fs:[00000030h]		1_2_01557016
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01557016 mov eax, dword ptr fs:[00000030h]		1_2_01557016
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A4015 mov eax, dword ptr fs:[00000030h]		1_2_015A4015
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A4015 mov eax, dword ptr fs:[00000030h]		1_2_015A4015
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014EB02A mov eax, dword ptr fs:[00000030h]		1_2_014EB02A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014EB02A mov eax, dword ptr fs:[00000030h]		1_2_014EB02A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014EB02A mov eax, dword ptr fs:[00000030h]		1_2_014EB02A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014EB02A mov eax, dword ptr fs:[00000030h]		1_2_014EB02A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150002D mov eax, dword ptr fs:[00000030h]		1_2_0150002D
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150002D mov eax, dword ptr fs:[00000030h]		1_2_0150002D
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150002D mov eax, dword ptr fs:[00000030h]		1_2_0150002D
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150002D mov eax, dword ptr fs:[00000030h]		1_2_0150002D
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150002D mov eax, dword ptr fs:[00000030h]		1_2_0150002D
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0156B8D0 mov eax, dword ptr fs:[00000030h]		1_2_0156B8D0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0156B8D0 mov ecx, dword ptr fs:[00000030h]		1_2_0156B8D0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0156B8D0 mov eax, dword ptr fs:[00000030h]		1_2_0156B8D0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0156B8D0 mov eax, dword ptr fs:[00000030h]		1_2_0156B8D0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0156B8D0 mov eax, dword ptr fs:[00000030h]		1_2_0156B8D0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0156B8D0 mov eax, dword ptr fs:[00000030h]		1_2_0156B8D0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D58EC mov eax, dword ptr fs:[00000030h]		1_2_014D58EC
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D40E1 mov eax, dword ptr fs:[00000030h]		1_2_014D40E1
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D40E1 mov eax, dword ptr fs:[00000030h]		1_2_014D40E1
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D40E1 mov eax, dword ptr fs:[00000030h]		1_2_014D40E1
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D9080 mov eax, dword ptr fs:[00000030h]		1_2_014D9080
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01553884 mov eax, dword ptr fs:[00000030h]		1_2_01553884
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01553884 mov eax, dword ptr fs:[00000030h]		1_2_01553884
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150F0BF mov ecx, dword ptr fs:[00000030h]		1_2_0150F0BF
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150F0BF mov eax, dword ptr fs:[00000030h]		1_2_0150F0BF
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150F0BF mov eax, dword ptr fs:[00000030h]		1_2_0150F0BF
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015020A0 mov eax, dword ptr fs:[00000030h]		1_2_015020A0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015020A0 mov eax, dword ptr fs:[00000030h]		1_2_015020A0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015020A0 mov eax, dword ptr fs:[00000030h]		1_2_015020A0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015020A0 mov eax, dword ptr fs:[00000030h]		1_2_015020A0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015020A0 mov eax, dword ptr fs:[00000030h]		1_2_015020A0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015020A0 mov eax, dword ptr fs:[00000030h]		1_2_015020A0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015190AF mov eax, dword ptr fs:[00000030h]		1_2_015190AF
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A8B58 mov eax, dword ptr fs:[00000030h]		1_2_015A8B58
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014DDB40 mov eax, dword ptr fs:[00000030h]		1_2_014DDB40
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014DF358 mov eax, dword ptr fs:[00000030h]		1_2_014DF358
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01503B7A mov eax, dword ptr fs:[00000030h]		1_2_01503B7A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01503B7A mov eax, dword ptr fs:[00000030h]		1_2_01503B7A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014DDB60 mov ecx, dword ptr fs:[00000030h]		1_2_014DDB60
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0159131B mov eax, dword ptr fs:[00000030h]		1_2_0159131B
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015553CA mov eax, dword ptr fs:[00000030h]		1_2_015553CA
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015553CA mov eax, dword ptr fs:[00000030h]		1_2_015553CA
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014FDBE9 mov eax, dword ptr fs:[00000030h]		1_2_014FDBE9
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015003E2 mov eax, dword ptr fs:[00000030h]		1_2_015003E2
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015003E2 mov eax, dword ptr fs:[00000030h]		1_2_015003E2
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015003E2 mov eax, dword ptr fs:[00000030h]		1_2_015003E2
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015003E2 mov eax, dword ptr fs:[00000030h]		1_2_015003E2
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015003E2 mov eax, dword ptr fs:[00000030h]		1_2_015003E2
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015003E2 mov eax, dword ptr fs:[00000030h]		1_2_015003E2
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150B390 mov eax, dword ptr fs:[00000030h]		1_2_0150B390
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E1B8F mov eax, dword ptr fs:[00000030h]		1_2_014E1B8F
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E1B8F mov eax, dword ptr fs:[00000030h]		1_2_014E1B8F
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01502397 mov eax, dword ptr fs:[00000030h]		1_2_01502397
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0159138A mov eax, dword ptr fs:[00000030h]		1_2_0159138A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0158D380 mov ecx, dword ptr fs:[00000030h]		1_2_0158D380
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01504BAD mov eax, dword ptr fs:[00000030h]		1_2_01504BAD
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01504BAD mov eax, dword ptr fs:[00000030h]		1_2_01504BAD
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01504BAD mov eax, dword ptr fs:[00000030h]		1_2_01504BAD
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A5BA5 mov eax, dword ptr fs:[00000030h]		1_2_015A5BA5
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01564257 mov eax, dword ptr fs:[00000030h]		1_2_01564257
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0159EA55 mov eax, dword ptr fs:[00000030h]		1_2_0159EA55
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D9240 mov eax, dword ptr fs:[00000030h]		1_2_014D9240
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D9240 mov eax, dword ptr fs:[00000030h]		1_2_014D9240
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D9240 mov eax, dword ptr fs:[00000030h]		1_2_014D9240
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D9240 mov eax, dword ptr fs:[00000030h]		1_2_014D9240
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0151927A mov eax, dword ptr fs:[00000030h]		1_2_0151927A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0158B260 mov eax, dword ptr fs:[00000030h]		1_2_0158B260
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0158B260 mov eax, dword ptr fs:[00000030h]		1_2_0158B260
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A8A62 mov eax, dword ptr fs:[00000030h]		1_2_015A8A62
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E8A0A mov eax, dword ptr fs:[00000030h]		1_2_014E8A0A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0159AA16 mov eax, dword ptr fs:[00000030h]		1_2_0159AA16
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0159AA16 mov eax, dword ptr fs:[00000030h]		1_2_0159AA16
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014F3A1C mov eax, dword ptr fs:[00000030h]		1_2_014F3A1C
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014DAA16 mov eax, dword ptr fs:[00000030h]		1_2_014DAA16
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014DAA16 mov eax, dword ptr fs:[00000030h]		1_2_014DAA16
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D5210 mov eax, dword ptr fs:[00000030h]		1_2_014D5210
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D5210 mov ecx, dword ptr fs:[00000030h]		1_2_014D5210
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D5210 mov eax, dword ptr fs:[00000030h]		1_2_014D5210
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D5210 mov eax, dword ptr fs:[00000030h]		1_2_014D5210
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01514A2C mov eax, dword ptr fs:[00000030h]		1_2_01514A2C
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01514A2C mov eax, dword ptr fs:[00000030h]		1_2_01514A2C
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01502ACB mov eax, dword ptr fs:[00000030h]		1_2_01502ACB
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01502AE4 mov eax, dword ptr fs:[00000030h]		1_2_01502AE4
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150D294 mov eax, dword ptr fs:[00000030h]		1_2_0150D294
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150D294 mov eax, dword ptr fs:[00000030h]		1_2_0150D294
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150FAB0 mov eax, dword ptr fs:[00000030h]		1_2_0150FAB0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D52A5 mov eax, dword ptr fs:[00000030h]		1_2_014D52A5
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D52A5 mov eax, dword ptr fs:[00000030h]		1_2_014D52A5
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D52A5 mov eax, dword ptr fs:[00000030h]		1_2_014D52A5
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D52A5 mov eax, dword ptr fs:[00000030h]		1_2_014D52A5
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D52A5 mov eax, dword ptr fs:[00000030h]		1_2_014D52A5
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014EAAB0 mov eax, dword ptr fs:[00000030h]		1_2_014EAAB0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014EAAB0 mov eax, dword ptr fs:[00000030h]		1_2_014EAAB0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01513D43 mov eax, dword ptr fs:[00000030h]		1_2_01513D43
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01553540 mov eax, dword ptr fs:[00000030h]		1_2_01553540
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01583D40 mov eax, dword ptr fs:[00000030h]		1_2_01583D40
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014F7D50 mov eax, dword ptr fs:[00000030h]		1_2_014F7D50
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014FC577 mov eax, dword ptr fs:[00000030h]		1_2_014FC577
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014FC577 mov eax, dword ptr fs:[00000030h]		1_2_014FC577
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0159E539 mov eax, dword ptr fs:[00000030h]		1_2_0159E539
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0155A537 mov eax, dword ptr fs:[00000030h]		1_2_0155A537
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01504D3B mov eax, dword ptr fs:[00000030h]		1_2_01504D3B
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01504D3B mov eax, dword ptr fs:[00000030h]		1_2_01504D3B
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01504D3B mov eax, dword ptr fs:[00000030h]		1_2_01504D3B
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A8D34 mov eax, dword ptr fs:[00000030h]		1_2_015A8D34
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E3D34 mov eax, dword ptr fs:[00000030h]		1_2_014E3D34
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E3D34 mov eax, dword ptr fs:[00000030h]		1_2_014E3D34
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E3D34 mov eax, dword ptr fs:[00000030h]		1_2_014E3D34
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E3D34 mov eax, dword ptr fs:[00000030h]		1_2_014E3D34
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E3D34 mov eax, dword ptr fs:[00000030h]		1_2_014E3D34
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E3D34 mov eax, dword ptr fs:[00000030h]		1_2_014E3D34
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E3D34 mov eax, dword ptr fs:[00000030h]		1_2_014E3D34
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E3D34 mov eax, dword ptr fs:[00000030h]		1_2_014E3D34
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E3D34 mov eax, dword ptr fs:[00000030h]		1_2_014E3D34
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E3D34 mov eax, dword ptr fs:[00000030h]		1_2_014E3D34
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E3D34 mov eax, dword ptr fs:[00000030h]		1_2_014E3D34
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E3D34 mov eax, dword ptr fs:[00000030h]		1_2_014E3D34
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E3D34 mov eax, dword ptr fs:[00000030h]		1_2_014E3D34
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014DAD30 mov eax, dword ptr fs:[00000030h]		1_2_014DAD30
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01556DC9 mov eax, dword ptr fs:[00000030h]		1_2_01556DC9
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01556DC9 mov eax, dword ptr fs:[00000030h]		1_2_01556DC9
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01556DC9 mov eax, dword ptr fs:[00000030h]		1_2_01556DC9
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01556DC9 mov ecx, dword ptr fs:[00000030h]		1_2_01556DC9
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01556DC9 mov eax, dword ptr fs:[00000030h]		1_2_01556DC9
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01556DC9 mov eax, dword ptr fs:[00000030h]		1_2_01556DC9
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01588DF1 mov eax, dword ptr fs:[00000030h]		1_2_01588DF1
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014ED5E0 mov eax, dword ptr fs:[00000030h]		1_2_014ED5E0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014ED5E0 mov eax, dword ptr fs:[00000030h]		1_2_014ED5E0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0159FDE2 mov eax, dword ptr fs:[00000030h]		1_2_0159FDE2
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0159FDE2 mov eax, dword ptr fs:[00000030h]		1_2_0159FDE2
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0159FDE2 mov eax, dword ptr fs:[00000030h]		1_2_0159FDE2
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0159FDE2 mov eax, dword ptr fs:[00000030h]		1_2_0159FDE2
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D2D8A mov eax, dword ptr fs:[00000030h]		1_2_014D2D8A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D2D8A mov eax, dword ptr fs:[00000030h]		1_2_014D2D8A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D2D8A mov eax, dword ptr fs:[00000030h]		1_2_014D2D8A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D2D8A mov eax, dword ptr fs:[00000030h]		1_2_014D2D8A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D2D8A mov eax, dword ptr fs:[00000030h]		1_2_014D2D8A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150FD9B mov eax, dword ptr fs:[00000030h]		1_2_0150FD9B
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150FD9B mov eax, dword ptr fs:[00000030h]		1_2_0150FD9B
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01502581 mov eax, dword ptr fs:[00000030h]		1_2_01502581
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01502581 mov eax, dword ptr fs:[00000030h]		1_2_01502581
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01502581 mov eax, dword ptr fs:[00000030h]		1_2_01502581
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01502581 mov eax, dword ptr fs:[00000030h]		1_2_01502581
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01501DB5 mov eax, dword ptr fs:[00000030h]		1_2_01501DB5
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01501DB5 mov eax, dword ptr fs:[00000030h]		1_2_01501DB5
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01501DB5 mov eax, dword ptr fs:[00000030h]		1_2_01501DB5
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015035A1 mov eax, dword ptr fs:[00000030h]		1_2_015035A1
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A05AC mov eax, dword ptr fs:[00000030h]		1_2_015A05AC
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A05AC mov eax, dword ptr fs:[00000030h]		1_2_015A05AC
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0156C450 mov eax, dword ptr fs:[00000030h]		1_2_0156C450
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0156C450 mov eax, dword ptr fs:[00000030h]		1_2_0156C450
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150A44B mov eax, dword ptr fs:[00000030h]		1_2_0150A44B
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014F746D mov eax, dword ptr fs:[00000030h]		1_2_014F746D
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A740D mov eax, dword ptr fs:[00000030h]		1_2_015A740D
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A740D mov eax, dword ptr fs:[00000030h]		1_2_015A740D
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A740D mov eax, dword ptr fs:[00000030h]		1_2_015A740D
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01591C06 mov eax, dword ptr fs:[00000030h]		1_2_01591C06
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01591C06 mov eax, dword ptr fs:[00000030h]		1_2_01591C06
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01591C06 mov eax, dword ptr fs:[00000030h]		1_2_01591C06
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01591C06 mov eax, dword ptr fs:[00000030h]		1_2_01591C06
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01591C06 mov eax, dword ptr fs:[00000030h]		1_2_01591C06
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01591C06 mov eax, dword ptr fs:[00000030h]		1_2_01591C06
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01591C06 mov eax, dword ptr fs:[00000030h]		1_2_01591C06
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01591C06 mov eax, dword ptr fs:[00000030h]		1_2_01591C06
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01591C06 mov eax, dword ptr fs:[00000030h]		1_2_01591C06
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01591C06 mov eax, dword ptr fs:[00000030h]		1_2_01591C06
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01591C06 mov eax, dword ptr fs:[00000030h]		1_2_01591C06
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01591C06 mov eax, dword ptr fs:[00000030h]		1_2_01591C06
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01591C06 mov eax, dword ptr fs:[00000030h]		1_2_01591C06
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01591C06 mov eax, dword ptr fs:[00000030h]		1_2_01591C06
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01556C0A mov eax, dword ptr fs:[00000030h]		1_2_01556C0A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01556C0A mov eax, dword ptr fs:[00000030h]		1_2_01556C0A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01556C0A mov eax, dword ptr fs:[00000030h]		1_2_01556C0A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01556C0A mov eax, dword ptr fs:[00000030h]		1_2_01556C0A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150BC2C mov eax, dword ptr fs:[00000030h]		1_2_0150BC2C
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A8CD6 mov eax, dword ptr fs:[00000030h]		1_2_015A8CD6
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015914FB mov eax, dword ptr fs:[00000030h]		1_2_015914FB
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01556CF0 mov eax, dword ptr fs:[00000030h]		1_2_01556CF0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01556CF0 mov eax, dword ptr fs:[00000030h]		1_2_01556CF0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01556CF0 mov eax, dword ptr fs:[00000030h]		1_2_01556CF0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E849B mov eax, dword ptr fs:[00000030h]		1_2_014E849B
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014EEF40 mov eax, dword ptr fs:[00000030h]		1_2_014EEF40
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014EFF60 mov eax, dword ptr fs:[00000030h]		1_2_014EFF60
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A8F6A mov eax, dword ptr fs:[00000030h]		1_2_015A8F6A
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0156FF10 mov eax, dword ptr fs:[00000030h]		1_2_0156FF10
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0156FF10 mov eax, dword ptr fs:[00000030h]		1_2_0156FF10
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A070D mov eax, dword ptr fs:[00000030h]		1_2_015A070D
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A070D mov eax, dword ptr fs:[00000030h]		1_2_015A070D
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014FF716 mov eax, dword ptr fs:[00000030h]		1_2_014FF716
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150A70E mov eax, dword ptr fs:[00000030h]		1_2_0150A70E
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150A70E mov eax, dword ptr fs:[00000030h]		1_2_0150A70E
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150E730 mov eax, dword ptr fs:[00000030h]		1_2_0150E730
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D4F2E mov eax, dword ptr fs:[00000030h]		1_2_014D4F2E
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014D4F2E mov eax, dword ptr fs:[00000030h]		1_2_014D4F2E
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015137F5 mov eax, dword ptr fs:[00000030h]		1_2_015137F5
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01557794 mov eax, dword ptr fs:[00000030h]		1_2_01557794
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01557794 mov eax, dword ptr fs:[00000030h]		1_2_01557794
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01557794 mov eax, dword ptr fs:[00000030h]		1_2_01557794
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E8794 mov eax, dword ptr fs:[00000030h]		1_2_014E8794
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E7E41 mov eax, dword ptr fs:[00000030h]		1_2_014E7E41
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E7E41 mov eax, dword ptr fs:[00000030h]		1_2_014E7E41
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E7E41 mov eax, dword ptr fs:[00000030h]		1_2_014E7E41
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E7E41 mov eax, dword ptr fs:[00000030h]		1_2_014E7E41
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E7E41 mov eax, dword ptr fs:[00000030h]		1_2_014E7E41
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E7E41 mov eax, dword ptr fs:[00000030h]		1_2_014E7E41
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0159AE44 mov eax, dword ptr fs:[00000030h]		1_2_0159AE44
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0159AE44 mov eax, dword ptr fs:[00000030h]		1_2_0159AE44
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E766D mov eax, dword ptr fs:[00000030h]		1_2_014E766D
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014FAE73 mov eax, dword ptr fs:[00000030h]		1_2_014FAE73
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014FAE73 mov eax, dword ptr fs:[00000030h]		1_2_014FAE73
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014FAE73 mov eax, dword ptr fs:[00000030h]		1_2_014FAE73
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014FAE73 mov eax, dword ptr fs:[00000030h]		1_2_014FAE73
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014FAE73 mov eax, dword ptr fs:[00000030h]		1_2_014FAE73
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150A61C mov eax, dword ptr fs:[00000030h]		1_2_0150A61C
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0150A61C mov eax, dword ptr fs:[00000030h]		1_2_0150A61C
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014DC600 mov eax, dword ptr fs:[00000030h]		1_2_014DC600
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014DC600 mov eax, dword ptr fs:[00000030h]		1_2_014DC600
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014DC600 mov eax, dword ptr fs:[00000030h]		1_2_014DC600
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01508E00 mov eax, dword ptr fs:[00000030h]		1_2_01508E00
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01591608 mov eax, dword ptr fs:[00000030h]		1_2_01591608
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0158FE3F mov eax, dword ptr fs:[00000030h]		1_2_0158FE3F
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014DE620 mov eax, dword ptr fs:[00000030h]		1_2_014DE620
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A8ED6 mov eax, dword ptr fs:[00000030h]		1_2_015A8ED6
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_01518EC7 mov eax, dword ptr fs:[00000030h]		1_2_01518EC7
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0158FEC0 mov eax, dword ptr fs:[00000030h]		1_2_0158FEC0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015036CC mov eax, dword ptr fs:[00000030h]		1_2_015036CC
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_014E76E2 mov eax, dword ptr fs:[00000030h]		1_2_014E76E2
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015016E0 mov ecx, dword ptr fs:[00000030h]		1_2_015016E0
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_0156FE87 mov eax, dword ptr fs:[00000030h]		1_2_0156FE87
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015546A7 mov eax, dword ptr fs:[00000030h]		1_2_015546A7
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A0EA5 mov eax, dword ptr fs:[00000030h]		1_2_015A0EA5
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A0EA5 mov eax, dword ptr fs:[00000030h]		1_2_015A0EA5
Source: C:\Users\user\Desktop\PO98765.exe	Code function: 1_2_015A0EA5 mov eax, dword ptr fs:[00000030h]		1_2_015A0EA5
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0510AD30 mov eax, dword ptr fs:[00000030h]		3_2_0510AD30
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05113D34 mov eax, dword ptr fs:[00000030h]		3_2_05113D34
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05113D34 mov eax, dword ptr fs:[00000030h]		3_2_05113D34
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05113D34 mov eax, dword ptr fs:[00000030h]		3_2_05113D34
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05113D34 mov eax, dword ptr fs:[00000030h]		3_2_05113D34
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05113D34 mov eax, dword ptr fs:[00000030h]		3_2_05113D34
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05113D34 mov eax, dword ptr fs:[00000030h]		3_2_05113D34
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05113D34 mov eax, dword ptr fs:[00000030h]		3_2_05113D34
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05113D34 mov eax, dword ptr fs:[00000030h]		3_2_05113D34
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05113D34 mov eax, dword ptr fs:[00000030h]		3_2_05113D34
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05113D34 mov eax, dword ptr fs:[00000030h]		3_2_05113D34
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05113D34 mov eax, dword ptr fs:[00000030h]		3_2_05113D34
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05113D34 mov eax, dword ptr fs:[00000030h]		3_2_05113D34
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05113D34 mov eax, dword ptr fs:[00000030h]		3_2_05113D34
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051CE539 mov eax, dword ptr fs:[00000030h]		3_2_051CE539
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05134D3B mov eax, dword ptr fs:[00000030h]		3_2_05134D3B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05134D3B mov eax, dword ptr fs:[00000030h]		3_2_05134D3B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05134D3B mov eax, dword ptr fs:[00000030h]		3_2_05134D3B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D8D34 mov eax, dword ptr fs:[00000030h]		3_2_051D8D34
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0518A537 mov eax, dword ptr fs:[00000030h]		3_2_0518A537
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05127D50 mov eax, dword ptr fs:[00000030h]		3_2_05127D50
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05143D43 mov eax, dword ptr fs:[00000030h]		3_2_05143D43
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05183540 mov eax, dword ptr fs:[00000030h]		3_2_05183540
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0512C577 mov eax, dword ptr fs:[00000030h]		3_2_0512C577
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0512C577 mov eax, dword ptr fs:[00000030h]		3_2_0512C577
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513FD9B mov eax, dword ptr fs:[00000030h]		3_2_0513FD9B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513FD9B mov eax, dword ptr fs:[00000030h]		3_2_0513FD9B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05132581 mov eax, dword ptr fs:[00000030h]		3_2_05132581
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05132581 mov eax, dword ptr fs:[00000030h]		3_2_05132581
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05132581 mov eax, dword ptr fs:[00000030h]		3_2_05132581
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05132581 mov eax, dword ptr fs:[00000030h]		3_2_05132581
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05102D8A mov eax, dword ptr fs:[00000030h]		3_2_05102D8A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05102D8A mov eax, dword ptr fs:[00000030h]		3_2_05102D8A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05102D8A mov eax, dword ptr fs:[00000030h]		3_2_05102D8A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05102D8A mov eax, dword ptr fs:[00000030h]		3_2_05102D8A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05102D8A mov eax, dword ptr fs:[00000030h]		3_2_05102D8A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05131DB5 mov eax, dword ptr fs:[00000030h]		3_2_05131DB5
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05131DB5 mov eax, dword ptr fs:[00000030h]		3_2_05131DB5
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05131DB5 mov eax, dword ptr fs:[00000030h]		3_2_05131DB5
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D05AC mov eax, dword ptr fs:[00000030h]		3_2_051D05AC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D05AC mov eax, dword ptr fs:[00000030h]		3_2_051D05AC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051335A1 mov eax, dword ptr fs:[00000030h]		3_2_051335A1
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05186DC9 mov eax, dword ptr fs:[00000030h]		3_2_05186DC9
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05186DC9 mov eax, dword ptr fs:[00000030h]		3_2_05186DC9
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05186DC9 mov eax, dword ptr fs:[00000030h]		3_2_05186DC9
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05186DC9 mov ecx, dword ptr fs:[00000030h]		3_2_05186DC9
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05186DC9 mov eax, dword ptr fs:[00000030h]		3_2_05186DC9
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05186DC9 mov eax, dword ptr fs:[00000030h]		3_2_05186DC9
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051B8DF1 mov eax, dword ptr fs:[00000030h]		3_2_051B8DF1
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0511D5E0 mov eax, dword ptr fs:[00000030h]		3_2_0511D5E0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0511D5E0 mov eax, dword ptr fs:[00000030h]		3_2_0511D5E0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051CFDE2 mov eax, dword ptr fs:[00000030h]		3_2_051CFDE2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051CFDE2 mov eax, dword ptr fs:[00000030h]		3_2_051CFDE2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051CFDE2 mov eax, dword ptr fs:[00000030h]		3_2_051CFDE2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051CFDE2 mov eax, dword ptr fs:[00000030h]		3_2_051CFDE2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D740D mov eax, dword ptr fs:[00000030h]		3_2_051D740D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D740D mov eax, dword ptr fs:[00000030h]		3_2_051D740D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D740D mov eax, dword ptr fs:[00000030h]		3_2_051D740D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05186C0A mov eax, dword ptr fs:[00000030h]		3_2_05186C0A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05186C0A mov eax, dword ptr fs:[00000030h]		3_2_05186C0A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05186C0A mov eax, dword ptr fs:[00000030h]		3_2_05186C0A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05186C0A mov eax, dword ptr fs:[00000030h]		3_2_05186C0A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051C1C06 mov eax, dword ptr fs:[00000030h]		3_2_051C1C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051C1C06 mov eax, dword ptr fs:[00000030h]		3_2_051C1C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051C1C06 mov eax, dword ptr fs:[00000030h]		3_2_051C1C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051C1C06 mov eax, dword ptr fs:[00000030h]		3_2_051C1C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051C1C06 mov eax, dword ptr fs:[00000030h]		3_2_051C1C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051C1C06 mov eax, dword ptr fs:[00000030h]		3_2_051C1C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051C1C06 mov eax, dword ptr fs:[00000030h]		3_2_051C1C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051C1C06 mov eax, dword ptr fs:[00000030h]		3_2_051C1C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051C1C06 mov eax, dword ptr fs:[00000030h]		3_2_051C1C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051C1C06 mov eax, dword ptr fs:[00000030h]		3_2_051C1C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051C1C06 mov eax, dword ptr fs:[00000030h]		3_2_051C1C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051C1C06 mov eax, dword ptr fs:[00000030h]		3_2_051C1C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051C1C06 mov eax, dword ptr fs:[00000030h]		3_2_051C1C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051C1C06 mov eax, dword ptr fs:[00000030h]		3_2_051C1C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513BC2C mov eax, dword ptr fs:[00000030h]		3_2_0513BC2C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0519C450 mov eax, dword ptr fs:[00000030h]		3_2_0519C450
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0519C450 mov eax, dword ptr fs:[00000030h]		3_2_0519C450
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513A44B mov eax, dword ptr fs:[00000030h]		3_2_0513A44B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0512746D mov eax, dword ptr fs:[00000030h]		3_2_0512746D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0511849B mov eax, dword ptr fs:[00000030h]		3_2_0511849B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D8CD6 mov eax, dword ptr fs:[00000030h]		3_2_051D8CD6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051C14FB mov eax, dword ptr fs:[00000030h]		3_2_051C14FB
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05186CF0 mov eax, dword ptr fs:[00000030h]		3_2_05186CF0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05186CF0 mov eax, dword ptr fs:[00000030h]		3_2_05186CF0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05186CF0 mov eax, dword ptr fs:[00000030h]		3_2_05186CF0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0512F716 mov eax, dword ptr fs:[00000030h]		3_2_0512F716
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0519FF10 mov eax, dword ptr fs:[00000030h]		3_2_0519FF10
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0519FF10 mov eax, dword ptr fs:[00000030h]		3_2_0519FF10
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D070D mov eax, dword ptr fs:[00000030h]		3_2_051D070D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D070D mov eax, dword ptr fs:[00000030h]		3_2_051D070D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513A70E mov eax, dword ptr fs:[00000030h]		3_2_0513A70E
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513A70E mov eax, dword ptr fs:[00000030h]		3_2_0513A70E
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513E730 mov eax, dword ptr fs:[00000030h]		3_2_0513E730
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05104F2E mov eax, dword ptr fs:[00000030h]		3_2_05104F2E
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05104F2E mov eax, dword ptr fs:[00000030h]		3_2_05104F2E
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0511EF40 mov eax, dword ptr fs:[00000030h]		3_2_0511EF40
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0511FF60 mov eax, dword ptr fs:[00000030h]		3_2_0511FF60
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D8F6A mov eax, dword ptr fs:[00000030h]		3_2_051D8F6A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05118794 mov eax, dword ptr fs:[00000030h]		3_2_05118794
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05187794 mov eax, dword ptr fs:[00000030h]		3_2_05187794
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05187794 mov eax, dword ptr fs:[00000030h]		3_2_05187794
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05187794 mov eax, dword ptr fs:[00000030h]		3_2_05187794
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051437F5 mov eax, dword ptr fs:[00000030h]		3_2_051437F5
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513A61C mov eax, dword ptr fs:[00000030h]		3_2_0513A61C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513A61C mov eax, dword ptr fs:[00000030h]		3_2_0513A61C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0510C600 mov eax, dword ptr fs:[00000030h]		3_2_0510C600
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0510C600 mov eax, dword ptr fs:[00000030h]		3_2_0510C600
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0510C600 mov eax, dword ptr fs:[00000030h]		3_2_0510C600
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05138E00 mov eax, dword ptr fs:[00000030h]		3_2_05138E00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051C1608 mov eax, dword ptr fs:[00000030h]		3_2_051C1608
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051BFE3F mov eax, dword ptr fs:[00000030h]		3_2_051BFE3F
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0510E620 mov eax, dword ptr fs:[00000030h]		3_2_0510E620
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05117E41 mov eax, dword ptr fs:[00000030h]		3_2_05117E41
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05117E41 mov eax, dword ptr fs:[00000030h]		3_2_05117E41
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05117E41 mov eax, dword ptr fs:[00000030h]		3_2_05117E41
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05117E41 mov eax, dword ptr fs:[00000030h]		3_2_05117E41
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05117E41 mov eax, dword ptr fs:[00000030h]		3_2_05117E41
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05117E41 mov eax, dword ptr fs:[00000030h]		3_2_05117E41
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051CAE44 mov eax, dword ptr fs:[00000030h]		3_2_051CAE44
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051CAE44 mov eax, dword ptr fs:[00000030h]		3_2_051CAE44
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0512AE73 mov eax, dword ptr fs:[00000030h]		3_2_0512AE73
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0512AE73 mov eax, dword ptr fs:[00000030h]		3_2_0512AE73
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0512AE73 mov eax, dword ptr fs:[00000030h]		3_2_0512AE73
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0512AE73 mov eax, dword ptr fs:[00000030h]		3_2_0512AE73
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0512AE73 mov eax, dword ptr fs:[00000030h]		3_2_0512AE73
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0511766D mov eax, dword ptr fs:[00000030h]		3_2_0511766D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0519FE87 mov eax, dword ptr fs:[00000030h]		3_2_0519FE87
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D0EA5 mov eax, dword ptr fs:[00000030h]		3_2_051D0EA5
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D0EA5 mov eax, dword ptr fs:[00000030h]		3_2_051D0EA5
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D0EA5 mov eax, dword ptr fs:[00000030h]		3_2_051D0EA5
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051846A7 mov eax, dword ptr fs:[00000030h]		3_2_051846A7
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D8ED6 mov eax, dword ptr fs:[00000030h]		3_2_051D8ED6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05148EC7 mov eax, dword ptr fs:[00000030h]		3_2_05148EC7
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051BFEC0 mov eax, dword ptr fs:[00000030h]		3_2_051BFEC0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051336CC mov eax, dword ptr fs:[00000030h]		3_2_051336CC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051316E0 mov ecx, dword ptr fs:[00000030h]		3_2_051316E0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051176E2 mov eax, dword ptr fs:[00000030h]		3_2_051176E2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05109100 mov eax, dword ptr fs:[00000030h]		3_2_05109100
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05109100 mov eax, dword ptr fs:[00000030h]		3_2_05109100
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05109100 mov eax, dword ptr fs:[00000030h]		3_2_05109100
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513513A mov eax, dword ptr fs:[00000030h]		3_2_0513513A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513513A mov eax, dword ptr fs:[00000030h]		3_2_0513513A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05124120 mov eax, dword ptr fs:[00000030h]		3_2_05124120
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05124120 mov eax, dword ptr fs:[00000030h]		3_2_05124120
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05124120 mov eax, dword ptr fs:[00000030h]		3_2_05124120
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05124120 mov eax, dword ptr fs:[00000030h]		3_2_05124120
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05124120 mov ecx, dword ptr fs:[00000030h]		3_2_05124120
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0512B944 mov eax, dword ptr fs:[00000030h]		3_2_0512B944
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0512B944 mov eax, dword ptr fs:[00000030h]		3_2_0512B944
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0510B171 mov eax, dword ptr fs:[00000030h]		3_2_0510B171
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0510B171 mov eax, dword ptr fs:[00000030h]		3_2_0510B171
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0510C962 mov eax, dword ptr fs:[00000030h]		3_2_0510C962
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05132990 mov eax, dword ptr fs:[00000030h]		3_2_05132990
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0512C182 mov eax, dword ptr fs:[00000030h]		3_2_0512C182
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513A185 mov eax, dword ptr fs:[00000030h]		3_2_0513A185
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051851BE mov eax, dword ptr fs:[00000030h]		3_2_051851BE
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051851BE mov eax, dword ptr fs:[00000030h]		3_2_051851BE
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051851BE mov eax, dword ptr fs:[00000030h]		3_2_051851BE
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051851BE mov eax, dword ptr fs:[00000030h]		3_2_051851BE
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051361A0 mov eax, dword ptr fs:[00000030h]		3_2_051361A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051361A0 mov eax, dword ptr fs:[00000030h]		3_2_051361A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051869A6 mov eax, dword ptr fs:[00000030h]		3_2_051869A6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051941E8 mov eax, dword ptr fs:[00000030h]		3_2_051941E8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0510B1E1 mov eax, dword ptr fs:[00000030h]		3_2_0510B1E1
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0510B1E1 mov eax, dword ptr fs:[00000030h]		3_2_0510B1E1
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0510B1E1 mov eax, dword ptr fs:[00000030h]		3_2_0510B1E1
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D4015 mov eax, dword ptr fs:[00000030h]		3_2_051D4015
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D4015 mov eax, dword ptr fs:[00000030h]		3_2_051D4015
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05187016 mov eax, dword ptr fs:[00000030h]		3_2_05187016
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05187016 mov eax, dword ptr fs:[00000030h]		3_2_05187016
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05187016 mov eax, dword ptr fs:[00000030h]		3_2_05187016
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0511B02A mov eax, dword ptr fs:[00000030h]		3_2_0511B02A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0511B02A mov eax, dword ptr fs:[00000030h]		3_2_0511B02A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0511B02A mov eax, dword ptr fs:[00000030h]		3_2_0511B02A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0511B02A mov eax, dword ptr fs:[00000030h]		3_2_0511B02A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513002D mov eax, dword ptr fs:[00000030h]		3_2_0513002D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513002D mov eax, dword ptr fs:[00000030h]		3_2_0513002D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513002D mov eax, dword ptr fs:[00000030h]		3_2_0513002D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513002D mov eax, dword ptr fs:[00000030h]		3_2_0513002D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513002D mov eax, dword ptr fs:[00000030h]		3_2_0513002D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05120050 mov eax, dword ptr fs:[00000030h]		3_2_05120050
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05120050 mov eax, dword ptr fs:[00000030h]		3_2_05120050
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D1074 mov eax, dword ptr fs:[00000030h]		3_2_051D1074
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051C2073 mov eax, dword ptr fs:[00000030h]		3_2_051C2073
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05109080 mov eax, dword ptr fs:[00000030h]		3_2_05109080
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05183884 mov eax, dword ptr fs:[00000030h]		3_2_05183884
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05183884 mov eax, dword ptr fs:[00000030h]		3_2_05183884
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513F0BF mov ecx, dword ptr fs:[00000030h]		3_2_0513F0BF
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513F0BF mov eax, dword ptr fs:[00000030h]		3_2_0513F0BF
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513F0BF mov eax, dword ptr fs:[00000030h]		3_2_0513F0BF
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051320A0 mov eax, dword ptr fs:[00000030h]		3_2_051320A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051320A0 mov eax, dword ptr fs:[00000030h]		3_2_051320A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051320A0 mov eax, dword ptr fs:[00000030h]		3_2_051320A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051320A0 mov eax, dword ptr fs:[00000030h]		3_2_051320A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051320A0 mov eax, dword ptr fs:[00000030h]		3_2_051320A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051320A0 mov eax, dword ptr fs:[00000030h]		3_2_051320A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051490AF mov eax, dword ptr fs:[00000030h]		3_2_051490AF
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0519B8D0 mov eax, dword ptr fs:[00000030h]		3_2_0519B8D0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0519B8D0 mov ecx, dword ptr fs:[00000030h]		3_2_0519B8D0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0519B8D0 mov eax, dword ptr fs:[00000030h]		3_2_0519B8D0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0519B8D0 mov eax, dword ptr fs:[00000030h]		3_2_0519B8D0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0519B8D0 mov eax, dword ptr fs:[00000030h]		3_2_0519B8D0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0519B8D0 mov eax, dword ptr fs:[00000030h]		3_2_0519B8D0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051058EC mov eax, dword ptr fs:[00000030h]		3_2_051058EC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051C131B mov eax, dword ptr fs:[00000030h]		3_2_051C131B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D8B58 mov eax, dword ptr fs:[00000030h]		3_2_051D8B58
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0510F358 mov eax, dword ptr fs:[00000030h]		3_2_0510F358
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0510DB40 mov eax, dword ptr fs:[00000030h]		3_2_0510DB40
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05133B7A mov eax, dword ptr fs:[00000030h]		3_2_05133B7A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05133B7A mov eax, dword ptr fs:[00000030h]		3_2_05133B7A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0510DB60 mov ecx, dword ptr fs:[00000030h]		3_2_0510DB60
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_0513B390 mov eax, dword ptr fs:[00000030h]		3_2_0513B390
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05132397 mov eax, dword ptr fs:[00000030h]		3_2_05132397
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051C138A mov eax, dword ptr fs:[00000030h]		3_2_051C138A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051BD380 mov ecx, dword ptr fs:[00000030h]		3_2_051BD380
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05111B8F mov eax, dword ptr fs:[00000030h]		3_2_05111B8F
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05111B8F mov eax, dword ptr fs:[00000030h]		3_2_05111B8F
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051D5BA5 mov eax, dword ptr fs:[00000030h]		3_2_051D5BA5
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05134BAD mov eax, dword ptr fs:[00000030h]		3_2_05134BAD
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05134BAD mov eax, dword ptr fs:[00000030h]		3_2_05134BAD
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_05134BAD mov eax, dword ptr fs:[00000030h]		3_2_05134BAD
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051853CA mov eax, dword ptr fs:[00000030h]		3_2_051853CA
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051853CA mov eax, dword ptr fs:[00000030h]		3_2_051853CA
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 3_2_051303E2 mov eax, dword ptr fs:[00000030h]		3_2_051303E2

Enables debug privileges

Source: C:\Users\user\Desktop\PO98765.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process token adjusted: Debug			Jump to behavior

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\Desktop\PO98765.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 160.122.150.218 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.227.38.74 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\PO98765.exe

Memory written: C:\Users\user\Desktop\PO98765.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\PO98765.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Section loaded: unknown target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Section loaded: unknown target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\PO98765.exe	Thread register set: target process: 3424			Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Thread register set: target process: 3424			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\PO98765.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\PO98765.exe

Section unmapped: C:\Windows\SysWOW64\mstsc.exe base address: 1070000

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\PO98765.exe	Process created: C:\Users\user\Desktop\PO98765.exe C:\Users\user\Desktop\PO98765.exe			Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO98765.exe'			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: explorer.exe, 00000002.00000000.682188809.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000002.00000000.682566937.0000000001080000.00000002.00000001.sdmp, mstsc.exe, 00000003.00000002.923963210.0000000003990000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000002.00000000.696913420.0000000005E50000.00000004.00000001.sdmp, mstsc.exe, 00000003.00000002.923963210.0000000003990000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000002.00000000.682566937.0000000001080000.00000002.00000001.sdmp, mstsc.exe, 00000003.00000002.923963210.0000000003990000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000002.00000000.682566937.0000000001080000.00000002.00000001.sdmp, mstsc.exe, 00000003.00000002.923963210.0000000003990000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000002.00000000.700351269.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\PO98765.exe	Queries volume information: C:\Users\user\Desktop\PO98765.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PO98765.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation			Jump to behavior

Contains functionality to query the account / user name

Source: C:\Users\user\Desktop\PO98765.exe

Code function: 0_2_05BA62D8 GetUserNameA,

0_2_05BA62D8

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\PO98765.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Source: Yara match	File source: 00000003.00000002.923055372.0000000000F40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.923022023.0000000000F10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.679040055.0000000003741000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.715786451.0000000001040000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.922790825.0000000000C70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.715956692.00000000013F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.714949083.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.PO98765.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PO98765.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Source: Yara match	File source: 00000003.00000002.923055372.0000000000F40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.923022023.0000000000F10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.679040055.0000000003741000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.715786451.0000000001040000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.922790825.0000000000C70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.715956692.00000000013F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.714949083.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.PO98765.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PO98765.exe.400000.0.raw.unpack, type: UNPACKEDPE