Windows Analysis Report PO_101&102.exe

Overview

General Information

Sample Name: PO_101&102.exe
Analysis ID: 510596
MD5: d814902ba2d06c94c66f52ce53ed1428
SHA1: 152f01b88a43ae7f0cf486a947bb0b0b23496827
SHA256: cce115dcfb19503dfbc71566681425094ca56887fc1afe85b9bc9788341312bf
Tags: exeformbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Initial sample is a PE file and has a suspicious name
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Modifies the prolog of user mode functions (user mode inline hooks)
Self deletion via cmd delete
Injects a PE file into a foreign processes
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to detect virtual machines (SGDT)

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000009.00000002.348466397.0000000000FB0000.00000040.00020000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.reynbetgirisi.com/snr6/"], "decoy": ["jjglassmi1.com", "vpsseattle.com", "drfllc.top", "staycoolonline.com", "eptlove.com", "solusimatasehat.site", "ionrarecharlestonproperties.com", "b3eflucg.xyz", "tvchosun-usa.com", "mmahzxwzsadqlshop.life", "gospelimport.com", "demoapps.website", "jackburst54.com", "99rocket.education", "ccbwithbri.com", "trapperairsoft.com", "useroadly.com", "ralphlaurenonline-nl.com", "loanmaster4u.com", "champ-beauty-tomigaoka-nail.com", "theripemillennial.com", "123intan.net", "typopendant.com", "coruscant.holdings", "bio-intelligenz-therapie.com", "reprv.com", "directreport.net", "phinespe.xyz", "xuvedae.site", "idilikproperties.info", "wakigaggenin.com", "mal2tech.com", "nftwhaler.xyz", "gxhnjssx.com", "ozba.xyz", "lecupcake.net", "lucid.quest", "kaleoslawncare.com", "tiew.store", "texcommercialpainting.com", "2152351.com", "likewize-xl.com", "dacooligans.com", "manuelmartinezs.com", "beancusp.com", "barbershopvalleyvillage.com", "southwickfunerals.com", "briellebaeslay.info", "rebeccarye.com", "unitedstateswelders.com", "saudiarabiavegan.com", "testcarona.com", "serverapsd.com", "crickx.email", "hdszbj.com", "bennettmountainoutfitter.com", "leileilei1999.xyz", "baroquefolke.com", "francinegeorges.com", "horpces.online", "resolutionfix.com", "mike-schultz.xyz", "sohutobankueahomupezinkv.xyz", "flowerseedqueen.com"]}
Yara detected FormBook
Source: Yara match File source: 9.0.PO_101&102.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.PO_101&102.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.PO_101&102.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.PO_101&102.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.PO_101&102.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.PO_101&102.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO_101&102.exe.3a4c4e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.PO_101&102.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.348466397.0000000000FB0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.333516525.000000000F6F6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.348384221.0000000000D70000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.320955277.000000000F6F6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.542137974.0000000003070000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.539322069.00000000008D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.291465505.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.542399139.00000000030A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.294755714.00000000039A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.348134923.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.291860367.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: www.reynbetgirisi.com/snr6/ Avira URL Cloud: Label: malware
Machine Learning detection for sample
Source: PO_101&102.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 9.0.PO_101&102.exe.400000.8.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 9.0.PO_101&102.exe.400000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 9.2.PO_101&102.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 9.0.PO_101&102.exe.400000.6.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: PO_101&102.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: PO_101&102.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: PO_101&102.exe, 00000009.00000002.348548606.0000000001050000.00000040.00000001.sdmp, wlanext.exe, 0000000D.00000002.543166274.00000000032DF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: PO_101&102.exe, wlanext.exe
Source: Binary string: wlanext.pdb source: PO_101&102.exe, 00000009.00000002.348426415.0000000000DB9000.00000004.00000020.sdmp
Source: Binary string: wlanext.pdbGCTL source: PO_101&102.exe, 00000009.00000002.348426415.0000000000DB9000.00000004.00000020.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 1_2_073184D8
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 1_2_073184C8
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 4x nop then pop ebx 9_2_00407B2D
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 4x nop then pop esi 9_2_0041732F
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 4x nop then pop ebx 13_2_008D7B2D
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 4x nop then pop esi 13_2_008E732F

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49754 -> 52.44.94.227:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49754 -> 52.44.94.227:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49754 -> 52.44.94.227:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.barbershopvalleyvillage.com
Source: C:\Windows\explorer.exe Domain query: www.champ-beauty-tomigaoka-nail.com
Source: C:\Windows\explorer.exe Network Connect: 150.95.255.38 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.reprv.com
Source: C:\Windows\explorer.exe Network Connect: 52.44.94.227 80 Jump to behavior
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.reynbetgirisi.com/snr6/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AMAZON-AESUS AMAZON-AESUS
Source: Joe Sandbox View ASN Name: INTERQGMOInternetIncJP INTERQGMOInternetIncJP
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /snr6/?v0DD=Zy5Qpi9o71BxgS1SycsJXGxeSETLIPANxi7ogI8FlHlRlRfybFGNqMyxmIVsIwo4eCM0&p2MTV=Jf94jZD8vHv8m HTTP/1.1Host: www.barbershopvalleyvillage.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /snr6/?v0DD=AT56xQorg2W9iGq4d7Tt4iWj+Y9aO9Wbdx0aYCn8sjL6tNqdMMFemPCECz3N3nQc4IZ0&p2MTV=Jf94jZD8vHv8m HTTP/1.1Host: www.champ-beauty-tomigaoka-nail.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 150.95.255.38 150.95.255.38
Source: wlanext.exe, 0000000D.00000002.543670677.0000000003C7F000.00000004.00020000.sdmp String found in binary or memory: http://dfltweb1.onamae.com
Source: PO_101&102.exe, 00000001.00000003.273913731.00000000010AD000.00000004.00000001.sdmp String found in binary or memory: http://en.w
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: PO_101&102.exe, 00000001.00000002.293898506.0000000002861000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameP
Source: PO_101&102.exe String found in binary or memory: http://tempuri.org/DatabaseDataSet.xsd
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: PO_101&102.exe, 00000001.00000002.296658993.0000000006A72000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: unknown DNS traffic detected: queries for: www.barbershopvalleyvillage.com
Source: global traffic HTTP traffic detected: GET /snr6/?v0DD=Zy5Qpi9o71BxgS1SycsJXGxeSETLIPANxi7ogI8FlHlRlRfybFGNqMyxmIVsIwo4eCM0&p2MTV=Jf94jZD8vHv8m HTTP/1.1Host: www.barbershopvalleyvillage.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /snr6/?v0DD=AT56xQorg2W9iGq4d7Tt4iWj+Y9aO9Wbdx0aYCn8sjL6tNqdMMFemPCECz3N3nQc4IZ0&p2MTV=Jf94jZD8vHv8m HTTP/1.1Host: www.champ-beauty-tomigaoka-nail.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 9.0.PO_101&102.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.PO_101&102.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.PO_101&102.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.PO_101&102.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.PO_101&102.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.PO_101&102.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO_101&102.exe.3a4c4e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.PO_101&102.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.348466397.0000000000FB0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.333516525.000000000F6F6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.348384221.0000000000D70000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.320955277.000000000F6F6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.542137974.0000000003070000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.539322069.00000000008D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.291465505.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.542399139.00000000030A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.294755714.00000000039A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.348134923.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.291860367.0000000000400000.00000040.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 9.0.PO_101&102.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.PO_101&102.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.0.PO_101&102.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.PO_101&102.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.2.PO_101&102.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.2.PO_101&102.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.0.PO_101&102.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.PO_101&102.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.2.PO_101&102.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.2.PO_101&102.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.0.PO_101&102.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.PO_101&102.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.PO_101&102.exe.3a4c4e0.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.PO_101&102.exe.3a4c4e0.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.0.PO_101&102.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.PO_101&102.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.348466397.0000000000FB0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.348466397.0000000000FB0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000000.333516525.000000000F6F6000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000000.333516525.000000000F6F6000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.348384221.0000000000D70000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.348384221.0000000000D70000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000000.320955277.000000000F6F6000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000000.320955277.000000000F6F6000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.542137974.0000000003070000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.542137974.0000000003070000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.539322069.00000000008D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.539322069.00000000008D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000000.291465505.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000000.291465505.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.542399139.00000000030A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.542399139.00000000030A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.294755714.00000000039A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.294755714.00000000039A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.348134923.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.348134923.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000000.291860367.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000000.291860367.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: PO_101&102.exe
Uses 32bit PE files
Source: PO_101&102.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 9.0.PO_101&102.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.PO_101&102.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.0.PO_101&102.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.PO_101&102.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.2.PO_101&102.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.2.PO_101&102.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.0.PO_101&102.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.PO_101&102.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.2.PO_101&102.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.2.PO_101&102.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.0.PO_101&102.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.PO_101&102.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.PO_101&102.exe.3a4c4e0.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.PO_101&102.exe.3a4c4e0.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.0.PO_101&102.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.PO_101&102.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.348466397.0000000000FB0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.348466397.0000000000FB0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000000.333516525.000000000F6F6000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000000.333516525.000000000F6F6000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.348384221.0000000000D70000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.348384221.0000000000D70000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000000.320955277.000000000F6F6000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000000.320955277.000000000F6F6000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.542137974.0000000003070000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.542137974.0000000003070000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.539322069.00000000008D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.539322069.00000000008D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000000.291465505.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000000.291465505.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.542399139.00000000030A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.542399139.00000000030A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.294755714.00000000039A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.294755714.00000000039A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.348134923.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.348134923.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000000.291860367.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000000.291860367.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_00540E25 1_2_00540E25
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_02749968 1_2_02749968
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_070367B0 1_2_070367B0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_07037EF0 1_2_07037EF0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_07037360 1_2_07037360
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_07031982 1_2_07031982
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_07039830 1_2_07039830
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_070388B8 1_2_070388B8
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_0703A728 1_2_0703A728
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_0703BDF0 1_2_0703BDF0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_07037301 1_2_07037301
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_0703BB90 1_2_0703BB90
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_07032B98 1_2_07032B98
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_0703B2F8 1_2_0703B2F8
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_0703B988 1_2_0703B988
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_073114A8 1_2_073114A8
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_07314380 1_2_07314380
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_07311010 1_2_07311010
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_073140C0 1_2_073140C0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_07311F99 1_2_07311F99
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_073106B5 1_2_073106B5
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_073106B8 1_2_073106B8
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_07310D0D 1_2_07310D0D
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_07313DE1 1_2_07313DE1
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_07312C08 1_2_07312C08
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_07314371 1_2_07314371
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_07311379 1_2_07311379
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_07312BF7 1_2_07312BF7
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_07313227 1_2_07313227
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_07315931 1_2_07315931
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_07311000 1_2_07311000
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_07310007 1_2_07310007
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_07310040 1_2_07310040
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_088B06F0 1_2_088B06F0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_088B0E68 1_2_088B0E68
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_088B5FB8 1_2_088B5FB8
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_088B65D9 1_2_088B65D9
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_088B79F9 1_2_088B79F9
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_088B5FA8 1_2_088B5FA8
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_088B6327 1_2_088B6327
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_088B6338 1_2_088B6338
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_088BF760 1_2_088BF760
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_088B65E8 1_2_088B65E8
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_00401030 9_2_00401030
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0041E83A 9_2_0041E83A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0041DD3A 9_2_0041DD3A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0041EDC6 9_2_0041EDC6
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0041E5DB 9_2_0041E5DB
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_00402D87 9_2_00402D87
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_00402D90 9_2_00402D90
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0041D5A6 9_2_0041D5A6
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_00409E60 9_2_00409E60
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_00402FB0 9_2_00402FB0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_00650E25 9_2_00650E25
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0107F900 9_2_0107F900
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01094120 9_2_01094120
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010999BF 9_2_010999BF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01131002 9_2_01131002
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0114E824 9_2_0114E824
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A830 9_2_0109A830
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0108B090 9_2_0108B090
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A20A0 9_2_010A20A0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_011420A8 9_2_011420A8
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_011428EC 9_2_011428EC
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01142B28 9_2_01142B28
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109AB40 9_2_0109AB40
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0111CB4F 9_2_0111CB4F
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A138B 9_2_010A138B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109EB9A 9_2_0109EB9A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AEBB0 9_2_010AEBB0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0113DBD2 9_2_0113DBD2
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_011303DA 9_2_011303DA
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AABD8 9_2_010AABD8
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_011223E3 9_2_011223E3
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0112FA2B 9_2_0112FA2B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B236 9_2_0109B236
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_011422AE 9_2_011422AE
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134AEF 9_2_01134AEF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01142D07 9_2_01142D07
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01070D20 9_2_01070D20
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01141D55 9_2_01141D55
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A2581 9_2_010A2581
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01132D82 9_2_01132D82
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_011425DD 9_2_011425DD
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0108D5E0 9_2_0108D5E0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0108841F 9_2_0108841F
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0113D466 9_2_0113D466
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B477 9_2_0109B477
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134496 9_2_01134496
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0114DFCE 9_2_0114DFCE
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01141FF1 9_2_01141FF1
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0113D616 9_2_0113D616
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01095600 9_2_01095600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01096E30 9_2_01096E30
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01121EB6 9_2_01121EB6
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01142EF7 9_2_01142EF7
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032B2B28 13_2_032B2B28
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320AB40 13_2_0320AB40
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0321EBB0 13_2_0321EBB0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032A03DA 13_2_032A03DA
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032ADBD2 13_2_032ADBD2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0321ABD8 13_2_0321ABD8
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0329FA2B 13_2_0329FA2B
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032B22AE 13_2_032B22AE
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03204120 13_2_03204120
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_031EF900 13_2_031EF900
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032099BF 13_2_032099BF
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032BE824 13_2_032BE824
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A830 13_2_0320A830
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032A1002 13_2_032A1002
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032120A0 13_2_032120A0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032B20A8 13_2_032B20A8
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_031FB090 13_2_031FB090
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032B28EC 13_2_032B28EC
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032B1FF1 13_2_032B1FF1
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032BDFCE 13_2_032BDFCE
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03206E30 13_2_03206E30
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032AD616 13_2_032AD616
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032B2EF7 13_2_032B2EF7
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032B2D07 13_2_032B2D07
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_031E0D20 13_2_031E0D20
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032B1D55 13_2_032B1D55
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03212581 13_2_03212581
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032B25DD 13_2_032B25DD
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_031FD5E0 13_2_031FD5E0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_031F841F 13_2_031F841F
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032AD466 13_2_032AD466
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008EE83A 13_2_008EE83A
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008D2D87 13_2_008D2D87
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008D2D90 13_2_008D2D90
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008ED5A6 13_2_008ED5A6
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008EE5DB 13_2_008EE5DB
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008D9E60 13_2_008D9E60
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008D2FB0 13_2_008D2FB0
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\wlanext.exe Code function: String function: 031EB150 appears 87 times
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: String function: 0107B150 appears 145 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0041A360 NtCreateFile, 9_2_0041A360
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0041A410 NtReadFile, 9_2_0041A410
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0041A490 NtClose, 9_2_0041A490
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0041A540 NtAllocateVirtualMemory, 9_2_0041A540
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0041A40D NtReadFile, 9_2_0041A40D
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0041A48B NtClose, 9_2_0041A48B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0041A53C NtAllocateVirtualMemory, 9_2_0041A53C
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 9_2_010B9910
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B99A0 NtCreateSection,LdrInitializeThunk, 9_2_010B99A0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9840 NtDelayExecution,LdrInitializeThunk, 9_2_010B9840
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9860 NtQuerySystemInformation,LdrInitializeThunk, 9_2_010B9860
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B98F0 NtReadVirtualMemory,LdrInitializeThunk, 9_2_010B98F0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9A00 NtProtectVirtualMemory,LdrInitializeThunk, 9_2_010B9A00
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9A20 NtResumeThread,LdrInitializeThunk, 9_2_010B9A20
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9A50 NtCreateFile,LdrInitializeThunk, 9_2_010B9A50
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9540 NtReadFile,LdrInitializeThunk, 9_2_010B9540
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B95D0 NtClose,LdrInitializeThunk, 9_2_010B95D0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9710 NtQueryInformationToken,LdrInitializeThunk, 9_2_010B9710
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9780 NtMapViewOfSection,LdrInitializeThunk, 9_2_010B9780
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B97A0 NtUnmapViewOfSection,LdrInitializeThunk, 9_2_010B97A0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9660 NtAllocateVirtualMemory,LdrInitializeThunk, 9_2_010B9660
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B96E0 NtFreeVirtualMemory,LdrInitializeThunk, 9_2_010B96E0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9950 NtQueueApcThread, 9_2_010B9950
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B99D0 NtCreateProcessEx, 9_2_010B99D0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9820 NtEnumerateKey, 9_2_010B9820
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010BB040 NtSuspendThread, 9_2_010BB040
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B98A0 NtWriteVirtualMemory, 9_2_010B98A0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9B00 NtSetValueKey, 9_2_010B9B00
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010BA3B0 NtGetContextThread, 9_2_010BA3B0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9A10 NtQuerySection, 9_2_010B9A10
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9A80 NtOpenDirectoryObject, 9_2_010B9A80
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9520 NtWaitForSingleObject, 9_2_010B9520
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010BAD30 NtSetContextThread, 9_2_010BAD30
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9560 NtWriteFile, 9_2_010B9560
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B95F0 NtQueryInformationFile, 9_2_010B95F0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010BA710 NtOpenProcessToken, 9_2_010BA710
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9730 NtQueryVirtualMemory, 9_2_010B9730
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9760 NtOpenProcess, 9_2_010B9760
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010BA770 NtOpenThread, 9_2_010BA770
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9770 NtSetInformationFile, 9_2_010B9770
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9FE0 NtCreateMutant, 9_2_010B9FE0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9610 NtEnumerateValueKey, 9_2_010B9610
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9650 NtQueryValueKey, 9_2_010B9650
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B9670 NtQueryInformationProcess, 9_2_010B9670
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B96D0 NtCreateKey, 9_2_010B96D0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229A50 NtCreateFile,LdrInitializeThunk, 13_2_03229A50
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229910 NtAdjustPrivilegesToken,LdrInitializeThunk, 13_2_03229910
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032299A0 NtCreateSection,LdrInitializeThunk, 13_2_032299A0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229860 NtQuerySystemInformation,LdrInitializeThunk, 13_2_03229860
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229840 NtDelayExecution,LdrInitializeThunk, 13_2_03229840
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229710 NtQueryInformationToken,LdrInitializeThunk, 13_2_03229710
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229780 NtMapViewOfSection,LdrInitializeThunk, 13_2_03229780
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229FE0 NtCreateMutant,LdrInitializeThunk, 13_2_03229FE0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229660 NtAllocateVirtualMemory,LdrInitializeThunk, 13_2_03229660
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229650 NtQueryValueKey,LdrInitializeThunk, 13_2_03229650
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032296E0 NtFreeVirtualMemory,LdrInitializeThunk, 13_2_032296E0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032296D0 NtCreateKey,LdrInitializeThunk, 13_2_032296D0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229540 NtReadFile,LdrInitializeThunk, 13_2_03229540
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032295D0 NtClose,LdrInitializeThunk, 13_2_032295D0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229B00 NtSetValueKey, 13_2_03229B00
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0322A3B0 NtGetContextThread, 13_2_0322A3B0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229A20 NtResumeThread, 13_2_03229A20
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229A00 NtProtectVirtualMemory, 13_2_03229A00
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229A10 NtQuerySection, 13_2_03229A10
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229A80 NtOpenDirectoryObject, 13_2_03229A80
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229950 NtQueueApcThread, 13_2_03229950
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032299D0 NtCreateProcessEx, 13_2_032299D0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229820 NtEnumerateKey, 13_2_03229820
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0322B040 NtSuspendThread, 13_2_0322B040
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032298A0 NtWriteVirtualMemory, 13_2_032298A0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032298F0 NtReadVirtualMemory, 13_2_032298F0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229730 NtQueryVirtualMemory, 13_2_03229730
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0322A710 NtOpenProcessToken, 13_2_0322A710
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229760 NtOpenProcess, 13_2_03229760
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0322A770 NtOpenThread, 13_2_0322A770
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229770 NtSetInformationFile, 13_2_03229770
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032297A0 NtUnmapViewOfSection, 13_2_032297A0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229610 NtEnumerateValueKey, 13_2_03229610
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229670 NtQueryInformationProcess, 13_2_03229670
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229520 NtWaitForSingleObject, 13_2_03229520
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0322AD30 NtSetContextThread, 13_2_0322AD30
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03229560 NtWriteFile, 13_2_03229560
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032295F0 NtQueryInformationFile, 13_2_032295F0
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008EA360 NtCreateFile, 13_2_008EA360
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008EA490 NtClose, 13_2_008EA490
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008EA410 NtReadFile, 13_2_008EA410
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008EA540 NtAllocateVirtualMemory, 13_2_008EA540
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008EA48B NtClose, 13_2_008EA48B
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008EA40D NtReadFile, 13_2_008EA40D
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008EA53C NtAllocateVirtualMemory, 13_2_008EA53C
Sample file is different than original file name gathered from version info
Source: PO_101&102.exe Binary or memory string: OriginalFilename vs PO_101&102.exe
Source: PO_101&102.exe, 00000001.00000000.271922534.0000000000532000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamerfNVoNr.exe4 vs PO_101&102.exe
Source: PO_101&102.exe, 00000001.00000002.297143567.0000000006E60000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameBunifu.UI.dll4 vs PO_101&102.exe
Source: PO_101&102.exe, 00000001.00000002.294074675.00000000029EB000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameMajorRevision.exe< vs PO_101&102.exe
Source: PO_101&102.exe Binary or memory string: OriginalFilename vs PO_101&102.exe
Source: PO_101&102.exe, 00000009.00000002.348426415.0000000000DB9000.00000004.00000020.sdmp Binary or memory string: OriginalFilenamewlanext.exej% vs PO_101&102.exe
Source: PO_101&102.exe, 00000009.00000000.289871341.0000000000642000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamerfNVoNr.exe4 vs PO_101&102.exe
Source: PO_101&102.exe, 00000009.00000002.348907835.00000000012FF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs PO_101&102.exe
Source: PO_101&102.exe Binary or memory string: OriginalFilenamerfNVoNr.exe4 vs PO_101&102.exe
Source: PO_101&102.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\PO_101&102.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\PO_101&102.exe 'C:\Users\user\Desktop\PO_101&102.exe'
Source: C:\Users\user\Desktop\PO_101&102.exe Process created: C:\Users\user\Desktop\PO_101&102.exe {path}
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\wlanext.exe C:\Windows\SysWOW64\wlanext.exe
Source: C:\Windows\SysWOW64\wlanext.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO_101&102.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO_101&102.exe Process created: C:\Users\user\Desktop\PO_101&102.exe {path} Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO_101&102.exe' Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO_101&102.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/1@4/2
Source: C:\Users\user\Desktop\PO_101&102.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: PO_101&102.exe Joe Sandbox Cloud Basic: Detection: clean Score: 0 Perma Link
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4008:120:WilError_01
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: PO_101&102.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: PO_101&102.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: PO_101&102.exe, 00000009.00000002.348548606.0000000001050000.00000040.00000001.sdmp, wlanext.exe, 0000000D.00000002.543166274.00000000032DF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: PO_101&102.exe, wlanext.exe
Source: Binary string: wlanext.pdb source: PO_101&102.exe, 00000009.00000002.348426415.0000000000DB9000.00000004.00000020.sdmp
Source: Binary string: wlanext.pdbGCTL source: PO_101&102.exe, 00000009.00000002.348426415.0000000000DB9000.00000004.00000020.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_00534FA2 push 00000000h; iretd 1_2_00534FEC
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_073192DD push FFFFFF8Bh; iretd 1_2_073192DF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_088B3CEC push eax; ret 1_2_088B3CED
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_088BAC05 push ds; iretd 1_2_088BAC0B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0041EA41 push eax; ret 9_2_0041EB9B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_00407B2B pushfd ; iretd 9_2_00407B2C
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0041ABC6 push edx; ret 9_2_0041ABC8
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_00417C75 push eax; ret 9_2_00417C8B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_004164E9 push ebx; iretd 9_2_004164F2
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0041D4B5 push eax; ret 9_2_0041D508
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0041656B push esp; iretd 9_2_0041656C
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0041D56C push eax; ret 9_2_0041D572
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0041D502 push eax; ret 9_2_0041D508
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0041D50B push eax; ret 9_2_0041D572
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0041DD3A push eax; ret 9_2_0041DB23
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0041D5A6 push eax; ret 9_2_0041DB23
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_00403633 push eax; iretd 9_2_0040363E
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_00644FA2 push 00000000h; iretd 9_2_00644FEC
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010CD0D1 push ecx; ret 9_2_010CD0E4
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0323D0D1 push ecx; ret 13_2_0323D0E4
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008EEA41 push eax; ret 13_2_008EEB9B
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008EABC6 push edx; ret 13_2_008EABC8
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008D7B2B pushfd ; iretd 13_2_008D7B2C
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008ED4B5 push eax; ret 13_2_008ED508
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008E64E9 push ebx; iretd 13_2_008E64F2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008E7C75 push eax; ret 13_2_008E7C8B
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008ED5A6 push eax; ret 13_2_008EDB23
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008ED50B push eax; ret 13_2_008ED572
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008ED502 push eax; ret 13_2_008ED508
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008ED56C push eax; ret 13_2_008ED572
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_008E656B push esp; iretd 13_2_008E656C
Source: initial sample Static PE information: section name: .text entropy: 7.43356279731

Hooking and other Techniques for Hiding and Protection:

barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x81 0x1E 0xEA
Self deletion via cmd delete
Source: C:\Windows\SysWOW64\wlanext.exe Process created: /c del 'C:\Users\user\Desktop\PO_101&102.exe'
Source: C:\Windows\SysWOW64\wlanext.exe Process created: /c del 'C:\Users\user\Desktop\PO_101&102.exe' Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: PO_101&102.exe PID: 7068, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: PO_101&102.exe, 00000001.00000002.293938102.00000000028C0000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: PO_101&102.exe, 00000001.00000002.293938102.00000000028C0000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\PO_101&102.exe RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\PO_101&102.exe RDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wlanext.exe RDTSC instruction interceptor: First address: 00000000008D9904 second address: 00000000008D990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\wlanext.exe RDTSC instruction interceptor: First address: 00000000008D9B7E second address: 00000000008D9B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\PO_101&102.exe TID: 7072 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe TID: 7120 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 1964 Thread sleep time: -52000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe TID: 6792 Thread sleep time: -42000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\wlanext.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\wlanext.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_00409AB0 rdtsc 9_2_00409AB0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\PO_101&102.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Contains functionality to detect virtual machines (SGDT)
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 1_2_0053985B sgdt fword ptr [eax] 1_2_0053985B
Source: C:\Users\user\Desktop\PO_101&102.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: PO_101&102.exe, 00000001.00000002.293938102.00000000028C0000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: explorer.exe, 0000000A.00000000.326896307.00000000047D0000.00000004.00000001.sdmp Binary or memory string: War&Prod_VMware_SATA
Source: explorer.exe, 0000000A.00000000.318948809.00000000086C9000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: PO_101&102.exe, 00000001.00000002.293938102.00000000028C0000.00000004.00000001.sdmp Binary or memory string: vmware
Source: explorer.exe, 0000000A.00000000.305586847.0000000008778000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: PO_101&102.exe, 00000001.00000002.293938102.00000000028C0000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: PO_101&102.exe, 00000001.00000002.293938102.00000000028C0000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 0000000A.00000000.299282553.00000000067C2000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000A.00000000.318948809.00000000086C9000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: explorer.exe, 0000000A.00000000.299282553.00000000067C2000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: PO_101&102.exe, 00000001.00000002.293938102.00000000028C0000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: PO_101&102.exe, 00000001.00000002.293938102.00000000028C0000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: PO_101&102.exe, 00000001.00000002.293938102.00000000028C0000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: PO_101&102.exe, 00000001.00000002.293938102.00000000028C0000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: PO_101&102.exe, 00000001.00000002.293938102.00000000028C0000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 0000000A.00000000.318948809.00000000086C9000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_00409AB0 rdtsc 9_2_00409AB0
Enables debug privileges
Source: C:\Users\user\Desktop\PO_101&102.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01079100 mov eax, dword ptr fs:[00000030h] 9_2_01079100
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01079100 mov eax, dword ptr fs:[00000030h] 9_2_01079100
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01079100 mov eax, dword ptr fs:[00000030h] 9_2_01079100
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01094120 mov eax, dword ptr fs:[00000030h] 9_2_01094120
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01094120 mov eax, dword ptr fs:[00000030h] 9_2_01094120
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01094120 mov eax, dword ptr fs:[00000030h] 9_2_01094120
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01094120 mov eax, dword ptr fs:[00000030h] 9_2_01094120
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01094120 mov ecx, dword ptr fs:[00000030h] 9_2_01094120
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A513A mov eax, dword ptr fs:[00000030h] 9_2_010A513A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A513A mov eax, dword ptr fs:[00000030h] 9_2_010A513A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B944 mov eax, dword ptr fs:[00000030h] 9_2_0109B944
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B944 mov eax, dword ptr fs:[00000030h] 9_2_0109B944
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0107C962 mov eax, dword ptr fs:[00000030h] 9_2_0107C962
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0107B171 mov eax, dword ptr fs:[00000030h] 9_2_0107B171
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0107B171 mov eax, dword ptr fs:[00000030h] 9_2_0107B171
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109C182 mov eax, dword ptr fs:[00000030h] 9_2_0109C182
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AA185 mov eax, dword ptr fs:[00000030h] 9_2_010AA185
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A2990 mov eax, dword ptr fs:[00000030h] 9_2_010A2990
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A4190 mov eax, dword ptr fs:[00000030h] 9_2_010A4190
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F69A6 mov eax, dword ptr fs:[00000030h] 9_2_010F69A6
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A61A0 mov eax, dword ptr fs:[00000030h] 9_2_010A61A0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A61A0 mov eax, dword ptr fs:[00000030h] 9_2_010A61A0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F51BE mov eax, dword ptr fs:[00000030h] 9_2_010F51BE
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F51BE mov eax, dword ptr fs:[00000030h] 9_2_010F51BE
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F51BE mov eax, dword ptr fs:[00000030h] 9_2_010F51BE
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F51BE mov eax, dword ptr fs:[00000030h] 9_2_010F51BE
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010999BF mov ecx, dword ptr fs:[00000030h] 9_2_010999BF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010999BF mov ecx, dword ptr fs:[00000030h] 9_2_010999BF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010999BF mov eax, dword ptr fs:[00000030h] 9_2_010999BF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010999BF mov ecx, dword ptr fs:[00000030h] 9_2_010999BF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010999BF mov ecx, dword ptr fs:[00000030h] 9_2_010999BF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010999BF mov eax, dword ptr fs:[00000030h] 9_2_010999BF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010999BF mov ecx, dword ptr fs:[00000030h] 9_2_010999BF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010999BF mov ecx, dword ptr fs:[00000030h] 9_2_010999BF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010999BF mov eax, dword ptr fs:[00000030h] 9_2_010999BF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010999BF mov ecx, dword ptr fs:[00000030h] 9_2_010999BF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010999BF mov ecx, dword ptr fs:[00000030h] 9_2_010999BF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010999BF mov eax, dword ptr fs:[00000030h] 9_2_010999BF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_011349A4 mov eax, dword ptr fs:[00000030h] 9_2_011349A4
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_011349A4 mov eax, dword ptr fs:[00000030h] 9_2_011349A4
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_011349A4 mov eax, dword ptr fs:[00000030h] 9_2_011349A4
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_011349A4 mov eax, dword ptr fs:[00000030h] 9_2_011349A4
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0107B1E1 mov eax, dword ptr fs:[00000030h] 9_2_0107B1E1
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0107B1E1 mov eax, dword ptr fs:[00000030h] 9_2_0107B1E1
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0107B1E1 mov eax, dword ptr fs:[00000030h] 9_2_0107B1E1
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_011041E8 mov eax, dword ptr fs:[00000030h] 9_2_011041E8
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01144015 mov eax, dword ptr fs:[00000030h] 9_2_01144015
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01144015 mov eax, dword ptr fs:[00000030h] 9_2_01144015
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F7016 mov eax, dword ptr fs:[00000030h] 9_2_010F7016
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F7016 mov eax, dword ptr fs:[00000030h] 9_2_010F7016
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F7016 mov eax, dword ptr fs:[00000030h] 9_2_010F7016
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0108B02A mov eax, dword ptr fs:[00000030h] 9_2_0108B02A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0108B02A mov eax, dword ptr fs:[00000030h] 9_2_0108B02A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0108B02A mov eax, dword ptr fs:[00000030h] 9_2_0108B02A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0108B02A mov eax, dword ptr fs:[00000030h] 9_2_0108B02A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A002D mov eax, dword ptr fs:[00000030h] 9_2_010A002D
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A002D mov eax, dword ptr fs:[00000030h] 9_2_010A002D
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A002D mov eax, dword ptr fs:[00000030h] 9_2_010A002D
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A002D mov eax, dword ptr fs:[00000030h] 9_2_010A002D
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A002D mov eax, dword ptr fs:[00000030h] 9_2_010A002D
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A830 mov eax, dword ptr fs:[00000030h] 9_2_0109A830
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A830 mov eax, dword ptr fs:[00000030h] 9_2_0109A830
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A830 mov eax, dword ptr fs:[00000030h] 9_2_0109A830
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A830 mov eax, dword ptr fs:[00000030h] 9_2_0109A830
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01090050 mov eax, dword ptr fs:[00000030h] 9_2_01090050
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01090050 mov eax, dword ptr fs:[00000030h] 9_2_01090050
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01132073 mov eax, dword ptr fs:[00000030h] 9_2_01132073
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01141074 mov eax, dword ptr fs:[00000030h] 9_2_01141074
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01079080 mov eax, dword ptr fs:[00000030h] 9_2_01079080
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F3884 mov eax, dword ptr fs:[00000030h] 9_2_010F3884
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F3884 mov eax, dword ptr fs:[00000030h] 9_2_010F3884
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B90AF mov eax, dword ptr fs:[00000030h] 9_2_010B90AF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A20A0 mov eax, dword ptr fs:[00000030h] 9_2_010A20A0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A20A0 mov eax, dword ptr fs:[00000030h] 9_2_010A20A0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A20A0 mov eax, dword ptr fs:[00000030h] 9_2_010A20A0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A20A0 mov eax, dword ptr fs:[00000030h] 9_2_010A20A0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A20A0 mov eax, dword ptr fs:[00000030h] 9_2_010A20A0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A20A0 mov eax, dword ptr fs:[00000030h] 9_2_010A20A0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AF0BF mov ecx, dword ptr fs:[00000030h] 9_2_010AF0BF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AF0BF mov eax, dword ptr fs:[00000030h] 9_2_010AF0BF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AF0BF mov eax, dword ptr fs:[00000030h] 9_2_010AF0BF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0110B8D0 mov eax, dword ptr fs:[00000030h] 9_2_0110B8D0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0110B8D0 mov ecx, dword ptr fs:[00000030h] 9_2_0110B8D0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0110B8D0 mov eax, dword ptr fs:[00000030h] 9_2_0110B8D0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0110B8D0 mov eax, dword ptr fs:[00000030h] 9_2_0110B8D0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0110B8D0 mov eax, dword ptr fs:[00000030h] 9_2_0110B8D0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0110B8D0 mov eax, dword ptr fs:[00000030h] 9_2_0110B8D0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010740E1 mov eax, dword ptr fs:[00000030h] 9_2_010740E1
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010740E1 mov eax, dword ptr fs:[00000030h] 9_2_010740E1
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010740E1 mov eax, dword ptr fs:[00000030h] 9_2_010740E1
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010758EC mov eax, dword ptr fs:[00000030h] 9_2_010758EC
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B8E4 mov eax, dword ptr fs:[00000030h] 9_2_0109B8E4
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B8E4 mov eax, dword ptr fs:[00000030h] 9_2_0109B8E4
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 mov eax, dword ptr fs:[00000030h] 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 mov eax, dword ptr fs:[00000030h] 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 mov eax, dword ptr fs:[00000030h] 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 mov eax, dword ptr fs:[00000030h] 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 mov eax, dword ptr fs:[00000030h] 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 mov eax, dword ptr fs:[00000030h] 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 mov eax, dword ptr fs:[00000030h] 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 mov eax, dword ptr fs:[00000030h] 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 mov eax, dword ptr fs:[00000030h] 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 mov eax, dword ptr fs:[00000030h] 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 mov eax, dword ptr fs:[00000030h] 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 mov eax, dword ptr fs:[00000030h] 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 mov eax, dword ptr fs:[00000030h] 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 mov eax, dword ptr fs:[00000030h] 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 mov eax, dword ptr fs:[00000030h] 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 mov eax, dword ptr fs:[00000030h] 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 mov eax, dword ptr fs:[00000030h] 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 mov eax, dword ptr fs:[00000030h] 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 mov eax, dword ptr fs:[00000030h] 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 mov eax, dword ptr fs:[00000030h] 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A309 mov eax, dword ptr fs:[00000030h] 9_2_0109A309
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0113131B mov eax, dword ptr fs:[00000030h] 9_2_0113131B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0107DB40 mov eax, dword ptr fs:[00000030h] 9_2_0107DB40
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01148B58 mov eax, dword ptr fs:[00000030h] 9_2_01148B58
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0107F358 mov eax, dword ptr fs:[00000030h] 9_2_0107F358
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0107DB60 mov ecx, dword ptr fs:[00000030h] 9_2_0107DB60
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A3B7A mov eax, dword ptr fs:[00000030h] 9_2_010A3B7A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A3B7A mov eax, dword ptr fs:[00000030h] 9_2_010A3B7A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A138B mov eax, dword ptr fs:[00000030h] 9_2_010A138B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A138B mov eax, dword ptr fs:[00000030h] 9_2_010A138B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A138B mov eax, dword ptr fs:[00000030h] 9_2_010A138B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01081B8F mov eax, dword ptr fs:[00000030h] 9_2_01081B8F
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01081B8F mov eax, dword ptr fs:[00000030h] 9_2_01081B8F
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0112D380 mov ecx, dword ptr fs:[00000030h] 9_2_0112D380
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109EB9A mov eax, dword ptr fs:[00000030h] 9_2_0109EB9A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109EB9A mov eax, dword ptr fs:[00000030h] 9_2_0109EB9A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0113138A mov eax, dword ptr fs:[00000030h] 9_2_0113138A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AB390 mov eax, dword ptr fs:[00000030h] 9_2_010AB390
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A2397 mov eax, dword ptr fs:[00000030h] 9_2_010A2397
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A4BAD mov eax, dword ptr fs:[00000030h] 9_2_010A4BAD
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A4BAD mov eax, dword ptr fs:[00000030h] 9_2_010A4BAD
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A4BAD mov eax, dword ptr fs:[00000030h] 9_2_010A4BAD
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01145BA5 mov eax, dword ptr fs:[00000030h] 9_2_01145BA5
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F53CA mov eax, dword ptr fs:[00000030h] 9_2_010F53CA
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F53CA mov eax, dword ptr fs:[00000030h] 9_2_010F53CA
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A53C5 mov eax, dword ptr fs:[00000030h] 9_2_010A53C5
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109DBE9 mov eax, dword ptr fs:[00000030h] 9_2_0109DBE9
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A03E2 mov eax, dword ptr fs:[00000030h] 9_2_010A03E2
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A03E2 mov eax, dword ptr fs:[00000030h] 9_2_010A03E2
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A03E2 mov eax, dword ptr fs:[00000030h] 9_2_010A03E2
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A03E2 mov eax, dword ptr fs:[00000030h] 9_2_010A03E2
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A03E2 mov eax, dword ptr fs:[00000030h] 9_2_010A03E2
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A03E2 mov eax, dword ptr fs:[00000030h] 9_2_010A03E2
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_011223E3 mov ecx, dword ptr fs:[00000030h] 9_2_011223E3
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_011223E3 mov ecx, dword ptr fs:[00000030h] 9_2_011223E3
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_011223E3 mov eax, dword ptr fs:[00000030h] 9_2_011223E3
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01088A0A mov eax, dword ptr fs:[00000030h] 9_2_01088A0A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0113AA16 mov eax, dword ptr fs:[00000030h] 9_2_0113AA16
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0113AA16 mov eax, dword ptr fs:[00000030h] 9_2_0113AA16
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0107AA16 mov eax, dword ptr fs:[00000030h] 9_2_0107AA16
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0107AA16 mov eax, dword ptr fs:[00000030h] 9_2_0107AA16
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01093A1C mov eax, dword ptr fs:[00000030h] 9_2_01093A1C
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01075210 mov eax, dword ptr fs:[00000030h] 9_2_01075210
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01075210 mov ecx, dword ptr fs:[00000030h] 9_2_01075210
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01075210 mov eax, dword ptr fs:[00000030h] 9_2_01075210
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01075210 mov eax, dword ptr fs:[00000030h] 9_2_01075210
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A229 mov eax, dword ptr fs:[00000030h] 9_2_0109A229
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A229 mov eax, dword ptr fs:[00000030h] 9_2_0109A229
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A229 mov eax, dword ptr fs:[00000030h] 9_2_0109A229
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A229 mov eax, dword ptr fs:[00000030h] 9_2_0109A229
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A229 mov eax, dword ptr fs:[00000030h] 9_2_0109A229
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A229 mov eax, dword ptr fs:[00000030h] 9_2_0109A229
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A229 mov eax, dword ptr fs:[00000030h] 9_2_0109A229
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A229 mov eax, dword ptr fs:[00000030h] 9_2_0109A229
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109A229 mov eax, dword ptr fs:[00000030h] 9_2_0109A229
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B4A2C mov eax, dword ptr fs:[00000030h] 9_2_010B4A2C
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B4A2C mov eax, dword ptr fs:[00000030h] 9_2_010B4A2C
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01131229 mov eax, dword ptr fs:[00000030h] 9_2_01131229
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B236 mov eax, dword ptr fs:[00000030h] 9_2_0109B236
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B236 mov eax, dword ptr fs:[00000030h] 9_2_0109B236
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B236 mov eax, dword ptr fs:[00000030h] 9_2_0109B236
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B236 mov eax, dword ptr fs:[00000030h] 9_2_0109B236
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B236 mov eax, dword ptr fs:[00000030h] 9_2_0109B236
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B236 mov eax, dword ptr fs:[00000030h] 9_2_0109B236
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0113EA55 mov eax, dword ptr fs:[00000030h] 9_2_0113EA55
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01079240 mov eax, dword ptr fs:[00000030h] 9_2_01079240
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01079240 mov eax, dword ptr fs:[00000030h] 9_2_01079240
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01079240 mov eax, dword ptr fs:[00000030h] 9_2_01079240
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01079240 mov eax, dword ptr fs:[00000030h] 9_2_01079240
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01104257 mov eax, dword ptr fs:[00000030h] 9_2_01104257
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B5A69 mov eax, dword ptr fs:[00000030h] 9_2_010B5A69
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B5A69 mov eax, dword ptr fs:[00000030h] 9_2_010B5A69
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B5A69 mov eax, dword ptr fs:[00000030h] 9_2_010B5A69
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B927A mov eax, dword ptr fs:[00000030h] 9_2_010B927A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0112B260 mov eax, dword ptr fs:[00000030h] 9_2_0112B260
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0112B260 mov eax, dword ptr fs:[00000030h] 9_2_0112B260
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01148A62 mov eax, dword ptr fs:[00000030h] 9_2_01148A62
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AD294 mov eax, dword ptr fs:[00000030h] 9_2_010AD294
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AD294 mov eax, dword ptr fs:[00000030h] 9_2_010AD294
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010752A5 mov eax, dword ptr fs:[00000030h] 9_2_010752A5
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010752A5 mov eax, dword ptr fs:[00000030h] 9_2_010752A5
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010752A5 mov eax, dword ptr fs:[00000030h] 9_2_010752A5
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010752A5 mov eax, dword ptr fs:[00000030h] 9_2_010752A5
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010752A5 mov eax, dword ptr fs:[00000030h] 9_2_010752A5
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0108AAB0 mov eax, dword ptr fs:[00000030h] 9_2_0108AAB0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0108AAB0 mov eax, dword ptr fs:[00000030h] 9_2_0108AAB0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AFAB0 mov eax, dword ptr fs:[00000030h] 9_2_010AFAB0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A2ACB mov eax, dword ptr fs:[00000030h] 9_2_010A2ACB
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A2AE4 mov eax, dword ptr fs:[00000030h] 9_2_010A2AE4
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134AEF mov eax, dword ptr fs:[00000030h] 9_2_01134AEF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134AEF mov eax, dword ptr fs:[00000030h] 9_2_01134AEF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134AEF mov eax, dword ptr fs:[00000030h] 9_2_01134AEF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134AEF mov eax, dword ptr fs:[00000030h] 9_2_01134AEF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134AEF mov eax, dword ptr fs:[00000030h] 9_2_01134AEF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134AEF mov eax, dword ptr fs:[00000030h] 9_2_01134AEF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134AEF mov eax, dword ptr fs:[00000030h] 9_2_01134AEF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134AEF mov eax, dword ptr fs:[00000030h] 9_2_01134AEF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134AEF mov eax, dword ptr fs:[00000030h] 9_2_01134AEF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134AEF mov eax, dword ptr fs:[00000030h] 9_2_01134AEF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134AEF mov eax, dword ptr fs:[00000030h] 9_2_01134AEF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134AEF mov eax, dword ptr fs:[00000030h] 9_2_01134AEF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134AEF mov eax, dword ptr fs:[00000030h] 9_2_01134AEF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134AEF mov eax, dword ptr fs:[00000030h] 9_2_01134AEF
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01148D34 mov eax, dword ptr fs:[00000030h] 9_2_01148D34
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0113E539 mov eax, dword ptr fs:[00000030h] 9_2_0113E539
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AF527 mov eax, dword ptr fs:[00000030h] 9_2_010AF527
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AF527 mov eax, dword ptr fs:[00000030h] 9_2_010AF527
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AF527 mov eax, dword ptr fs:[00000030h] 9_2_010AF527
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A4D3B mov eax, dword ptr fs:[00000030h] 9_2_010A4D3B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A4D3B mov eax, dword ptr fs:[00000030h] 9_2_010A4D3B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A4D3B mov eax, dword ptr fs:[00000030h] 9_2_010A4D3B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0107AD30 mov eax, dword ptr fs:[00000030h] 9_2_0107AD30
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010FA537 mov eax, dword ptr fs:[00000030h] 9_2_010FA537
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01083D34 mov eax, dword ptr fs:[00000030h] 9_2_01083D34
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01083D34 mov eax, dword ptr fs:[00000030h] 9_2_01083D34
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01083D34 mov eax, dword ptr fs:[00000030h] 9_2_01083D34
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01083D34 mov eax, dword ptr fs:[00000030h] 9_2_01083D34
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01083D34 mov eax, dword ptr fs:[00000030h] 9_2_01083D34
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01083D34 mov eax, dword ptr fs:[00000030h] 9_2_01083D34
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01083D34 mov eax, dword ptr fs:[00000030h] 9_2_01083D34
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01083D34 mov eax, dword ptr fs:[00000030h] 9_2_01083D34
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01083D34 mov eax, dword ptr fs:[00000030h] 9_2_01083D34
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01083D34 mov eax, dword ptr fs:[00000030h] 9_2_01083D34
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01083D34 mov eax, dword ptr fs:[00000030h] 9_2_01083D34
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01083D34 mov eax, dword ptr fs:[00000030h] 9_2_01083D34
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01083D34 mov eax, dword ptr fs:[00000030h] 9_2_01083D34
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B3D43 mov eax, dword ptr fs:[00000030h] 9_2_010B3D43
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F3540 mov eax, dword ptr fs:[00000030h] 9_2_010F3540
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01123D40 mov eax, dword ptr fs:[00000030h] 9_2_01123D40
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01097D50 mov eax, dword ptr fs:[00000030h] 9_2_01097D50
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109C577 mov eax, dword ptr fs:[00000030h] 9_2_0109C577
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109C577 mov eax, dword ptr fs:[00000030h] 9_2_0109C577
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01098D76 mov eax, dword ptr fs:[00000030h] 9_2_01098D76
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01098D76 mov eax, dword ptr fs:[00000030h] 9_2_01098D76
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01098D76 mov eax, dword ptr fs:[00000030h] 9_2_01098D76
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01098D76 mov eax, dword ptr fs:[00000030h] 9_2_01098D76
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01098D76 mov eax, dword ptr fs:[00000030h] 9_2_01098D76
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A2581 mov eax, dword ptr fs:[00000030h] 9_2_010A2581
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A2581 mov eax, dword ptr fs:[00000030h] 9_2_010A2581
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A2581 mov eax, dword ptr fs:[00000030h] 9_2_010A2581
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A2581 mov eax, dword ptr fs:[00000030h] 9_2_010A2581
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01072D8A mov eax, dword ptr fs:[00000030h] 9_2_01072D8A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01072D8A mov eax, dword ptr fs:[00000030h] 9_2_01072D8A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01072D8A mov eax, dword ptr fs:[00000030h] 9_2_01072D8A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01072D8A mov eax, dword ptr fs:[00000030h] 9_2_01072D8A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01072D8A mov eax, dword ptr fs:[00000030h] 9_2_01072D8A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AFD9B mov eax, dword ptr fs:[00000030h] 9_2_010AFD9B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AFD9B mov eax, dword ptr fs:[00000030h] 9_2_010AFD9B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01132D82 mov eax, dword ptr fs:[00000030h] 9_2_01132D82
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01132D82 mov eax, dword ptr fs:[00000030h] 9_2_01132D82
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01132D82 mov eax, dword ptr fs:[00000030h] 9_2_01132D82
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01132D82 mov eax, dword ptr fs:[00000030h] 9_2_01132D82
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01132D82 mov eax, dword ptr fs:[00000030h] 9_2_01132D82
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01132D82 mov eax, dword ptr fs:[00000030h] 9_2_01132D82
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01132D82 mov eax, dword ptr fs:[00000030h] 9_2_01132D82
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A35A1 mov eax, dword ptr fs:[00000030h] 9_2_010A35A1
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_011405AC mov eax, dword ptr fs:[00000030h] 9_2_011405AC
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_011405AC mov eax, dword ptr fs:[00000030h] 9_2_011405AC
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A1DB5 mov eax, dword ptr fs:[00000030h] 9_2_010A1DB5
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A1DB5 mov eax, dword ptr fs:[00000030h] 9_2_010A1DB5
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A1DB5 mov eax, dword ptr fs:[00000030h] 9_2_010A1DB5
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F6DC9 mov eax, dword ptr fs:[00000030h] 9_2_010F6DC9
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F6DC9 mov eax, dword ptr fs:[00000030h] 9_2_010F6DC9
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F6DC9 mov eax, dword ptr fs:[00000030h] 9_2_010F6DC9
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F6DC9 mov ecx, dword ptr fs:[00000030h] 9_2_010F6DC9
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F6DC9 mov eax, dword ptr fs:[00000030h] 9_2_010F6DC9
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F6DC9 mov eax, dword ptr fs:[00000030h] 9_2_010F6DC9
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01128DF1 mov eax, dword ptr fs:[00000030h] 9_2_01128DF1
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0108D5E0 mov eax, dword ptr fs:[00000030h] 9_2_0108D5E0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0108D5E0 mov eax, dword ptr fs:[00000030h] 9_2_0108D5E0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0113FDE2 mov eax, dword ptr fs:[00000030h] 9_2_0113FDE2
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0113FDE2 mov eax, dword ptr fs:[00000030h] 9_2_0113FDE2
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0113FDE2 mov eax, dword ptr fs:[00000030h] 9_2_0113FDE2
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0113FDE2 mov eax, dword ptr fs:[00000030h] 9_2_0113FDE2
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F6C0A mov eax, dword ptr fs:[00000030h] 9_2_010F6C0A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F6C0A mov eax, dword ptr fs:[00000030h] 9_2_010F6C0A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F6C0A mov eax, dword ptr fs:[00000030h] 9_2_010F6C0A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F6C0A mov eax, dword ptr fs:[00000030h] 9_2_010F6C0A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01131C06 mov eax, dword ptr fs:[00000030h] 9_2_01131C06
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01131C06 mov eax, dword ptr fs:[00000030h] 9_2_01131C06
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01131C06 mov eax, dword ptr fs:[00000030h] 9_2_01131C06
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01131C06 mov eax, dword ptr fs:[00000030h] 9_2_01131C06
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01131C06 mov eax, dword ptr fs:[00000030h] 9_2_01131C06
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01131C06 mov eax, dword ptr fs:[00000030h] 9_2_01131C06
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01131C06 mov eax, dword ptr fs:[00000030h] 9_2_01131C06
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01131C06 mov eax, dword ptr fs:[00000030h] 9_2_01131C06
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01131C06 mov eax, dword ptr fs:[00000030h] 9_2_01131C06
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01131C06 mov eax, dword ptr fs:[00000030h] 9_2_01131C06
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01131C06 mov eax, dword ptr fs:[00000030h] 9_2_01131C06
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01131C06 mov eax, dword ptr fs:[00000030h] 9_2_01131C06
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01131C06 mov eax, dword ptr fs:[00000030h] 9_2_01131C06
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01131C06 mov eax, dword ptr fs:[00000030h] 9_2_01131C06
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0114740D mov eax, dword ptr fs:[00000030h] 9_2_0114740D
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0114740D mov eax, dword ptr fs:[00000030h] 9_2_0114740D
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0114740D mov eax, dword ptr fs:[00000030h] 9_2_0114740D
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010ABC2C mov eax, dword ptr fs:[00000030h] 9_2_010ABC2C
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A3C3E mov eax, dword ptr fs:[00000030h] 9_2_010A3C3E
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A3C3E mov eax, dword ptr fs:[00000030h] 9_2_010A3C3E
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A3C3E mov eax, dword ptr fs:[00000030h] 9_2_010A3C3E
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0110C450 mov eax, dword ptr fs:[00000030h] 9_2_0110C450
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0110C450 mov eax, dword ptr fs:[00000030h] 9_2_0110C450
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AA44B mov eax, dword ptr fs:[00000030h] 9_2_010AA44B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109746D mov eax, dword ptr fs:[00000030h] 9_2_0109746D
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AAC7B mov eax, dword ptr fs:[00000030h] 9_2_010AAC7B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AAC7B mov eax, dword ptr fs:[00000030h] 9_2_010AAC7B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AAC7B mov eax, dword ptr fs:[00000030h] 9_2_010AAC7B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AAC7B mov eax, dword ptr fs:[00000030h] 9_2_010AAC7B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AAC7B mov eax, dword ptr fs:[00000030h] 9_2_010AAC7B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AAC7B mov eax, dword ptr fs:[00000030h] 9_2_010AAC7B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AAC7B mov eax, dword ptr fs:[00000030h] 9_2_010AAC7B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AAC7B mov eax, dword ptr fs:[00000030h] 9_2_010AAC7B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AAC7B mov eax, dword ptr fs:[00000030h] 9_2_010AAC7B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AAC7B mov eax, dword ptr fs:[00000030h] 9_2_010AAC7B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AAC7B mov eax, dword ptr fs:[00000030h] 9_2_010AAC7B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B477 mov eax, dword ptr fs:[00000030h] 9_2_0109B477
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B477 mov eax, dword ptr fs:[00000030h] 9_2_0109B477
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B477 mov eax, dword ptr fs:[00000030h] 9_2_0109B477
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B477 mov eax, dword ptr fs:[00000030h] 9_2_0109B477
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B477 mov eax, dword ptr fs:[00000030h] 9_2_0109B477
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B477 mov eax, dword ptr fs:[00000030h] 9_2_0109B477
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B477 mov eax, dword ptr fs:[00000030h] 9_2_0109B477
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B477 mov eax, dword ptr fs:[00000030h] 9_2_0109B477
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B477 mov eax, dword ptr fs:[00000030h] 9_2_0109B477
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B477 mov eax, dword ptr fs:[00000030h] 9_2_0109B477
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B477 mov eax, dword ptr fs:[00000030h] 9_2_0109B477
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B477 mov eax, dword ptr fs:[00000030h] 9_2_0109B477
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134496 mov eax, dword ptr fs:[00000030h] 9_2_01134496
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134496 mov eax, dword ptr fs:[00000030h] 9_2_01134496
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134496 mov eax, dword ptr fs:[00000030h] 9_2_01134496
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134496 mov eax, dword ptr fs:[00000030h] 9_2_01134496
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134496 mov eax, dword ptr fs:[00000030h] 9_2_01134496
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134496 mov eax, dword ptr fs:[00000030h] 9_2_01134496
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134496 mov eax, dword ptr fs:[00000030h] 9_2_01134496
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134496 mov eax, dword ptr fs:[00000030h] 9_2_01134496
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134496 mov eax, dword ptr fs:[00000030h] 9_2_01134496
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134496 mov eax, dword ptr fs:[00000030h] 9_2_01134496
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134496 mov eax, dword ptr fs:[00000030h] 9_2_01134496
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134496 mov eax, dword ptr fs:[00000030h] 9_2_01134496
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01134496 mov eax, dword ptr fs:[00000030h] 9_2_01134496
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0108849B mov eax, dword ptr fs:[00000030h] 9_2_0108849B
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01148CD6 mov eax, dword ptr fs:[00000030h] 9_2_01148CD6
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_011314FB mov eax, dword ptr fs:[00000030h] 9_2_011314FB
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F6CF0 mov eax, dword ptr fs:[00000030h] 9_2_010F6CF0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F6CF0 mov eax, dword ptr fs:[00000030h] 9_2_010F6CF0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F6CF0 mov eax, dword ptr fs:[00000030h] 9_2_010F6CF0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0110FF10 mov eax, dword ptr fs:[00000030h] 9_2_0110FF10
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0110FF10 mov eax, dword ptr fs:[00000030h] 9_2_0110FF10
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AA70E mov eax, dword ptr fs:[00000030h] 9_2_010AA70E
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AA70E mov eax, dword ptr fs:[00000030h] 9_2_010AA70E
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0114070D mov eax, dword ptr fs:[00000030h] 9_2_0114070D
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0114070D mov eax, dword ptr fs:[00000030h] 9_2_0114070D
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A4710 mov eax, dword ptr fs:[00000030h] 9_2_010A4710
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109F716 mov eax, dword ptr fs:[00000030h] 9_2_0109F716
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01074F2E mov eax, dword ptr fs:[00000030h] 9_2_01074F2E
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01074F2E mov eax, dword ptr fs:[00000030h] 9_2_01074F2E
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B73D mov eax, dword ptr fs:[00000030h] 9_2_0109B73D
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109B73D mov eax, dword ptr fs:[00000030h] 9_2_0109B73D
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A3F33 mov eax, dword ptr fs:[00000030h] 9_2_010A3F33
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AE730 mov eax, dword ptr fs:[00000030h] 9_2_010AE730
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01131751 mov eax, dword ptr fs:[00000030h] 9_2_01131751
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0108EF40 mov eax, dword ptr fs:[00000030h] 9_2_0108EF40
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0108FF60 mov eax, dword ptr fs:[00000030h] 9_2_0108FF60
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01148F6A mov eax, dword ptr fs:[00000030h] 9_2_01148F6A
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F7794 mov eax, dword ptr fs:[00000030h] 9_2_010F7794
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F7794 mov eax, dword ptr fs:[00000030h] 9_2_010F7794
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F7794 mov eax, dword ptr fs:[00000030h] 9_2_010F7794
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01088794 mov eax, dword ptr fs:[00000030h] 9_2_01088794
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_011317D2 mov eax, dword ptr fs:[00000030h] 9_2_011317D2
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B37F5 mov eax, dword ptr fs:[00000030h] 9_2_010B37F5
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0107C600 mov eax, dword ptr fs:[00000030h] 9_2_0107C600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0107C600 mov eax, dword ptr fs:[00000030h] 9_2_0107C600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0107C600 mov eax, dword ptr fs:[00000030h] 9_2_0107C600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01095600 mov eax, dword ptr fs:[00000030h] 9_2_01095600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01095600 mov eax, dword ptr fs:[00000030h] 9_2_01095600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01095600 mov eax, dword ptr fs:[00000030h] 9_2_01095600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01095600 mov eax, dword ptr fs:[00000030h] 9_2_01095600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01095600 mov ecx, dword ptr fs:[00000030h] 9_2_01095600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01095600 mov ecx, dword ptr fs:[00000030h] 9_2_01095600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01095600 mov eax, dword ptr fs:[00000030h] 9_2_01095600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01095600 mov ecx, dword ptr fs:[00000030h] 9_2_01095600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01095600 mov ecx, dword ptr fs:[00000030h] 9_2_01095600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01095600 mov eax, dword ptr fs:[00000030h] 9_2_01095600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01095600 mov eax, dword ptr fs:[00000030h] 9_2_01095600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01095600 mov eax, dword ptr fs:[00000030h] 9_2_01095600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01095600 mov eax, dword ptr fs:[00000030h] 9_2_01095600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01095600 mov eax, dword ptr fs:[00000030h] 9_2_01095600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01095600 mov eax, dword ptr fs:[00000030h] 9_2_01095600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01095600 mov eax, dword ptr fs:[00000030h] 9_2_01095600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01095600 mov eax, dword ptr fs:[00000030h] 9_2_01095600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01095600 mov eax, dword ptr fs:[00000030h] 9_2_01095600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01095600 mov eax, dword ptr fs:[00000030h] 9_2_01095600
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A8E00 mov eax, dword ptr fs:[00000030h] 9_2_010A8E00
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AA61C mov eax, dword ptr fs:[00000030h] 9_2_010AA61C
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010AA61C mov eax, dword ptr fs:[00000030h] 9_2_010AA61C
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01131608 mov eax, dword ptr fs:[00000030h] 9_2_01131608
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0107E620 mov eax, dword ptr fs:[00000030h] 9_2_0107E620
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0112FE3F mov eax, dword ptr fs:[00000030h] 9_2_0112FE3F
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01087E41 mov eax, dword ptr fs:[00000030h] 9_2_01087E41
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01087E41 mov eax, dword ptr fs:[00000030h] 9_2_01087E41
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01087E41 mov eax, dword ptr fs:[00000030h] 9_2_01087E41
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01087E41 mov eax, dword ptr fs:[00000030h] 9_2_01087E41
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01087E41 mov eax, dword ptr fs:[00000030h] 9_2_01087E41
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01087E41 mov eax, dword ptr fs:[00000030h] 9_2_01087E41
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0113AE44 mov eax, dword ptr fs:[00000030h] 9_2_0113AE44
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0113AE44 mov eax, dword ptr fs:[00000030h] 9_2_0113AE44
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0108766D mov eax, dword ptr fs:[00000030h] 9_2_0108766D
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109AE73 mov eax, dword ptr fs:[00000030h] 9_2_0109AE73
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109AE73 mov eax, dword ptr fs:[00000030h] 9_2_0109AE73
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109AE73 mov eax, dword ptr fs:[00000030h] 9_2_0109AE73
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109AE73 mov eax, dword ptr fs:[00000030h] 9_2_0109AE73
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0109AE73 mov eax, dword ptr fs:[00000030h] 9_2_0109AE73
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0110FE87 mov eax, dword ptr fs:[00000030h] 9_2_0110FE87
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010F46A7 mov eax, dword ptr fs:[00000030h] 9_2_010F46A7
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01140EA5 mov eax, dword ptr fs:[00000030h] 9_2_01140EA5
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01140EA5 mov eax, dword ptr fs:[00000030h] 9_2_01140EA5
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01140EA5 mov eax, dword ptr fs:[00000030h] 9_2_01140EA5
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_01148ED6 mov eax, dword ptr fs:[00000030h] 9_2_01148ED6
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A36CC mov eax, dword ptr fs:[00000030h] 9_2_010A36CC
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010B8EC7 mov eax, dword ptr fs:[00000030h] 9_2_010B8EC7
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0112FEC0 mov eax, dword ptr fs:[00000030h] 9_2_0112FEC0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010A16E0 mov ecx, dword ptr fs:[00000030h] 9_2_010A16E0
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_010876E2 mov eax, dword ptr fs:[00000030h] 9_2_010876E2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 mov eax, dword ptr fs:[00000030h] 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 mov eax, dword ptr fs:[00000030h] 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 mov eax, dword ptr fs:[00000030h] 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 mov eax, dword ptr fs:[00000030h] 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 mov eax, dword ptr fs:[00000030h] 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 mov eax, dword ptr fs:[00000030h] 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 mov eax, dword ptr fs:[00000030h] 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 mov eax, dword ptr fs:[00000030h] 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 mov eax, dword ptr fs:[00000030h] 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 mov eax, dword ptr fs:[00000030h] 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 mov eax, dword ptr fs:[00000030h] 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 mov eax, dword ptr fs:[00000030h] 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 mov eax, dword ptr fs:[00000030h] 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 mov eax, dword ptr fs:[00000030h] 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 mov eax, dword ptr fs:[00000030h] 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 mov eax, dword ptr fs:[00000030h] 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 mov eax, dword ptr fs:[00000030h] 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 mov eax, dword ptr fs:[00000030h] 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 mov eax, dword ptr fs:[00000030h] 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 mov eax, dword ptr fs:[00000030h] 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A309 mov eax, dword ptr fs:[00000030h] 13_2_0320A309
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032A131B mov eax, dword ptr fs:[00000030h] 13_2_032A131B
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_031EF358 mov eax, dword ptr fs:[00000030h] 13_2_031EF358
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03213B7A mov eax, dword ptr fs:[00000030h] 13_2_03213B7A
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03213B7A mov eax, dword ptr fs:[00000030h] 13_2_03213B7A
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_031EDB40 mov eax, dword ptr fs:[00000030h] 13_2_031EDB40
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032B8B58 mov eax, dword ptr fs:[00000030h] 13_2_032B8B58
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_031EDB60 mov ecx, dword ptr fs:[00000030h] 13_2_031EDB60
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03214BAD mov eax, dword ptr fs:[00000030h] 13_2_03214BAD
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03214BAD mov eax, dword ptr fs:[00000030h] 13_2_03214BAD
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03214BAD mov eax, dword ptr fs:[00000030h] 13_2_03214BAD
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032B5BA5 mov eax, dword ptr fs:[00000030h] 13_2_032B5BA5
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_031F1B8F mov eax, dword ptr fs:[00000030h] 13_2_031F1B8F
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_031F1B8F mov eax, dword ptr fs:[00000030h] 13_2_031F1B8F
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032A138A mov eax, dword ptr fs:[00000030h] 13_2_032A138A
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0329D380 mov ecx, dword ptr fs:[00000030h] 13_2_0329D380
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0321B390 mov eax, dword ptr fs:[00000030h] 13_2_0321B390
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03212397 mov eax, dword ptr fs:[00000030h] 13_2_03212397
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032103E2 mov eax, dword ptr fs:[00000030h] 13_2_032103E2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032103E2 mov eax, dword ptr fs:[00000030h] 13_2_032103E2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032103E2 mov eax, dword ptr fs:[00000030h] 13_2_032103E2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032103E2 mov eax, dword ptr fs:[00000030h] 13_2_032103E2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032103E2 mov eax, dword ptr fs:[00000030h] 13_2_032103E2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032103E2 mov eax, dword ptr fs:[00000030h] 13_2_032103E2
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320DBE9 mov eax, dword ptr fs:[00000030h] 13_2_0320DBE9
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032653CA mov eax, dword ptr fs:[00000030h] 13_2_032653CA
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_032653CA mov eax, dword ptr fs:[00000030h] 13_2_032653CA
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_031EAA16 mov eax, dword ptr fs:[00000030h] 13_2_031EAA16
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_031EAA16 mov eax, dword ptr fs:[00000030h] 13_2_031EAA16
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A229 mov eax, dword ptr fs:[00000030h] 13_2_0320A229
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A229 mov eax, dword ptr fs:[00000030h] 13_2_0320A229
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A229 mov eax, dword ptr fs:[00000030h] 13_2_0320A229
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A229 mov eax, dword ptr fs:[00000030h] 13_2_0320A229
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A229 mov eax, dword ptr fs:[00000030h] 13_2_0320A229
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A229 mov eax, dword ptr fs:[00000030h] 13_2_0320A229
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A229 mov eax, dword ptr fs:[00000030h] 13_2_0320A229
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A229 mov eax, dword ptr fs:[00000030h] 13_2_0320A229
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_0320A229 mov eax, dword ptr fs:[00000030h] 13_2_0320A229
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03224A2C mov eax, dword ptr fs:[00000030h] 13_2_03224A2C
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_03224A2C mov eax, dword ptr fs:[00000030h] 13_2_03224A2C
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_031E5210 mov eax, dword ptr fs:[00000030h] 13_2_031E5210
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_031E5210 mov ecx, dword ptr fs:[00000030h] 13_2_031E5210
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_031E5210 mov eax, dword ptr fs:[00000030h] 13_2_031E5210
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_031E5210 mov eax, dword ptr fs:[00000030h] 13_2_031E5210
Source: C:\Windows\SysWOW64\wlanext.exe Code function: 13_2_031F8A0A mov eax, dword ptr fs:[00000030h] 13_2_031F8A0A
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\PO_101&102.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\PO_101&102.exe Code function: 9_2_0040ACF0 LdrLoadDll, 9_2_0040ACF0
Source: C:\Users\user\Desktop\PO_101&102.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.barbershopvalleyvillage.com
Source: C:\Windows\explorer.exe Domain query: www.champ-beauty-tomigaoka-nail.com
Source: C:\Windows\explorer.exe Network Connect: 150.95.255.38 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.reprv.com
Source: C:\Windows\explorer.exe Network Connect: 52.44.94.227 80 Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\PO_101&102.exe Section unmapped: C:\Windows\SysWOW64\wlanext.exe base address: 920000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\PO_101&102.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Section loaded: unknown target: C:\Windows\SysWOW64\wlanext.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Section loaded: unknown target: C:\Windows\SysWOW64\wlanext.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\PO_101&102.exe Memory written: C:\Users\user\Desktop\PO_101&102.exe base: 400000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\PO_101&102.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\PO_101&102.exe Thread register set: target process: 3352 Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe Thread register set: target process: 3352 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\PO_101&102.exe Process created: C:\Users\user\Desktop\PO_101&102.exe {path} Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO_101&102.exe' Jump to behavior
Source: explorer.exe, 0000000A.00000000.366275043.00000000011E0000.00000002.00020000.sdmp, wlanext.exe, 0000000D.00000002.543841774.0000000004820000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 0000000A.00000000.313234158.0000000000B68000.00000004.00000020.sdmp Binary or memory string: Progman\Pr
Source: explorer.exe, 0000000A.00000000.366275043.00000000011E0000.00000002.00020000.sdmp, wlanext.exe, 0000000D.00000002.543841774.0000000004820000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000A.00000000.366275043.00000000011E0000.00000002.00020000.sdmp, wlanext.exe, 0000000D.00000002.543841774.0000000004820000.00000002.00020000.sdmp Binary or memory string: Progman
Source: explorer.exe, 0000000A.00000000.366275043.00000000011E0000.00000002.00020000.sdmp, wlanext.exe, 0000000D.00000002.543841774.0000000004820000.00000002.00020000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 0000000A.00000000.305586847.0000000008778000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWndh

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Users\user\Desktop\PO_101&102.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO_101&102.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 9.0.PO_101&102.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.PO_101&102.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.PO_101&102.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.PO_101&102.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.PO_101&102.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.PO_101&102.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO_101&102.exe.3a4c4e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.PO_101&102.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.348466397.0000000000FB0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.333516525.000000000F6F6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.348384221.0000000000D70000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.320955277.000000000F6F6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.542137974.0000000003070000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.539322069.00000000008D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.291465505.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.542399139.00000000030A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.294755714.00000000039A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.348134923.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.291860367.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 9.0.PO_101&102.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.PO_101&102.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.PO_101&102.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.PO_101&102.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.PO_101&102.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.PO_101&102.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO_101&102.exe.3a4c4e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.PO_101&102.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.348466397.0000000000FB0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.333516525.000000000F6F6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.348384221.0000000000D70000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.320955277.000000000F6F6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.542137974.0000000003070000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.539322069.00000000008D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.291465505.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.542399139.00000000030A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.294755714.00000000039A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.348134923.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.291860367.0000000000400000.00000040.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 510596 Sample: PO_101&102.exe Startdate: 28/10/2021 Architecture: WINDOWS Score: 100 31 www.99rocket.education 2->31 39 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->39 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 8 other signatures 2->45 11 PO_101&102.exe 3 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\...\PO_101&102.exe.log, ASCII 11->29 dropped 57 Tries to detect virtualization through RDTSC time measurements 11->57 59 Injects a PE file into a foreign processes 11->59 15 PO_101&102.exe 11->15         started        signatures6 process7 signatures8 61 Modifies the context of a thread in another process (thread injection) 15->61 63 Maps a DLL or memory area into another process 15->63 65 Sample uses process hollowing technique 15->65 67 Queues an APC in another process (thread injection) 15->67 18 explorer.exe 15->18 injected process9 dnsIp10 33 www.champ-beauty-tomigaoka-nail.com 150.95.255.38, 49781, 80 INTERQGMOInternetIncJP Japan 18->33 35 barbershopvalleyvillage.com 52.44.94.227, 49754, 80 AMAZON-AESUS United States 18->35 37 2 other IPs or domains 18->37 47 System process connects to network (likely due to code injection or exploit) 18->47 22 wlanext.exe 18->22         started        signatures11 process12 signatures13 49 Self deletion via cmd delete 22->49 51 Modifies the context of a thread in another process (thread injection) 22->51 53 Maps a DLL or memory area into another process 22->53 55 Tries to detect virtualization through RDTSC time measurements 22->55 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
52.44.94.227
 barbershopvalleyvillage.com United States
14618 AMAZON-AESUS true
150.95.255.38
 www.champ-beauty-tomigaoka-nail.com Japan 7506 INTERQGMOInternetIncJP true

Contacted Domains

Name IP Active
barbershopvalleyvillage.com 52.44.94.227 true
www.99rocket.education 208.91.197.39 true
www.champ-beauty-tomigaoka-nail.com 150.95.255.38 true
www.barbershopvalleyvillage.com unknown unknown
www.reprv.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.barbershopvalleyvillage.com/snr6/?v0DD=Zy5Qpi9o71BxgS1SycsJXGxeSETLIPANxi7ogI8FlHlRlRfybFGNqMyxmIVsIwo4eCM0&p2MTV=Jf94jZD8vHv8m true
  • Avira URL Cloud: safe
 unknown
www.reynbetgirisi.com/snr6/ true
  • Avira URL Cloud: malware
 low
http://www.champ-beauty-tomigaoka-nail.com/snr6/?v0DD=AT56xQorg2W9iGq4d7Tt4iWj+Y9aO9Wbdx0aYCn8sjL6tNqdMMFemPCECz3N3nQc4IZ0&p2MTV=Jf94jZD8vHv8m true
  • Avira URL Cloud: safe
 unknown