Windows Analysis Report
PO1038854.exe

Overview

General Information

Sample name: PO1038854.exe
Analysis ID: 1522761
MD5: 0b8096803c8a92e49a117832e8005e90
SHA1: b897636e60d041c518422da34325c7810c1f3404
SHA256: 85e703636c2e5c837b37714c02a838dca4f2ac440d45c0bedfbf56b8e01c4820
Tags: exe
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
.NET source code contains very large array initializations
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: PO1038854.exe ReversingLabs: Detection: 23%
Yara detected FormBook
Source: Yara match File source: 5.2.PO1038854.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.PO1038854.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.2385912141.0000000001CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2384523939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: PO1038854.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: PO1038854.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: PO1038854.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: wntdll.pdbUGP source: PO1038854.exe, 00000005.00000002.2385119811.0000000001990000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: PO1038854.exe, PO1038854.exe, 00000005.00000002.2385119811.0000000001990000.00000040.00001000.00020000.00000000.sdmp
Source: PO1038854.exe, 00000000.00000002.2137118655.000000000316E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 5.2.PO1038854.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.PO1038854.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.2385912141.0000000001CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2384523939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 5.2.PO1038854.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 5.2.PO1038854.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2385912141.0000000001CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2384523939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
.NET source code contains very large array initializations
Source: PO1038854.exe, CircularButton.cs Large array initialization: : array initializer size 678416
Contains functionality to call native functions
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_0042CAF3 NtClose, 5_2_0042CAF3
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02DF0 NtQuerySystemInformation,LdrInitializeThunk, 5_2_01A02DF0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02C70 NtFreeVirtualMemory,LdrInitializeThunk, 5_2_01A02C70
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A035C0 NtCreateMutant,LdrInitializeThunk, 5_2_01A035C0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A04340 NtSetContextThread, 5_2_01A04340
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A04650 NtSuspendThread, 5_2_01A04650
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02BA0 NtEnumerateValueKey, 5_2_01A02BA0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02B80 NtQueryInformationFile, 5_2_01A02B80
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02BE0 NtQueryValueKey, 5_2_01A02BE0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02BF0 NtAllocateVirtualMemory, 5_2_01A02BF0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02B60 NtClose, 5_2_01A02B60
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02AB0 NtWaitForSingleObject, 5_2_01A02AB0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02AF0 NtWriteFile, 5_2_01A02AF0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02AD0 NtReadFile, 5_2_01A02AD0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02DB0 NtEnumerateKey, 5_2_01A02DB0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02DD0 NtDelayExecution, 5_2_01A02DD0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02D30 NtUnmapViewOfSection, 5_2_01A02D30
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02D00 NtSetInformationFile, 5_2_01A02D00
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02D10 NtMapViewOfSection, 5_2_01A02D10
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02CA0 NtQueryInformationToken, 5_2_01A02CA0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02CF0 NtOpenProcess, 5_2_01A02CF0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02CC0 NtQueryVirtualMemory, 5_2_01A02CC0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02C00 NtQueryInformationProcess, 5_2_01A02C00
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02C60 NtCreateKey, 5_2_01A02C60
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02FA0 NtQuerySection, 5_2_01A02FA0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02FB0 NtResumeThread, 5_2_01A02FB0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02F90 NtProtectVirtualMemory, 5_2_01A02F90
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02FE0 NtCreateFile, 5_2_01A02FE0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02F30 NtCreateSection, 5_2_01A02F30
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02F60 NtCreateProcessEx, 5_2_01A02F60
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02EA0 NtAdjustPrivilegesToken, 5_2_01A02EA0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02E80 NtReadVirtualMemory, 5_2_01A02E80
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02EE0 NtQueueApcThread, 5_2_01A02EE0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02E30 NtWriteVirtualMemory, 5_2_01A02E30
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A03090 NtSetValueKey, 5_2_01A03090
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A03010 NtOpenDirectoryObject, 5_2_01A03010
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A039B0 NtGetContextThread, 5_2_01A039B0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A03D10 NtOpenProcessToken, 5_2_01A03D10
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A03D70 NtOpenThread, 5_2_01A03D70
Detected potential crypto function
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_07273720 0_2_07273720
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_072727E8 0_2_072727E8
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_07270040 0_2_07270040
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_07273F68 0_2_07273F68
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_07273710 0_2_07273710
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_072727D8 0_2_072727D8
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_0727D670 0_2_0727D670
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_0727B6F0 0_2_0727B6F0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_072725C9 0_2_072725C9
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_072725D8 0_2_072725D8
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_072744A8 0_2_072744A8
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_07274498 0_2_07274498
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_07272368 0_2_07272368
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_07272378 0_2_07272378
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_0727B2B8 0_2_0727B2B8
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_072721C9 0_2_072721C9
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_072721D8 0_2_072721D8
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_07270006 0_2_07270006
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_07273013 0_2_07273013
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_07270F68 0_2_07270F68
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_07270F58 0_2_07270F58
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_07272F58 0_2_07272F58
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_07273F58 0_2_07273F58
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_0727AE80 0_2_0727AE80
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_0727BB28 0_2_0727BB28
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_07271B28 0_2_07271B28
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_07271B38 0_2_07271B38
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_07272A30 0_2_07272A30
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_07272A40 0_2_07272A40
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_07271928 0_2_07271928
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_00402800 5_2_00402800
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_004010C0 5_2_004010C0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_0042F0D3 5_2_0042F0D3
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_00401210 5_2_00401210
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_004034F5 5_2_004034F5
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_004104A3 5_2_004104A3
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_00403500 5_2_00403500
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_004025D4 5_2_004025D4
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_004025DC 5_2_004025DC
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_004025E0 5_2_004025E0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_00416E03 5_2_00416E03
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_004106C3 5_2_004106C3
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_0040E743 5_2_0040E743
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_00402FCF 5_2_00402FCF
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_00402FD0 5_2_00402FD0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_004027F3 5_2_004027F3
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A901AA 5_2_01A901AA
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A841A2 5_2_01A841A2
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A881CC 5_2_01A881CC
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C0100 5_2_019C0100
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6A118 5_2_01A6A118
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A58158 5_2_01A58158
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A62000 5_2_01A62000
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A903E6 5_2_01A903E6
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019DE3F0 5_2_019DE3F0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A8A352 5_2_01A8A352
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A502C0 5_2_01A502C0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A70274 5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A90591 5_2_01A90591
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0535 5_2_019D0535
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A7E4F6 5_2_01A7E4F6
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A74420 5_2_01A74420
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A82446 5_2_01A82446
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CC7C0 5_2_019CC7C0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F4750 5_2_019F4750
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0770 5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EC6E0 5_2_019EC6E0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A9A9A6 5_2_01A9A9A6
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D29A0 5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E6962 5_2_019E6962
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019B68B8 5_2_019B68B8
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FE8F0 5_2_019FE8F0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019DA840 5_2_019DA840
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D2840 5_2_019D2840
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A86BD7 5_2_01A86BD7
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A8AB40 5_2_01A8AB40
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CEA80 5_2_019CEA80
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E8DBF 5_2_019E8DBF
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CADE0 5_2_019CADE0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019DAD00 5_2_019DAD00
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6CD1F 5_2_01A6CD1F
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A70CB5 5_2_01A70CB5
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C0CF2 5_2_019C0CF2
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0C00 5_2_019D0C00
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4EFA0 5_2_01A4EFA0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C2FC8 5_2_019C2FC8
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019DCFE0 5_2_019DCFE0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A12F28 5_2_01A12F28
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A72F30 5_2_01A72F30
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F0F30 5_2_019F0F30
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A44F40 5_2_01A44F40
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E2E90 5_2_019E2E90
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A8CE93 5_2_01A8CE93
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A8EEDB 5_2_01A8EEDB
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A8EE26 5_2_01A8EE26
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0E59 5_2_019D0E59
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019DB1B0 5_2_019DB1B0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A9B16B 5_2_01A9B16B
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A0516C 5_2_01A0516C
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019BF172 5_2_019BF172
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A870E9 5_2_01A870E9
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A8F0E0 5_2_01A8F0E0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D70C0 5_2_019D70C0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A7F0CC 5_2_01A7F0CC
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A1739A 5_2_01A1739A
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A8132D 5_2_01A8132D
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019BD34C 5_2_019BD34C
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D52A0 5_2_019D52A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A712ED 5_2_01A712ED
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EB2C0 5_2_019EB2C0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6D5B0 5_2_01A6D5B0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A995C3 5_2_01A995C3
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A87571 5_2_01A87571
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A8F43F 5_2_01A8F43F
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C1460 5_2_019C1460
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A8F7B0 5_2_01A8F7B0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A816CC 5_2_01A816CC
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A15630 5_2_01A15630
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A65910 5_2_01A65910
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D9950 5_2_019D9950
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EB950 5_2_019EB950
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D38E0 5_2_019D38E0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3D800 5_2_01A3D800
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EFB80 5_2_019EFB80
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A45BF0 5_2_01A45BF0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A0DBF9 5_2_01A0DBF9
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A8FB76 5_2_01A8FB76
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A15AA0 5_2_01A15AA0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A71AA3 5_2_01A71AA3
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6DAAC 5_2_01A6DAAC
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A7DAC6 5_2_01A7DAC6
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A43A6C 5_2_01A43A6C
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A8FA49 5_2_01A8FA49
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A87A46 5_2_01A87A46
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EFDC0 5_2_019EFDC0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A87D73 5_2_01A87D73
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D3D40 5_2_019D3D40
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A81D5A 5_2_01A81D5A
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A8FCF2 5_2_01A8FCF2
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A49C32 5_2_01A49C32
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D1F92 5_2_019D1F92
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A8FFB1 5_2_01A8FFB1
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01993FD2 5_2_01993FD2
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01993FD5 5_2_01993FD5
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A8FF09 5_2_01A8FF09
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D9EB0 5_2_019D9EB0
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\PO1038854.exe Code function: String function: 01A3EA12 appears 86 times
Source: C:\Users\user\Desktop\PO1038854.exe Code function: String function: 01A05130 appears 58 times
Source: C:\Users\user\Desktop\PO1038854.exe Code function: String function: 01A17E54 appears 111 times
Source: C:\Users\user\Desktop\PO1038854.exe Code function: String function: 019BB970 appears 280 times
Source: C:\Users\user\Desktop\PO1038854.exe Code function: String function: 01A4F290 appears 105 times
Sample file is different than original file name gathered from version info
Source: PO1038854.exe, 00000000.00000002.2151567751.000000000A140000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs PO1038854.exe
Source: PO1038854.exe, 00000000.00000000.2124136505.0000000000B84000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameRjdR.exe@ vs PO1038854.exe
Source: PO1038854.exe, 00000000.00000002.2136001690.000000000115E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs PO1038854.exe
Source: PO1038854.exe, 00000005.00000002.2385119811.0000000001ABD000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs PO1038854.exe
Source: PO1038854.exe Binary or memory string: OriginalFilenameRjdR.exe@ vs PO1038854.exe
Uses 32bit PE files
Source: PO1038854.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 5.2.PO1038854.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 5.2.PO1038854.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2385912141.0000000001CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2384523939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: PO1038854.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, C6p2pqJV2lX1KN4pKa.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, C6p2pqJV2lX1KN4pKa.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, XhsEuGxgMg3yVMoqO1.cs Security API names: _0020.SetAccessControl
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, XhsEuGxgMg3yVMoqO1.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, XhsEuGxgMg3yVMoqO1.cs Security API names: _0020.AddAccessRule
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, XhsEuGxgMg3yVMoqO1.cs Security API names: _0020.SetAccessControl
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, XhsEuGxgMg3yVMoqO1.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, XhsEuGxgMg3yVMoqO1.cs Security API names: _0020.AddAccessRule
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, XhsEuGxgMg3yVMoqO1.cs Security API names: _0020.SetAccessControl
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, XhsEuGxgMg3yVMoqO1.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, XhsEuGxgMg3yVMoqO1.cs Security API names: _0020.AddAccessRule
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, C6p2pqJV2lX1KN4pKa.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/6@0/0
Source: C:\Users\user\Desktop\PO1038854.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO1038854.exe.log Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2024:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z5g0fnvv.pm2.ps1 Jump to behavior
Source: PO1038854.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: PO1038854.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\PO1038854.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: PO1038854.exe ReversingLabs: Detection: 23%
Source: unknown Process created: C:\Users\user\Desktop\PO1038854.exe "C:\Users\user\Desktop\PO1038854.exe"
Source: C:\Users\user\Desktop\PO1038854.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO1038854.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO1038854.exe Process created: C:\Users\user\Desktop\PO1038854.exe "C:\Users\user\Desktop\PO1038854.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\PO1038854.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO1038854.exe" Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process created: C:\Users\user\Desktop\PO1038854.exe "C:\Users\user\Desktop\PO1038854.exe" Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: PO1038854.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: PO1038854.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: wntdll.pdbUGP source: PO1038854.exe, 00000005.00000002.2385119811.0000000001990000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: PO1038854.exe, PO1038854.exe, 00000005.00000002.2385119811.0000000001990000.00000040.00001000.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 0.2.PO1038854.exe.3f19c80.2.raw.unpack, MainForm.cs .Net Code: _200E_200C_200B_202B_202E_200E_200E_202D_200B_206C_202C_202B_200B_200F_200E_206F_206C_202C_202D_200E_206E_206E_200C_206D_202C_200B_200E_202B_200B_206A_202E_206A_202E_206E_206E_206A_206C_206A_206F_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO1038854.exe.3f31ea0.0.raw.unpack, MainForm.cs .Net Code: _200E_200C_200B_202B_202E_200E_200E_202D_200B_206C_202C_202B_200B_200F_200E_206F_206C_202C_202D_200E_206E_206E_200C_206D_202C_200B_200E_202B_200B_206A_202E_206A_202E_206E_206E_206A_206C_206A_206F_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, XhsEuGxgMg3yVMoqO1.cs .Net Code: PuapfsrokX System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, XhsEuGxgMg3yVMoqO1.cs .Net Code: PuapfsrokX System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, XhsEuGxgMg3yVMoqO1.cs .Net Code: PuapfsrokX System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO1038854.exe.7230000.5.raw.unpack, MainForm.cs .Net Code: _200E_200C_200B_202B_202E_200E_200E_202D_200B_206C_202C_202B_200B_200F_200E_206F_206C_202C_202D_200E_206E_206E_200C_206D_202C_200B_200E_202B_200B_206A_202E_206A_202E_206E_206E_206A_206C_206A_206F_202E_202E System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_0727BF50 pushfd ; iretd 0_2_0727BF51
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_07276EEC push cs; ret 0_2_07276EEF
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 0_2_07533177 push dword ptr [edx+ebp*2-75h]; iretd 0_2_07533187
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_004150A8 push ss; iretd 5_2_004150B9
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_00414143 push ebp; iretd 5_2_00414189
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_00406377 push es; ret 5_2_00406381
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_0041FBDB push ebp; ret 5_2_0041FBDC
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_00411D04 pushad ; retf 5_2_00411D2D
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_00403780 push eax; ret 5_2_00403782
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_0199225F pushad ; ret 5_2_019927F9
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019927FA pushad ; ret 5_2_019927F9
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C09AD push ecx; mov dword ptr [esp], ecx 5_2_019C09B6
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_0199283D push eax; iretd 5_2_01992858
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01991200 push eax; iretd 5_2_01991369
Source: PO1038854.exe Static PE information: section name: .text entropy: 7.870972260343742
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, RLSg2R6IrZ2GD8sVjc.cs High entropy of concatenated method names: 'U5fcJnbYU5', 'FgrcqVbTRn', 'i92cD0ElnJ', 'ob0crSH0W2', 'KaEcdTMcLH', 'zybceGLCa1', 'Jslcw2f3kC', 'Nc9cObKFJM', 'T3ocKs7hI1', 'wefc4xZdCh'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, gS5KKpZ2WTUXSwwu502.cs High entropy of concatenated method names: 'jAauIpyItj', 'Iksui9Imgy', 'fNGufsSEqM', 'Gyfu0sUfNb', 'LnGuQ2rJp3', 'd1muWBpRDB', 'LWrumPJE7u', 'PZSuJX58ok', 'om2uqtrhLM', 'qOBu5oOjL5'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, Oex7JwwMJCxfYXMxrL.cs High entropy of concatenated method names: 't8H8UhtG3f', 'NPm8XHR7PX', 'IaQ8PRDRUj', 'q7DP3y9NTF', 'T6JPzHchyu', 'SAj82TWNjK', 'ToX8ZinR9j', 'QBd8NgbPLY', 'TRd8hQnFvj', 'R5l8pmfenc'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, YHByLgCj8GJmh7Msgn.cs High entropy of concatenated method names: 'ToString', 'mZut4OUWmn', 'yhKtrYaJ6S', 'g0ftRtJZFS', 'Ru7td9wbAJ', 'fPCtejkKWW', 'XFctBIpm2b', 'J0UtwZsveU', 'EFFtOnaEfM', 'iXotAYpJ3p'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, iAJcic5IQC1sEN6tQ0.cs High entropy of concatenated method names: 'C8CkQh8ynU', 'EDJkmAGVKv', 'BxHXRMrjyb', 'JiWXdV4hui', 'c5iXeXhWsx', 'XGUXBaSUjw', 'qAYXwYwpvp', 'fa2XOdYNw8', 'jE8XArxu9J', 'Ks3XK6KpKA'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, XZIOZKAQoUDM9A8oeU.cs High entropy of concatenated method names: 'Dq68IoIbbW', 'ALs8iMSk3P', 'eQi8fo64KI', 'zet80Nu38j', 'F4y8Qe3naQ', 'UNc8Wjw3dZ', 'dCm8mcxjek', 'BDx8JpuLMs', 'gMN8qV9plQ', 'Oad85yi0Ot'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, tgoFEGNSHmepVwhgEo.cs High entropy of concatenated method names: 'Vbjfw6GR1', 'qer0VQQA9', 'tGlWX6SZR', 'BD7mMdQ3c', 'Aflq2ZNbo', 'jYE5BCHB2', 'u5vLVoTLhV1UqWXUfP', 'OwgEWYSMVX7eHA93h9', 'nL2agPkQF', 'RhhGTZlMD'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, C6p2pqJV2lX1KN4pKa.cs High entropy of concatenated method names: 'Sm91jd3oRy', 'IZC1s7VXtv', 'ko31CZNHcj', 'fuj1gaF4SS', 'Ps81b3yg6q', 'Yxm1M2Z5Dn', 'pHx1V8OQ2d', 'gIY19eK2ha', 'B7Q1FELsUn', 'tcv13t63wS'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, d8bGjiZhYYG0p7Yq2Vp.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CB0GjKojBB', 'hxRGs8wuXj', 'KAqGC3RCCt', 'QMPGgGP3FC', 'rdtGbTsDsr', 'GmTGM5MlF6', 'qhoGVas7xX'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, XhsEuGxgMg3yVMoqO1.cs High entropy of concatenated method names: 'VHIhnXjO9Q', 'ul0hUVKx9r', 'ncUh1iN8W0', 'mymhXsaa8S', 'NvWhkClvnL', 'dZPhPVfQcy', 'ae6h8NdQud', 'ASShxrUNa2', 'gDVhvRHI4q', 'wa3hltt0ft'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, hiC49dg7ThpoFoYW6F.cs High entropy of concatenated method names: 'iHg7l2juDc', 'oos7EOEHxZ', 'ToString', 'S0r7U00Fsn', 'uKO71RS1QL', 'BYR7X89jMG', 'DNp7kl2IM6', 'Hxd7PROhLb', 'Evr78AhDMD', 'QFN7xgvXO6'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, VHaWpa9AAOhnegFN3k.cs High entropy of concatenated method names: 'vH4aUlodM8', 'uYEa1xUh4X', 'zf3aXmBk75', 'E4RakUvqD4', 'pPSaPm7UMi', 'kI4a8UBJG8', 'fY8axeNyXV', 'RNZavuhtrS', 'uv4alIGguA', 'oqUaEv3dji'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, K4FQG6qRQZVKaJn6lH.cs High entropy of concatenated method names: 'vwgX0U6f4T', 'LtTXWtnudO', 'eYpXJAF300', 'k72XqnLaZ5', 'atBXySlMUM', 'umUXtgugGf', 'rXwX7OlW4q', 'bItXamLvy0', 'FpZXuWflQP', 'NebXGMYjqZ'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, h0Ifh0M4uwrgl7JUXj.cs High entropy of concatenated method names: 'ytl79NqFRQ', 'Uox73FvsMw', 'ag1a2rtkqH', 'rvwaZrDvqC', 'ELL74pnVOM', 'm6O7T9pHRZ', 'o30768hZFw', 'B1W7jccKC4', 'AZj7sew8n2', 'mVD7CVkWtH'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, M1hlmKFbfSonKR0FL6.cs High entropy of concatenated method names: 'pGZaDf4rOV', 'pv3arRf4K3', 'yRHaRt71Z2', 'bgvadRfJgG', 'fFAajSisfU', 'gIiaeARWQT', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, v45muV32yLcWxVHmFr.cs High entropy of concatenated method names: 'vKruZ1lLN5', 'qFruh7OZum', 'PqjupjdjgR', 'wdwuUvqudn', 'ivgu1oTBNs', 'Toauk3FUxD', 'FUMuPnp8Ye', 'NpFaVr9Mxa', 'Kyxa9JnfOg', 'dbJaFKMtDE'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, d7PkgCD1Icfh6t5u0R.cs High entropy of concatenated method names: 'dJtPnvbdFd', 'MMhP1PvvYa', 'f8PPkEeXc5', 'BOPP8OjeF8', 'h4KPxZMbPg', 'ztQkbg9m7b', 'lUpkMhl4Vx', 'rmEkVKNIp4', 'KkGk9pkCFE', 'swikF6FQfi'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, J2wSlmpLsG1BMrtNTV.cs High entropy of concatenated method names: 'bpmZ86p2pq', 'V2lZxX1KN4', 'QRQZlZVKaJ', 'e6lZEHPAJc', 'c6tZyQ0p7P', 'igCZt1Icfh', 'HMEJtJj4uhgY2Iw7JY', 'obyBpxfOG6fMawffu1', 'o9hZZnuGWN', 'Q0MZh5Cp8R'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, B6Uu1OZZW8FpZlqQ4RF.cs High entropy of concatenated method names: 'ToString', 'cqlGhQYePL', 'EUVGpBMv9y', 'OaTGnPoSPN', 'jeXGUuxFdf', 'aVAG1kxNSQ', 'Np2GXqZriE', 'RybGkKXrJ1', 'hDUNjP4mSuENZdUhrkq', 'c6d3rQ4gHQlpjViC8x8'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, JwOy8e1Oe81JxxIaL4.cs High entropy of concatenated method names: 'Dispose', 'uZJZF3ZMEB', 'nxfNrcim0E', 'RjYHHjtPAi', 'zVHZ3aWpaA', 'NOhZznegFN', 'ProcessDialogKey', 'YkAN21hlmK', 'UfSNZonKR0', 'XL6NNo45mu'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, RLSg2R6IrZ2GD8sVjc.cs High entropy of concatenated method names: 'U5fcJnbYU5', 'FgrcqVbTRn', 'i92cD0ElnJ', 'ob0crSH0W2', 'KaEcdTMcLH', 'zybceGLCa1', 'Jslcw2f3kC', 'Nc9cObKFJM', 'T3ocKs7hI1', 'wefc4xZdCh'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, gS5KKpZ2WTUXSwwu502.cs High entropy of concatenated method names: 'jAauIpyItj', 'Iksui9Imgy', 'fNGufsSEqM', 'Gyfu0sUfNb', 'LnGuQ2rJp3', 'd1muWBpRDB', 'LWrumPJE7u', 'PZSuJX58ok', 'om2uqtrhLM', 'qOBu5oOjL5'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, Oex7JwwMJCxfYXMxrL.cs High entropy of concatenated method names: 't8H8UhtG3f', 'NPm8XHR7PX', 'IaQ8PRDRUj', 'q7DP3y9NTF', 'T6JPzHchyu', 'SAj82TWNjK', 'ToX8ZinR9j', 'QBd8NgbPLY', 'TRd8hQnFvj', 'R5l8pmfenc'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, YHByLgCj8GJmh7Msgn.cs High entropy of concatenated method names: 'ToString', 'mZut4OUWmn', 'yhKtrYaJ6S', 'g0ftRtJZFS', 'Ru7td9wbAJ', 'fPCtejkKWW', 'XFctBIpm2b', 'J0UtwZsveU', 'EFFtOnaEfM', 'iXotAYpJ3p'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, iAJcic5IQC1sEN6tQ0.cs High entropy of concatenated method names: 'C8CkQh8ynU', 'EDJkmAGVKv', 'BxHXRMrjyb', 'JiWXdV4hui', 'c5iXeXhWsx', 'XGUXBaSUjw', 'qAYXwYwpvp', 'fa2XOdYNw8', 'jE8XArxu9J', 'Ks3XK6KpKA'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, XZIOZKAQoUDM9A8oeU.cs High entropy of concatenated method names: 'Dq68IoIbbW', 'ALs8iMSk3P', 'eQi8fo64KI', 'zet80Nu38j', 'F4y8Qe3naQ', 'UNc8Wjw3dZ', 'dCm8mcxjek', 'BDx8JpuLMs', 'gMN8qV9plQ', 'Oad85yi0Ot'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, tgoFEGNSHmepVwhgEo.cs High entropy of concatenated method names: 'Vbjfw6GR1', 'qer0VQQA9', 'tGlWX6SZR', 'BD7mMdQ3c', 'Aflq2ZNbo', 'jYE5BCHB2', 'u5vLVoTLhV1UqWXUfP', 'OwgEWYSMVX7eHA93h9', 'nL2agPkQF', 'RhhGTZlMD'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, C6p2pqJV2lX1KN4pKa.cs High entropy of concatenated method names: 'Sm91jd3oRy', 'IZC1s7VXtv', 'ko31CZNHcj', 'fuj1gaF4SS', 'Ps81b3yg6q', 'Yxm1M2Z5Dn', 'pHx1V8OQ2d', 'gIY19eK2ha', 'B7Q1FELsUn', 'tcv13t63wS'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, d8bGjiZhYYG0p7Yq2Vp.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CB0GjKojBB', 'hxRGs8wuXj', 'KAqGC3RCCt', 'QMPGgGP3FC', 'rdtGbTsDsr', 'GmTGM5MlF6', 'qhoGVas7xX'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, XhsEuGxgMg3yVMoqO1.cs High entropy of concatenated method names: 'VHIhnXjO9Q', 'ul0hUVKx9r', 'ncUh1iN8W0', 'mymhXsaa8S', 'NvWhkClvnL', 'dZPhPVfQcy', 'ae6h8NdQud', 'ASShxrUNa2', 'gDVhvRHI4q', 'wa3hltt0ft'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, hiC49dg7ThpoFoYW6F.cs High entropy of concatenated method names: 'iHg7l2juDc', 'oos7EOEHxZ', 'ToString', 'S0r7U00Fsn', 'uKO71RS1QL', 'BYR7X89jMG', 'DNp7kl2IM6', 'Hxd7PROhLb', 'Evr78AhDMD', 'QFN7xgvXO6'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, VHaWpa9AAOhnegFN3k.cs High entropy of concatenated method names: 'vH4aUlodM8', 'uYEa1xUh4X', 'zf3aXmBk75', 'E4RakUvqD4', 'pPSaPm7UMi', 'kI4a8UBJG8', 'fY8axeNyXV', 'RNZavuhtrS', 'uv4alIGguA', 'oqUaEv3dji'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, K4FQG6qRQZVKaJn6lH.cs High entropy of concatenated method names: 'vwgX0U6f4T', 'LtTXWtnudO', 'eYpXJAF300', 'k72XqnLaZ5', 'atBXySlMUM', 'umUXtgugGf', 'rXwX7OlW4q', 'bItXamLvy0', 'FpZXuWflQP', 'NebXGMYjqZ'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, h0Ifh0M4uwrgl7JUXj.cs High entropy of concatenated method names: 'ytl79NqFRQ', 'Uox73FvsMw', 'ag1a2rtkqH', 'rvwaZrDvqC', 'ELL74pnVOM', 'm6O7T9pHRZ', 'o30768hZFw', 'B1W7jccKC4', 'AZj7sew8n2', 'mVD7CVkWtH'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, M1hlmKFbfSonKR0FL6.cs High entropy of concatenated method names: 'pGZaDf4rOV', 'pv3arRf4K3', 'yRHaRt71Z2', 'bgvadRfJgG', 'fFAajSisfU', 'gIiaeARWQT', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, v45muV32yLcWxVHmFr.cs High entropy of concatenated method names: 'vKruZ1lLN5', 'qFruh7OZum', 'PqjupjdjgR', 'wdwuUvqudn', 'ivgu1oTBNs', 'Toauk3FUxD', 'FUMuPnp8Ye', 'NpFaVr9Mxa', 'Kyxa9JnfOg', 'dbJaFKMtDE'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, d7PkgCD1Icfh6t5u0R.cs High entropy of concatenated method names: 'dJtPnvbdFd', 'MMhP1PvvYa', 'f8PPkEeXc5', 'BOPP8OjeF8', 'h4KPxZMbPg', 'ztQkbg9m7b', 'lUpkMhl4Vx', 'rmEkVKNIp4', 'KkGk9pkCFE', 'swikF6FQfi'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, J2wSlmpLsG1BMrtNTV.cs High entropy of concatenated method names: 'bpmZ86p2pq', 'V2lZxX1KN4', 'QRQZlZVKaJ', 'e6lZEHPAJc', 'c6tZyQ0p7P', 'igCZt1Icfh', 'HMEJtJj4uhgY2Iw7JY', 'obyBpxfOG6fMawffu1', 'o9hZZnuGWN', 'Q0MZh5Cp8R'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, B6Uu1OZZW8FpZlqQ4RF.cs High entropy of concatenated method names: 'ToString', 'cqlGhQYePL', 'EUVGpBMv9y', 'OaTGnPoSPN', 'jeXGUuxFdf', 'aVAG1kxNSQ', 'Np2GXqZriE', 'RybGkKXrJ1', 'hDUNjP4mSuENZdUhrkq', 'c6d3rQ4gHQlpjViC8x8'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, JwOy8e1Oe81JxxIaL4.cs High entropy of concatenated method names: 'Dispose', 'uZJZF3ZMEB', 'nxfNrcim0E', 'RjYHHjtPAi', 'zVHZ3aWpaA', 'NOhZznegFN', 'ProcessDialogKey', 'YkAN21hlmK', 'UfSNZonKR0', 'XL6NNo45mu'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, RLSg2R6IrZ2GD8sVjc.cs High entropy of concatenated method names: 'U5fcJnbYU5', 'FgrcqVbTRn', 'i92cD0ElnJ', 'ob0crSH0W2', 'KaEcdTMcLH', 'zybceGLCa1', 'Jslcw2f3kC', 'Nc9cObKFJM', 'T3ocKs7hI1', 'wefc4xZdCh'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, gS5KKpZ2WTUXSwwu502.cs High entropy of concatenated method names: 'jAauIpyItj', 'Iksui9Imgy', 'fNGufsSEqM', 'Gyfu0sUfNb', 'LnGuQ2rJp3', 'd1muWBpRDB', 'LWrumPJE7u', 'PZSuJX58ok', 'om2uqtrhLM', 'qOBu5oOjL5'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, Oex7JwwMJCxfYXMxrL.cs High entropy of concatenated method names: 't8H8UhtG3f', 'NPm8XHR7PX', 'IaQ8PRDRUj', 'q7DP3y9NTF', 'T6JPzHchyu', 'SAj82TWNjK', 'ToX8ZinR9j', 'QBd8NgbPLY', 'TRd8hQnFvj', 'R5l8pmfenc'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, YHByLgCj8GJmh7Msgn.cs High entropy of concatenated method names: 'ToString', 'mZut4OUWmn', 'yhKtrYaJ6S', 'g0ftRtJZFS', 'Ru7td9wbAJ', 'fPCtejkKWW', 'XFctBIpm2b', 'J0UtwZsveU', 'EFFtOnaEfM', 'iXotAYpJ3p'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, iAJcic5IQC1sEN6tQ0.cs High entropy of concatenated method names: 'C8CkQh8ynU', 'EDJkmAGVKv', 'BxHXRMrjyb', 'JiWXdV4hui', 'c5iXeXhWsx', 'XGUXBaSUjw', 'qAYXwYwpvp', 'fa2XOdYNw8', 'jE8XArxu9J', 'Ks3XK6KpKA'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, XZIOZKAQoUDM9A8oeU.cs High entropy of concatenated method names: 'Dq68IoIbbW', 'ALs8iMSk3P', 'eQi8fo64KI', 'zet80Nu38j', 'F4y8Qe3naQ', 'UNc8Wjw3dZ', 'dCm8mcxjek', 'BDx8JpuLMs', 'gMN8qV9plQ', 'Oad85yi0Ot'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, tgoFEGNSHmepVwhgEo.cs High entropy of concatenated method names: 'Vbjfw6GR1', 'qer0VQQA9', 'tGlWX6SZR', 'BD7mMdQ3c', 'Aflq2ZNbo', 'jYE5BCHB2', 'u5vLVoTLhV1UqWXUfP', 'OwgEWYSMVX7eHA93h9', 'nL2agPkQF', 'RhhGTZlMD'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, C6p2pqJV2lX1KN4pKa.cs High entropy of concatenated method names: 'Sm91jd3oRy', 'IZC1s7VXtv', 'ko31CZNHcj', 'fuj1gaF4SS', 'Ps81b3yg6q', 'Yxm1M2Z5Dn', 'pHx1V8OQ2d', 'gIY19eK2ha', 'B7Q1FELsUn', 'tcv13t63wS'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, d8bGjiZhYYG0p7Yq2Vp.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CB0GjKojBB', 'hxRGs8wuXj', 'KAqGC3RCCt', 'QMPGgGP3FC', 'rdtGbTsDsr', 'GmTGM5MlF6', 'qhoGVas7xX'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, XhsEuGxgMg3yVMoqO1.cs High entropy of concatenated method names: 'VHIhnXjO9Q', 'ul0hUVKx9r', 'ncUh1iN8W0', 'mymhXsaa8S', 'NvWhkClvnL', 'dZPhPVfQcy', 'ae6h8NdQud', 'ASShxrUNa2', 'gDVhvRHI4q', 'wa3hltt0ft'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, hiC49dg7ThpoFoYW6F.cs High entropy of concatenated method names: 'iHg7l2juDc', 'oos7EOEHxZ', 'ToString', 'S0r7U00Fsn', 'uKO71RS1QL', 'BYR7X89jMG', 'DNp7kl2IM6', 'Hxd7PROhLb', 'Evr78AhDMD', 'QFN7xgvXO6'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, VHaWpa9AAOhnegFN3k.cs High entropy of concatenated method names: 'vH4aUlodM8', 'uYEa1xUh4X', 'zf3aXmBk75', 'E4RakUvqD4', 'pPSaPm7UMi', 'kI4a8UBJG8', 'fY8axeNyXV', 'RNZavuhtrS', 'uv4alIGguA', 'oqUaEv3dji'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, K4FQG6qRQZVKaJn6lH.cs High entropy of concatenated method names: 'vwgX0U6f4T', 'LtTXWtnudO', 'eYpXJAF300', 'k72XqnLaZ5', 'atBXySlMUM', 'umUXtgugGf', 'rXwX7OlW4q', 'bItXamLvy0', 'FpZXuWflQP', 'NebXGMYjqZ'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, h0Ifh0M4uwrgl7JUXj.cs High entropy of concatenated method names: 'ytl79NqFRQ', 'Uox73FvsMw', 'ag1a2rtkqH', 'rvwaZrDvqC', 'ELL74pnVOM', 'm6O7T9pHRZ', 'o30768hZFw', 'B1W7jccKC4', 'AZj7sew8n2', 'mVD7CVkWtH'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, M1hlmKFbfSonKR0FL6.cs High entropy of concatenated method names: 'pGZaDf4rOV', 'pv3arRf4K3', 'yRHaRt71Z2', 'bgvadRfJgG', 'fFAajSisfU', 'gIiaeARWQT', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, v45muV32yLcWxVHmFr.cs High entropy of concatenated method names: 'vKruZ1lLN5', 'qFruh7OZum', 'PqjupjdjgR', 'wdwuUvqudn', 'ivgu1oTBNs', 'Toauk3FUxD', 'FUMuPnp8Ye', 'NpFaVr9Mxa', 'Kyxa9JnfOg', 'dbJaFKMtDE'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, d7PkgCD1Icfh6t5u0R.cs High entropy of concatenated method names: 'dJtPnvbdFd', 'MMhP1PvvYa', 'f8PPkEeXc5', 'BOPP8OjeF8', 'h4KPxZMbPg', 'ztQkbg9m7b', 'lUpkMhl4Vx', 'rmEkVKNIp4', 'KkGk9pkCFE', 'swikF6FQfi'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, J2wSlmpLsG1BMrtNTV.cs High entropy of concatenated method names: 'bpmZ86p2pq', 'V2lZxX1KN4', 'QRQZlZVKaJ', 'e6lZEHPAJc', 'c6tZyQ0p7P', 'igCZt1Icfh', 'HMEJtJj4uhgY2Iw7JY', 'obyBpxfOG6fMawffu1', 'o9hZZnuGWN', 'Q0MZh5Cp8R'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, B6Uu1OZZW8FpZlqQ4RF.cs High entropy of concatenated method names: 'ToString', 'cqlGhQYePL', 'EUVGpBMv9y', 'OaTGnPoSPN', 'jeXGUuxFdf', 'aVAG1kxNSQ', 'Np2GXqZriE', 'RybGkKXrJ1', 'hDUNjP4mSuENZdUhrkq', 'c6d3rQ4gHQlpjViC8x8'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, JwOy8e1Oe81JxxIaL4.cs High entropy of concatenated method names: 'Dispose', 'uZJZF3ZMEB', 'nxfNrcim0E', 'RjYHHjtPAi', 'zVHZ3aWpaA', 'NOhZznegFN', 'ProcessDialogKey', 'YkAN21hlmK', 'UfSNZonKR0', 'XL6NNo45mu'

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: PO1038854.exe PID: 4440, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\PO1038854.exe Memory allocated: 14F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Memory allocated: 2EF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Memory allocated: 2E40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Memory allocated: 7A90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Memory allocated: 8A90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Memory allocated: 8C30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Memory allocated: 9C30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Memory allocated: A1D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Memory allocated: B1D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Memory allocated: C1D0000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A0096E rdtsc 5_2_01A0096E
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\PO1038854.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6802 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1370 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\PO1038854.exe API coverage: 0.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\PO1038854.exe TID: 6236 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6532 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6112 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe TID: 4568 Thread sleep time: -30000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\PO1038854.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\PO1038854.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A0096E rdtsc 5_2_01A0096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_00417DB3 LdrLoadDll, 5_2_00417DB3
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019BA197 mov eax, dword ptr fs:[00000030h] 5_2_019BA197
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019BA197 mov eax, dword ptr fs:[00000030h] 5_2_019BA197
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019BA197 mov eax, dword ptr fs:[00000030h] 5_2_019BA197
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A00185 mov eax, dword ptr fs:[00000030h] 5_2_01A00185
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A64180 mov eax, dword ptr fs:[00000030h] 5_2_01A64180
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A64180 mov eax, dword ptr fs:[00000030h] 5_2_01A64180
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A7C188 mov eax, dword ptr fs:[00000030h] 5_2_01A7C188
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A7C188 mov eax, dword ptr fs:[00000030h] 5_2_01A7C188
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4019F mov eax, dword ptr fs:[00000030h] 5_2_01A4019F
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4019F mov eax, dword ptr fs:[00000030h] 5_2_01A4019F
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4019F mov eax, dword ptr fs:[00000030h] 5_2_01A4019F
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4019F mov eax, dword ptr fs:[00000030h] 5_2_01A4019F
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A961E5 mov eax, dword ptr fs:[00000030h] 5_2_01A961E5
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F01F8 mov eax, dword ptr fs:[00000030h] 5_2_019F01F8
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A861C3 mov eax, dword ptr fs:[00000030h] 5_2_01A861C3
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A861C3 mov eax, dword ptr fs:[00000030h] 5_2_01A861C3
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3E1D0 mov eax, dword ptr fs:[00000030h] 5_2_01A3E1D0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3E1D0 mov eax, dword ptr fs:[00000030h] 5_2_01A3E1D0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3E1D0 mov ecx, dword ptr fs:[00000030h] 5_2_01A3E1D0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3E1D0 mov eax, dword ptr fs:[00000030h] 5_2_01A3E1D0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3E1D0 mov eax, dword ptr fs:[00000030h] 5_2_01A3E1D0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6E10E mov eax, dword ptr fs:[00000030h] 5_2_01A6E10E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6E10E mov ecx, dword ptr fs:[00000030h] 5_2_01A6E10E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6E10E mov eax, dword ptr fs:[00000030h] 5_2_01A6E10E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6E10E mov eax, dword ptr fs:[00000030h] 5_2_01A6E10E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6E10E mov ecx, dword ptr fs:[00000030h] 5_2_01A6E10E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6E10E mov eax, dword ptr fs:[00000030h] 5_2_01A6E10E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6E10E mov eax, dword ptr fs:[00000030h] 5_2_01A6E10E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6E10E mov ecx, dword ptr fs:[00000030h] 5_2_01A6E10E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6E10E mov eax, dword ptr fs:[00000030h] 5_2_01A6E10E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6E10E mov ecx, dword ptr fs:[00000030h] 5_2_01A6E10E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F0124 mov eax, dword ptr fs:[00000030h] 5_2_019F0124
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A80115 mov eax, dword ptr fs:[00000030h] 5_2_01A80115
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6A118 mov ecx, dword ptr fs:[00000030h] 5_2_01A6A118
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6A118 mov eax, dword ptr fs:[00000030h] 5_2_01A6A118
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6A118 mov eax, dword ptr fs:[00000030h] 5_2_01A6A118
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6A118 mov eax, dword ptr fs:[00000030h] 5_2_01A6A118
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C6154 mov eax, dword ptr fs:[00000030h] 5_2_019C6154
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C6154 mov eax, dword ptr fs:[00000030h] 5_2_019C6154
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019BC156 mov eax, dword ptr fs:[00000030h] 5_2_019BC156
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A94164 mov eax, dword ptr fs:[00000030h] 5_2_01A94164
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A94164 mov eax, dword ptr fs:[00000030h] 5_2_01A94164
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A54144 mov eax, dword ptr fs:[00000030h] 5_2_01A54144
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A54144 mov eax, dword ptr fs:[00000030h] 5_2_01A54144
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A54144 mov ecx, dword ptr fs:[00000030h] 5_2_01A54144
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A54144 mov eax, dword ptr fs:[00000030h] 5_2_01A54144
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A54144 mov eax, dword ptr fs:[00000030h] 5_2_01A54144
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A58158 mov eax, dword ptr fs:[00000030h] 5_2_01A58158
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A580A8 mov eax, dword ptr fs:[00000030h] 5_2_01A580A8
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A860B8 mov eax, dword ptr fs:[00000030h] 5_2_01A860B8
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A860B8 mov ecx, dword ptr fs:[00000030h] 5_2_01A860B8
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C208A mov eax, dword ptr fs:[00000030h] 5_2_019C208A
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019B80A0 mov eax, dword ptr fs:[00000030h] 5_2_019B80A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A460E0 mov eax, dword ptr fs:[00000030h] 5_2_01A460E0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A020F0 mov ecx, dword ptr fs:[00000030h] 5_2_01A020F0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019BC0F0 mov eax, dword ptr fs:[00000030h] 5_2_019BC0F0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C80E9 mov eax, dword ptr fs:[00000030h] 5_2_019C80E9
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019BA0E3 mov ecx, dword ptr fs:[00000030h] 5_2_019BA0E3
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A420DE mov eax, dword ptr fs:[00000030h] 5_2_01A420DE
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019DE016 mov eax, dword ptr fs:[00000030h] 5_2_019DE016
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019DE016 mov eax, dword ptr fs:[00000030h] 5_2_019DE016
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019DE016 mov eax, dword ptr fs:[00000030h] 5_2_019DE016
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019DE016 mov eax, dword ptr fs:[00000030h] 5_2_019DE016
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A56030 mov eax, dword ptr fs:[00000030h] 5_2_01A56030
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A44000 mov ecx, dword ptr fs:[00000030h] 5_2_01A44000
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A62000 mov eax, dword ptr fs:[00000030h] 5_2_01A62000
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A62000 mov eax, dword ptr fs:[00000030h] 5_2_01A62000
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A62000 mov eax, dword ptr fs:[00000030h] 5_2_01A62000
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A62000 mov eax, dword ptr fs:[00000030h] 5_2_01A62000
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A62000 mov eax, dword ptr fs:[00000030h] 5_2_01A62000
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A62000 mov eax, dword ptr fs:[00000030h] 5_2_01A62000
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A62000 mov eax, dword ptr fs:[00000030h] 5_2_01A62000
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A62000 mov eax, dword ptr fs:[00000030h] 5_2_01A62000
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019BA020 mov eax, dword ptr fs:[00000030h] 5_2_019BA020
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019BC020 mov eax, dword ptr fs:[00000030h] 5_2_019BC020
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C2050 mov eax, dword ptr fs:[00000030h] 5_2_019C2050
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EC073 mov eax, dword ptr fs:[00000030h] 5_2_019EC073
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A46050 mov eax, dword ptr fs:[00000030h] 5_2_01A46050
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019B8397 mov eax, dword ptr fs:[00000030h] 5_2_019B8397
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019B8397 mov eax, dword ptr fs:[00000030h] 5_2_019B8397
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019B8397 mov eax, dword ptr fs:[00000030h] 5_2_019B8397
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E438F mov eax, dword ptr fs:[00000030h] 5_2_019E438F
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E438F mov eax, dword ptr fs:[00000030h] 5_2_019E438F
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019BE388 mov eax, dword ptr fs:[00000030h] 5_2_019BE388
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019BE388 mov eax, dword ptr fs:[00000030h] 5_2_019BE388
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019BE388 mov eax, dword ptr fs:[00000030h] 5_2_019BE388
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CA3C0 mov eax, dword ptr fs:[00000030h] 5_2_019CA3C0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CA3C0 mov eax, dword ptr fs:[00000030h] 5_2_019CA3C0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CA3C0 mov eax, dword ptr fs:[00000030h] 5_2_019CA3C0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CA3C0 mov eax, dword ptr fs:[00000030h] 5_2_019CA3C0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CA3C0 mov eax, dword ptr fs:[00000030h] 5_2_019CA3C0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CA3C0 mov eax, dword ptr fs:[00000030h] 5_2_019CA3C0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C83C0 mov eax, dword ptr fs:[00000030h] 5_2_019C83C0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C83C0 mov eax, dword ptr fs:[00000030h] 5_2_019C83C0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C83C0 mov eax, dword ptr fs:[00000030h] 5_2_019C83C0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C83C0 mov eax, dword ptr fs:[00000030h] 5_2_019C83C0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F63FF mov eax, dword ptr fs:[00000030h] 5_2_019F63FF
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A463C0 mov eax, dword ptr fs:[00000030h] 5_2_01A463C0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A7C3CD mov eax, dword ptr fs:[00000030h] 5_2_01A7C3CD
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019DE3F0 mov eax, dword ptr fs:[00000030h] 5_2_019DE3F0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019DE3F0 mov eax, dword ptr fs:[00000030h] 5_2_019DE3F0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019DE3F0 mov eax, dword ptr fs:[00000030h] 5_2_019DE3F0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A643D4 mov eax, dword ptr fs:[00000030h] 5_2_01A643D4
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A643D4 mov eax, dword ptr fs:[00000030h] 5_2_01A643D4
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D03E9 mov eax, dword ptr fs:[00000030h] 5_2_019D03E9
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D03E9 mov eax, dword ptr fs:[00000030h] 5_2_019D03E9
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D03E9 mov eax, dword ptr fs:[00000030h] 5_2_019D03E9
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D03E9 mov eax, dword ptr fs:[00000030h] 5_2_019D03E9
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D03E9 mov eax, dword ptr fs:[00000030h] 5_2_019D03E9
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D03E9 mov eax, dword ptr fs:[00000030h] 5_2_019D03E9
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D03E9 mov eax, dword ptr fs:[00000030h] 5_2_019D03E9
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D03E9 mov eax, dword ptr fs:[00000030h] 5_2_019D03E9
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6E3DB mov eax, dword ptr fs:[00000030h] 5_2_01A6E3DB
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6E3DB mov eax, dword ptr fs:[00000030h] 5_2_01A6E3DB
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6E3DB mov ecx, dword ptr fs:[00000030h] 5_2_01A6E3DB
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6E3DB mov eax, dword ptr fs:[00000030h] 5_2_01A6E3DB
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019BC310 mov ecx, dword ptr fs:[00000030h] 5_2_019BC310
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A98324 mov eax, dword ptr fs:[00000030h] 5_2_01A98324
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A98324 mov ecx, dword ptr fs:[00000030h] 5_2_01A98324
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A98324 mov eax, dword ptr fs:[00000030h] 5_2_01A98324
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A98324 mov eax, dword ptr fs:[00000030h] 5_2_01A98324
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E0310 mov ecx, dword ptr fs:[00000030h] 5_2_019E0310
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FA30B mov eax, dword ptr fs:[00000030h] 5_2_019FA30B
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FA30B mov eax, dword ptr fs:[00000030h] 5_2_019FA30B
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FA30B mov eax, dword ptr fs:[00000030h] 5_2_019FA30B
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6437C mov eax, dword ptr fs:[00000030h] 5_2_01A6437C
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A9634F mov eax, dword ptr fs:[00000030h] 5_2_01A9634F
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h] 5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h] 5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h] 5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h] 5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h] 5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h] 5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h] 5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h] 5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h] 5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h] 5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h] 5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h] 5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h] 5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h] 5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h] 5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A68350 mov ecx, dword ptr fs:[00000030h] 5_2_01A68350
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4035C mov eax, dword ptr fs:[00000030h] 5_2_01A4035C
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4035C mov eax, dword ptr fs:[00000030h] 5_2_01A4035C
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4035C mov eax, dword ptr fs:[00000030h] 5_2_01A4035C
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4035C mov ecx, dword ptr fs:[00000030h] 5_2_01A4035C
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4035C mov eax, dword ptr fs:[00000030h] 5_2_01A4035C
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4035C mov eax, dword ptr fs:[00000030h] 5_2_01A4035C
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A8A352 mov eax, dword ptr fs:[00000030h] 5_2_01A8A352
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A562A0 mov eax, dword ptr fs:[00000030h] 5_2_01A562A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A562A0 mov ecx, dword ptr fs:[00000030h] 5_2_01A562A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A562A0 mov eax, dword ptr fs:[00000030h] 5_2_01A562A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A562A0 mov eax, dword ptr fs:[00000030h] 5_2_01A562A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A562A0 mov eax, dword ptr fs:[00000030h] 5_2_01A562A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A562A0 mov eax, dword ptr fs:[00000030h] 5_2_01A562A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FE284 mov eax, dword ptr fs:[00000030h] 5_2_019FE284
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FE284 mov eax, dword ptr fs:[00000030h] 5_2_019FE284
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A40283 mov eax, dword ptr fs:[00000030h] 5_2_01A40283
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A40283 mov eax, dword ptr fs:[00000030h] 5_2_01A40283
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A40283 mov eax, dword ptr fs:[00000030h] 5_2_01A40283
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CA2C3 mov eax, dword ptr fs:[00000030h] 5_2_019CA2C3
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CA2C3 mov eax, dword ptr fs:[00000030h] 5_2_019CA2C3
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CA2C3 mov eax, dword ptr fs:[00000030h] 5_2_019CA2C3
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CA2C3 mov eax, dword ptr fs:[00000030h] 5_2_019CA2C3
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CA2C3 mov eax, dword ptr fs:[00000030h] 5_2_019CA2C3
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D02E1 mov eax, dword ptr fs:[00000030h] 5_2_019D02E1
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D02E1 mov eax, dword ptr fs:[00000030h] 5_2_019D02E1
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D02E1 mov eax, dword ptr fs:[00000030h] 5_2_019D02E1
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A962D6 mov eax, dword ptr fs:[00000030h] 5_2_01A962D6
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019B823B mov eax, dword ptr fs:[00000030h] 5_2_019B823B
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C6259 mov eax, dword ptr fs:[00000030h] 5_2_019C6259
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019BA250 mov eax, dword ptr fs:[00000030h] 5_2_019BA250
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h] 5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h] 5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h] 5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h] 5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h] 5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h] 5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h] 5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h] 5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h] 5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h] 5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h] 5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h] 5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A48243 mov eax, dword ptr fs:[00000030h] 5_2_01A48243
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A48243 mov ecx, dword ptr fs:[00000030h] 5_2_01A48243
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019B826B mov eax, dword ptr fs:[00000030h] 5_2_019B826B
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A9625D mov eax, dword ptr fs:[00000030h] 5_2_01A9625D
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A7A250 mov eax, dword ptr fs:[00000030h] 5_2_01A7A250
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A7A250 mov eax, dword ptr fs:[00000030h] 5_2_01A7A250
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C4260 mov eax, dword ptr fs:[00000030h] 5_2_019C4260
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C4260 mov eax, dword ptr fs:[00000030h] 5_2_019C4260
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C4260 mov eax, dword ptr fs:[00000030h] 5_2_019C4260
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FE59C mov eax, dword ptr fs:[00000030h] 5_2_019FE59C
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A405A7 mov eax, dword ptr fs:[00000030h] 5_2_01A405A7
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A405A7 mov eax, dword ptr fs:[00000030h] 5_2_01A405A7
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A405A7 mov eax, dword ptr fs:[00000030h] 5_2_01A405A7
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F4588 mov eax, dword ptr fs:[00000030h] 5_2_019F4588
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C2582 mov eax, dword ptr fs:[00000030h] 5_2_019C2582
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C2582 mov ecx, dword ptr fs:[00000030h] 5_2_019C2582
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E45B1 mov eax, dword ptr fs:[00000030h] 5_2_019E45B1
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E45B1 mov eax, dword ptr fs:[00000030h] 5_2_019E45B1
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C65D0 mov eax, dword ptr fs:[00000030h] 5_2_019C65D0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FA5D0 mov eax, dword ptr fs:[00000030h] 5_2_019FA5D0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FA5D0 mov eax, dword ptr fs:[00000030h] 5_2_019FA5D0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FE5CF mov eax, dword ptr fs:[00000030h] 5_2_019FE5CF
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FE5CF mov eax, dword ptr fs:[00000030h] 5_2_019FE5CF
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FC5ED mov eax, dword ptr fs:[00000030h] 5_2_019FC5ED
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FC5ED mov eax, dword ptr fs:[00000030h] 5_2_019FC5ED
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EE5E7 mov eax, dword ptr fs:[00000030h] 5_2_019EE5E7
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EE5E7 mov eax, dword ptr fs:[00000030h] 5_2_019EE5E7
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EE5E7 mov eax, dword ptr fs:[00000030h] 5_2_019EE5E7
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EE5E7 mov eax, dword ptr fs:[00000030h] 5_2_019EE5E7
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EE5E7 mov eax, dword ptr fs:[00000030h] 5_2_019EE5E7
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EE5E7 mov eax, dword ptr fs:[00000030h] 5_2_019EE5E7
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EE5E7 mov eax, dword ptr fs:[00000030h] 5_2_019EE5E7
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EE5E7 mov eax, dword ptr fs:[00000030h] 5_2_019EE5E7
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C25E0 mov eax, dword ptr fs:[00000030h] 5_2_019C25E0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EE53E mov eax, dword ptr fs:[00000030h] 5_2_019EE53E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EE53E mov eax, dword ptr fs:[00000030h] 5_2_019EE53E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EE53E mov eax, dword ptr fs:[00000030h] 5_2_019EE53E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EE53E mov eax, dword ptr fs:[00000030h] 5_2_019EE53E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EE53E mov eax, dword ptr fs:[00000030h] 5_2_019EE53E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A56500 mov eax, dword ptr fs:[00000030h] 5_2_01A56500
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0535 mov eax, dword ptr fs:[00000030h] 5_2_019D0535
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0535 mov eax, dword ptr fs:[00000030h] 5_2_019D0535
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0535 mov eax, dword ptr fs:[00000030h] 5_2_019D0535
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0535 mov eax, dword ptr fs:[00000030h] 5_2_019D0535
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0535 mov eax, dword ptr fs:[00000030h] 5_2_019D0535
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0535 mov eax, dword ptr fs:[00000030h] 5_2_019D0535
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A94500 mov eax, dword ptr fs:[00000030h] 5_2_01A94500
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A94500 mov eax, dword ptr fs:[00000030h] 5_2_01A94500
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A94500 mov eax, dword ptr fs:[00000030h] 5_2_01A94500
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A94500 mov eax, dword ptr fs:[00000030h] 5_2_01A94500
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A94500 mov eax, dword ptr fs:[00000030h] 5_2_01A94500
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A94500 mov eax, dword ptr fs:[00000030h] 5_2_01A94500
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A94500 mov eax, dword ptr fs:[00000030h] 5_2_01A94500
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C8550 mov eax, dword ptr fs:[00000030h] 5_2_019C8550
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C8550 mov eax, dword ptr fs:[00000030h] 5_2_019C8550
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F656A mov eax, dword ptr fs:[00000030h] 5_2_019F656A
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F656A mov eax, dword ptr fs:[00000030h] 5_2_019F656A
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F656A mov eax, dword ptr fs:[00000030h] 5_2_019F656A
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4A4B0 mov eax, dword ptr fs:[00000030h] 5_2_01A4A4B0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F44B0 mov ecx, dword ptr fs:[00000030h] 5_2_019F44B0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C64AB mov eax, dword ptr fs:[00000030h] 5_2_019C64AB
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A7A49A mov eax, dword ptr fs:[00000030h] 5_2_01A7A49A
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C04E5 mov ecx, dword ptr fs:[00000030h] 5_2_019C04E5
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A46420 mov eax, dword ptr fs:[00000030h] 5_2_01A46420
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A46420 mov eax, dword ptr fs:[00000030h] 5_2_01A46420
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A46420 mov eax, dword ptr fs:[00000030h] 5_2_01A46420
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A46420 mov eax, dword ptr fs:[00000030h] 5_2_01A46420
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A46420 mov eax, dword ptr fs:[00000030h] 5_2_01A46420
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A46420 mov eax, dword ptr fs:[00000030h] 5_2_01A46420
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A46420 mov eax, dword ptr fs:[00000030h] 5_2_01A46420
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F8402 mov eax, dword ptr fs:[00000030h] 5_2_019F8402
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F8402 mov eax, dword ptr fs:[00000030h] 5_2_019F8402
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F8402 mov eax, dword ptr fs:[00000030h] 5_2_019F8402
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FA430 mov eax, dword ptr fs:[00000030h] 5_2_019FA430
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019BE420 mov eax, dword ptr fs:[00000030h] 5_2_019BE420
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019BE420 mov eax, dword ptr fs:[00000030h] 5_2_019BE420
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019BE420 mov eax, dword ptr fs:[00000030h] 5_2_019BE420
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019BC427 mov eax, dword ptr fs:[00000030h] 5_2_019BC427
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E245A mov eax, dword ptr fs:[00000030h] 5_2_019E245A
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4C460 mov ecx, dword ptr fs:[00000030h] 5_2_01A4C460
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019B645D mov eax, dword ptr fs:[00000030h] 5_2_019B645D
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FE443 mov eax, dword ptr fs:[00000030h] 5_2_019FE443
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FE443 mov eax, dword ptr fs:[00000030h] 5_2_019FE443
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FE443 mov eax, dword ptr fs:[00000030h] 5_2_019FE443
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FE443 mov eax, dword ptr fs:[00000030h] 5_2_019FE443
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FE443 mov eax, dword ptr fs:[00000030h] 5_2_019FE443
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FE443 mov eax, dword ptr fs:[00000030h] 5_2_019FE443
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FE443 mov eax, dword ptr fs:[00000030h] 5_2_019FE443
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FE443 mov eax, dword ptr fs:[00000030h] 5_2_019FE443
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EA470 mov eax, dword ptr fs:[00000030h] 5_2_019EA470
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EA470 mov eax, dword ptr fs:[00000030h] 5_2_019EA470
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EA470 mov eax, dword ptr fs:[00000030h] 5_2_019EA470
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A7A456 mov eax, dword ptr fs:[00000030h] 5_2_01A7A456
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A747A0 mov eax, dword ptr fs:[00000030h] 5_2_01A747A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6678E mov eax, dword ptr fs:[00000030h] 5_2_01A6678E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C07AF mov eax, dword ptr fs:[00000030h] 5_2_019C07AF
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4E7E1 mov eax, dword ptr fs:[00000030h] 5_2_01A4E7E1
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CC7C0 mov eax, dword ptr fs:[00000030h] 5_2_019CC7C0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C47FB mov eax, dword ptr fs:[00000030h] 5_2_019C47FB
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C47FB mov eax, dword ptr fs:[00000030h] 5_2_019C47FB
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A407C3 mov eax, dword ptr fs:[00000030h] 5_2_01A407C3
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E27ED mov eax, dword ptr fs:[00000030h] 5_2_019E27ED
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E27ED mov eax, dword ptr fs:[00000030h] 5_2_019E27ED
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E27ED mov eax, dword ptr fs:[00000030h] 5_2_019E27ED
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C0710 mov eax, dword ptr fs:[00000030h] 5_2_019C0710
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F0710 mov eax, dword ptr fs:[00000030h] 5_2_019F0710
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3C730 mov eax, dword ptr fs:[00000030h] 5_2_01A3C730
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FC700 mov eax, dword ptr fs:[00000030h] 5_2_019FC700
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F273C mov eax, dword ptr fs:[00000030h] 5_2_019F273C
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F273C mov ecx, dword ptr fs:[00000030h] 5_2_019F273C
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F273C mov eax, dword ptr fs:[00000030h] 5_2_019F273C
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FC720 mov eax, dword ptr fs:[00000030h] 5_2_019FC720
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FC720 mov eax, dword ptr fs:[00000030h] 5_2_019FC720
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C0750 mov eax, dword ptr fs:[00000030h] 5_2_019C0750
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F674D mov esi, dword ptr fs:[00000030h] 5_2_019F674D
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F674D mov eax, dword ptr fs:[00000030h] 5_2_019F674D
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F674D mov eax, dword ptr fs:[00000030h] 5_2_019F674D
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C8770 mov eax, dword ptr fs:[00000030h] 5_2_019C8770
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h] 5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h] 5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h] 5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h] 5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h] 5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h] 5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h] 5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h] 5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h] 5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h] 5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h] 5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h] 5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02750 mov eax, dword ptr fs:[00000030h] 5_2_01A02750
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02750 mov eax, dword ptr fs:[00000030h] 5_2_01A02750
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A44755 mov eax, dword ptr fs:[00000030h] 5_2_01A44755
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4E75D mov eax, dword ptr fs:[00000030h] 5_2_01A4E75D
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C4690 mov eax, dword ptr fs:[00000030h] 5_2_019C4690
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C4690 mov eax, dword ptr fs:[00000030h] 5_2_019C4690
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F66B0 mov eax, dword ptr fs:[00000030h] 5_2_019F66B0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FC6A6 mov eax, dword ptr fs:[00000030h] 5_2_019FC6A6
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3E6F2 mov eax, dword ptr fs:[00000030h] 5_2_01A3E6F2
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3E6F2 mov eax, dword ptr fs:[00000030h] 5_2_01A3E6F2
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3E6F2 mov eax, dword ptr fs:[00000030h] 5_2_01A3E6F2
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3E6F2 mov eax, dword ptr fs:[00000030h] 5_2_01A3E6F2
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A406F1 mov eax, dword ptr fs:[00000030h] 5_2_01A406F1
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A406F1 mov eax, dword ptr fs:[00000030h] 5_2_01A406F1
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FA6C7 mov ebx, dword ptr fs:[00000030h] 5_2_019FA6C7
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FA6C7 mov eax, dword ptr fs:[00000030h] 5_2_019FA6C7
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D260B mov eax, dword ptr fs:[00000030h] 5_2_019D260B
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D260B mov eax, dword ptr fs:[00000030h] 5_2_019D260B
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D260B mov eax, dword ptr fs:[00000030h] 5_2_019D260B
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D260B mov eax, dword ptr fs:[00000030h] 5_2_019D260B
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D260B mov eax, dword ptr fs:[00000030h] 5_2_019D260B
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D260B mov eax, dword ptr fs:[00000030h] 5_2_019D260B
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D260B mov eax, dword ptr fs:[00000030h] 5_2_019D260B
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3E609 mov eax, dword ptr fs:[00000030h] 5_2_01A3E609
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C262C mov eax, dword ptr fs:[00000030h] 5_2_019C262C
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A02619 mov eax, dword ptr fs:[00000030h] 5_2_01A02619
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019DE627 mov eax, dword ptr fs:[00000030h] 5_2_019DE627
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F6620 mov eax, dword ptr fs:[00000030h] 5_2_019F6620
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F8620 mov eax, dword ptr fs:[00000030h] 5_2_019F8620
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A8866E mov eax, dword ptr fs:[00000030h] 5_2_01A8866E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A8866E mov eax, dword ptr fs:[00000030h] 5_2_01A8866E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019DC640 mov eax, dword ptr fs:[00000030h] 5_2_019DC640
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F2674 mov eax, dword ptr fs:[00000030h] 5_2_019F2674
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FA660 mov eax, dword ptr fs:[00000030h] 5_2_019FA660
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FA660 mov eax, dword ptr fs:[00000030h] 5_2_019FA660
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A489B3 mov esi, dword ptr fs:[00000030h] 5_2_01A489B3
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A489B3 mov eax, dword ptr fs:[00000030h] 5_2_01A489B3
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A489B3 mov eax, dword ptr fs:[00000030h] 5_2_01A489B3
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C09AD mov eax, dword ptr fs:[00000030h] 5_2_019C09AD
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C09AD mov eax, dword ptr fs:[00000030h] 5_2_019C09AD
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h] 5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h] 5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h] 5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h] 5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h] 5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h] 5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h] 5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h] 5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h] 5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h] 5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h] 5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h] 5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h] 5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4E9E0 mov eax, dword ptr fs:[00000030h] 5_2_01A4E9E0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CA9D0 mov eax, dword ptr fs:[00000030h] 5_2_019CA9D0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CA9D0 mov eax, dword ptr fs:[00000030h] 5_2_019CA9D0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CA9D0 mov eax, dword ptr fs:[00000030h] 5_2_019CA9D0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CA9D0 mov eax, dword ptr fs:[00000030h] 5_2_019CA9D0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CA9D0 mov eax, dword ptr fs:[00000030h] 5_2_019CA9D0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CA9D0 mov eax, dword ptr fs:[00000030h] 5_2_019CA9D0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F49D0 mov eax, dword ptr fs:[00000030h] 5_2_019F49D0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A569C0 mov eax, dword ptr fs:[00000030h] 5_2_01A569C0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F29F9 mov eax, dword ptr fs:[00000030h] 5_2_019F29F9
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F29F9 mov eax, dword ptr fs:[00000030h] 5_2_019F29F9
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A8A9D3 mov eax, dword ptr fs:[00000030h] 5_2_01A8A9D3
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019B8918 mov eax, dword ptr fs:[00000030h] 5_2_019B8918
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019B8918 mov eax, dword ptr fs:[00000030h] 5_2_019B8918
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4892A mov eax, dword ptr fs:[00000030h] 5_2_01A4892A
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A5892B mov eax, dword ptr fs:[00000030h] 5_2_01A5892B
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3E908 mov eax, dword ptr fs:[00000030h] 5_2_01A3E908
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3E908 mov eax, dword ptr fs:[00000030h] 5_2_01A3E908
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4C912 mov eax, dword ptr fs:[00000030h] 5_2_01A4C912
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A0096E mov eax, dword ptr fs:[00000030h] 5_2_01A0096E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A0096E mov edx, dword ptr fs:[00000030h] 5_2_01A0096E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A0096E mov eax, dword ptr fs:[00000030h] 5_2_01A0096E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4C97C mov eax, dword ptr fs:[00000030h] 5_2_01A4C97C
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A64978 mov eax, dword ptr fs:[00000030h] 5_2_01A64978
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A64978 mov eax, dword ptr fs:[00000030h] 5_2_01A64978
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A40946 mov eax, dword ptr fs:[00000030h] 5_2_01A40946
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A94940 mov eax, dword ptr fs:[00000030h] 5_2_01A94940
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E6962 mov eax, dword ptr fs:[00000030h] 5_2_019E6962
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E6962 mov eax, dword ptr fs:[00000030h] 5_2_019E6962
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E6962 mov eax, dword ptr fs:[00000030h] 5_2_019E6962
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C0887 mov eax, dword ptr fs:[00000030h] 5_2_019C0887
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4C89D mov eax, dword ptr fs:[00000030h] 5_2_01A4C89D
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A8A8E4 mov eax, dword ptr fs:[00000030h] 5_2_01A8A8E4
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EE8C0 mov eax, dword ptr fs:[00000030h] 5_2_019EE8C0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FC8F9 mov eax, dword ptr fs:[00000030h] 5_2_019FC8F9
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FC8F9 mov eax, dword ptr fs:[00000030h] 5_2_019FC8F9
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A908C0 mov eax, dword ptr fs:[00000030h] 5_2_01A908C0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6483A mov eax, dword ptr fs:[00000030h] 5_2_01A6483A
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6483A mov eax, dword ptr fs:[00000030h] 5_2_01A6483A
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E2835 mov eax, dword ptr fs:[00000030h] 5_2_019E2835
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E2835 mov eax, dword ptr fs:[00000030h] 5_2_019E2835
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E2835 mov eax, dword ptr fs:[00000030h] 5_2_019E2835
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E2835 mov ecx, dword ptr fs:[00000030h] 5_2_019E2835
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E2835 mov eax, dword ptr fs:[00000030h] 5_2_019E2835
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E2835 mov eax, dword ptr fs:[00000030h] 5_2_019E2835
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FA830 mov eax, dword ptr fs:[00000030h] 5_2_019FA830
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4C810 mov eax, dword ptr fs:[00000030h] 5_2_01A4C810
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C4859 mov eax, dword ptr fs:[00000030h] 5_2_019C4859
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C4859 mov eax, dword ptr fs:[00000030h] 5_2_019C4859
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F0854 mov eax, dword ptr fs:[00000030h] 5_2_019F0854
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A56870 mov eax, dword ptr fs:[00000030h] 5_2_01A56870
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A56870 mov eax, dword ptr fs:[00000030h] 5_2_01A56870
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4E872 mov eax, dword ptr fs:[00000030h] 5_2_01A4E872
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4E872 mov eax, dword ptr fs:[00000030h] 5_2_01A4E872
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D2840 mov ecx, dword ptr fs:[00000030h] 5_2_019D2840
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A74BB0 mov eax, dword ptr fs:[00000030h] 5_2_01A74BB0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A74BB0 mov eax, dword ptr fs:[00000030h] 5_2_01A74BB0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0BBE mov eax, dword ptr fs:[00000030h] 5_2_019D0BBE
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0BBE mov eax, dword ptr fs:[00000030h] 5_2_019D0BBE
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C0BCD mov eax, dword ptr fs:[00000030h] 5_2_019C0BCD
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C0BCD mov eax, dword ptr fs:[00000030h] 5_2_019C0BCD
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C0BCD mov eax, dword ptr fs:[00000030h] 5_2_019C0BCD
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4CBF0 mov eax, dword ptr fs:[00000030h] 5_2_01A4CBF0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E0BCB mov eax, dword ptr fs:[00000030h] 5_2_019E0BCB
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E0BCB mov eax, dword ptr fs:[00000030h] 5_2_019E0BCB
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E0BCB mov eax, dword ptr fs:[00000030h] 5_2_019E0BCB
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EEBFC mov eax, dword ptr fs:[00000030h] 5_2_019EEBFC
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C8BF0 mov eax, dword ptr fs:[00000030h] 5_2_019C8BF0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C8BF0 mov eax, dword ptr fs:[00000030h] 5_2_019C8BF0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C8BF0 mov eax, dword ptr fs:[00000030h] 5_2_019C8BF0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6EBD0 mov eax, dword ptr fs:[00000030h] 5_2_01A6EBD0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A88B28 mov eax, dword ptr fs:[00000030h] 5_2_01A88B28
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A88B28 mov eax, dword ptr fs:[00000030h] 5_2_01A88B28
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A94B00 mov eax, dword ptr fs:[00000030h] 5_2_01A94B00
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3EB1D mov eax, dword ptr fs:[00000030h] 5_2_01A3EB1D
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3EB1D mov eax, dword ptr fs:[00000030h] 5_2_01A3EB1D
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3EB1D mov eax, dword ptr fs:[00000030h] 5_2_01A3EB1D
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3EB1D mov eax, dword ptr fs:[00000030h] 5_2_01A3EB1D
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3EB1D mov eax, dword ptr fs:[00000030h] 5_2_01A3EB1D
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3EB1D mov eax, dword ptr fs:[00000030h] 5_2_01A3EB1D
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3EB1D mov eax, dword ptr fs:[00000030h] 5_2_01A3EB1D
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3EB1D mov eax, dword ptr fs:[00000030h] 5_2_01A3EB1D
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A3EB1D mov eax, dword ptr fs:[00000030h] 5_2_01A3EB1D
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EEB20 mov eax, dword ptr fs:[00000030h] 5_2_019EEB20
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EEB20 mov eax, dword ptr fs:[00000030h] 5_2_019EEB20
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019B8B50 mov eax, dword ptr fs:[00000030h] 5_2_019B8B50
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A68B42 mov eax, dword ptr fs:[00000030h] 5_2_01A68B42
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A56B40 mov eax, dword ptr fs:[00000030h] 5_2_01A56B40
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A56B40 mov eax, dword ptr fs:[00000030h] 5_2_01A56B40
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019BCB7E mov eax, dword ptr fs:[00000030h] 5_2_019BCB7E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A8AB40 mov eax, dword ptr fs:[00000030h] 5_2_01A8AB40
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A74B4B mov eax, dword ptr fs:[00000030h] 5_2_01A74B4B
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A74B4B mov eax, dword ptr fs:[00000030h] 5_2_01A74B4B
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6EB50 mov eax, dword ptr fs:[00000030h] 5_2_01A6EB50
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A92B57 mov eax, dword ptr fs:[00000030h] 5_2_01A92B57
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A92B57 mov eax, dword ptr fs:[00000030h] 5_2_01A92B57
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A92B57 mov eax, dword ptr fs:[00000030h] 5_2_01A92B57
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A92B57 mov eax, dword ptr fs:[00000030h] 5_2_01A92B57
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A16AA4 mov eax, dword ptr fs:[00000030h] 5_2_01A16AA4
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F8A90 mov edx, dword ptr fs:[00000030h] 5_2_019F8A90
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CEA80 mov eax, dword ptr fs:[00000030h] 5_2_019CEA80
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CEA80 mov eax, dword ptr fs:[00000030h] 5_2_019CEA80
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CEA80 mov eax, dword ptr fs:[00000030h] 5_2_019CEA80
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CEA80 mov eax, dword ptr fs:[00000030h] 5_2_019CEA80
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CEA80 mov eax, dword ptr fs:[00000030h] 5_2_019CEA80
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CEA80 mov eax, dword ptr fs:[00000030h] 5_2_019CEA80
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CEA80 mov eax, dword ptr fs:[00000030h] 5_2_019CEA80
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CEA80 mov eax, dword ptr fs:[00000030h] 5_2_019CEA80
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019CEA80 mov eax, dword ptr fs:[00000030h] 5_2_019CEA80
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A94A80 mov eax, dword ptr fs:[00000030h] 5_2_01A94A80
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C8AA0 mov eax, dword ptr fs:[00000030h] 5_2_019C8AA0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C8AA0 mov eax, dword ptr fs:[00000030h] 5_2_019C8AA0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C0AD0 mov eax, dword ptr fs:[00000030h] 5_2_019C0AD0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F4AD0 mov eax, dword ptr fs:[00000030h] 5_2_019F4AD0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019F4AD0 mov eax, dword ptr fs:[00000030h] 5_2_019F4AD0
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A16ACC mov eax, dword ptr fs:[00000030h] 5_2_01A16ACC
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A16ACC mov eax, dword ptr fs:[00000030h] 5_2_01A16ACC
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A16ACC mov eax, dword ptr fs:[00000030h] 5_2_01A16ACC
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FAAEE mov eax, dword ptr fs:[00000030h] 5_2_019FAAEE
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FAAEE mov eax, dword ptr fs:[00000030h] 5_2_019FAAEE
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FCA38 mov eax, dword ptr fs:[00000030h] 5_2_019FCA38
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E4A35 mov eax, dword ptr fs:[00000030h] 5_2_019E4A35
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019E4A35 mov eax, dword ptr fs:[00000030h] 5_2_019E4A35
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019EEA2E mov eax, dword ptr fs:[00000030h] 5_2_019EEA2E
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A4CA11 mov eax, dword ptr fs:[00000030h] 5_2_01A4CA11
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019FCA24 mov eax, dword ptr fs:[00000030h] 5_2_019FCA24
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0A5B mov eax, dword ptr fs:[00000030h] 5_2_019D0A5B
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019D0A5B mov eax, dword ptr fs:[00000030h] 5_2_019D0A5B
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_01A6EA60 mov eax, dword ptr fs:[00000030h] 5_2_01A6EA60
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C6A50 mov eax, dword ptr fs:[00000030h] 5_2_019C6A50
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C6A50 mov eax, dword ptr fs:[00000030h] 5_2_019C6A50
Source: C:\Users\user\Desktop\PO1038854.exe Code function: 5_2_019C6A50 mov eax, dword ptr fs:[00000030h] 5_2_019C6A50
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\PO1038854.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO1038854.exe"
Source: C:\Users\user\Desktop\PO1038854.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO1038854.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\PO1038854.exe Memory written: C:\Users\user\Desktop\PO1038854.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\PO1038854.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO1038854.exe" Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Process created: C:\Users\user\Desktop\PO1038854.exe "C:\Users\user\Desktop\PO1038854.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\PO1038854.exe Queries volume information: C:\Users\user\Desktop\PO1038854.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 5.2.PO1038854.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.PO1038854.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.2385912141.0000000001CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2384523939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 5.2.PO1038854.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.PO1038854.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.2385912141.0000000001CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2384523939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1522761 Sample: PO1038854.exe Startdate: 30/09/2024 Architecture: WINDOWS Score: 100 22 Malicious sample detected (through community Yara rule) 2->22 24 Multi AV Scanner detection for submitted file 2->24 26 Yara detected FormBook 2->26 28 6 other signatures 2->28 7 PO1038854.exe 4 2->7         started        process3 file4 20 C:\Users\user\AppData\...\PO1038854.exe.log, ASCII 7->20 dropped 30 Adds a directory exclusion to Windows Defender 7->30 32 Injects a PE file into a foreign processes 7->32 11 powershell.exe 23 7->11         started        14 PO1038854.exe 7->14         started        signatures5 process6 signatures7 34 Loading BitLocker PowerShell Module 11->34 16 WmiPrvSE.exe 11->16         started        18 conhost.exe 11->18         started        process8
⊘No contacted IP infos