Windows Analysis Report
PO1038854.exe

AI detected suspicious sample

Source: Yara match	File source: 5.2.PO1038854.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO1038854.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2385912141.0000000001CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2384523939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: PO1038854.exe

Joe Sandbox ML: detected

Source: PO1038854.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PO1038854.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wntdll.pdbUGP source: PO1038854.exe, 00000005.00000002.2385119811.0000000001990000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: PO1038854.exe, PO1038854.exe, 00000005.00000002.2385119811.0000000001990000.00000040.00001000.00020000.00000000.sdmp

Source: PO1038854.exe, 00000000.00000002.2137118655.000000000316E000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 5.2.PO1038854.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO1038854.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2385912141.0000000001CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2384523939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: 5.2.PO1038854.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 5.2.PO1038854.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2385912141.0000000001CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2384523939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

.NET source code contains very large array initializations

Source: PO1038854.exe, CircularButton.cs

Large array initialization: : array initializer size 678416

Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_0042CAF3 NtClose,	5_2_0042CAF3
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_01A02DF0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_01A02C70
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A035C0 NtCreateMutant,LdrInitializeThunk,	5_2_01A035C0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A04340 NtSetContextThread,	5_2_01A04340
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A04650 NtSuspendThread,	5_2_01A04650
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02BA0 NtEnumerateValueKey,	5_2_01A02BA0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02B80 NtQueryInformationFile,	5_2_01A02B80
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02BE0 NtQueryValueKey,	5_2_01A02BE0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02BF0 NtAllocateVirtualMemory,	5_2_01A02BF0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02B60 NtClose,	5_2_01A02B60
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02AB0 NtWaitForSingleObject,	5_2_01A02AB0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02AF0 NtWriteFile,	5_2_01A02AF0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02AD0 NtReadFile,	5_2_01A02AD0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02DB0 NtEnumerateKey,	5_2_01A02DB0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02DD0 NtDelayExecution,	5_2_01A02DD0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02D30 NtUnmapViewOfSection,	5_2_01A02D30
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02D00 NtSetInformationFile,	5_2_01A02D00
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02D10 NtMapViewOfSection,	5_2_01A02D10
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02CA0 NtQueryInformationToken,	5_2_01A02CA0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02CF0 NtOpenProcess,	5_2_01A02CF0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02CC0 NtQueryVirtualMemory,	5_2_01A02CC0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02C00 NtQueryInformationProcess,	5_2_01A02C00
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02C60 NtCreateKey,	5_2_01A02C60
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02FA0 NtQuerySection,	5_2_01A02FA0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02FB0 NtResumeThread,	5_2_01A02FB0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02F90 NtProtectVirtualMemory,	5_2_01A02F90
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02FE0 NtCreateFile,	5_2_01A02FE0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02F30 NtCreateSection,	5_2_01A02F30
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02F60 NtCreateProcessEx,	5_2_01A02F60
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02EA0 NtAdjustPrivilegesToken,	5_2_01A02EA0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02E80 NtReadVirtualMemory,	5_2_01A02E80
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02EE0 NtQueueApcThread,	5_2_01A02EE0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02E30 NtWriteVirtualMemory,	5_2_01A02E30
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A03090 NtSetValueKey,	5_2_01A03090
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A03010 NtOpenDirectoryObject,	5_2_01A03010
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A039B0 NtGetContextThread,	5_2_01A039B0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A03D10 NtOpenProcessToken,	5_2_01A03D10
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A03D70 NtOpenThread,	5_2_01A03D70

Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_07273720	0_2_07273720
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_072727E8	0_2_072727E8
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_07270040	0_2_07270040
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_07273F68	0_2_07273F68
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_07273710	0_2_07273710
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_072727D8	0_2_072727D8
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_0727D670	0_2_0727D670
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_0727B6F0	0_2_0727B6F0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_072725C9	0_2_072725C9
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_072725D8	0_2_072725D8
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_072744A8	0_2_072744A8
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_07274498	0_2_07274498
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_07272368	0_2_07272368
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_07272378	0_2_07272378
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_0727B2B8	0_2_0727B2B8
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_072721C9	0_2_072721C9
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_072721D8	0_2_072721D8
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_07270006	0_2_07270006
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_07273013	0_2_07273013
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_07270F68	0_2_07270F68
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_07270F58	0_2_07270F58
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_07272F58	0_2_07272F58
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_07273F58	0_2_07273F58
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_0727AE80	0_2_0727AE80
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_0727BB28	0_2_0727BB28
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_07271B28	0_2_07271B28
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_07271B38	0_2_07271B38
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_07272A30	0_2_07272A30
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_07272A40	0_2_07272A40
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_07271928	0_2_07271928
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_00402800	5_2_00402800
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_004010C0	5_2_004010C0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_0042F0D3	5_2_0042F0D3
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_00401210	5_2_00401210
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_004034F5	5_2_004034F5
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_004104A3	5_2_004104A3
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_00403500	5_2_00403500
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_004025D4	5_2_004025D4
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_004025DC	5_2_004025DC
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_004025E0	5_2_004025E0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_00416E03	5_2_00416E03
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_004106C3	5_2_004106C3
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_0040E743	5_2_0040E743
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_00402FCF	5_2_00402FCF
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_00402FD0	5_2_00402FD0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_004027F3	5_2_004027F3
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A901AA	5_2_01A901AA
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A841A2	5_2_01A841A2
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A881CC	5_2_01A881CC
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C0100	5_2_019C0100
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6A118	5_2_01A6A118
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A58158	5_2_01A58158
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A62000	5_2_01A62000
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A903E6	5_2_01A903E6
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019DE3F0	5_2_019DE3F0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A8A352	5_2_01A8A352
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A502C0	5_2_01A502C0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A70274	5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A90591	5_2_01A90591
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0535	5_2_019D0535
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A7E4F6	5_2_01A7E4F6
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A74420	5_2_01A74420
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A82446	5_2_01A82446
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CC7C0	5_2_019CC7C0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F4750	5_2_019F4750
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0770	5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EC6E0	5_2_019EC6E0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A9A9A6	5_2_01A9A9A6
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D29A0	5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E6962	5_2_019E6962
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019B68B8	5_2_019B68B8
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FE8F0	5_2_019FE8F0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019DA840	5_2_019DA840
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D2840	5_2_019D2840
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A86BD7	5_2_01A86BD7
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A8AB40	5_2_01A8AB40
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CEA80	5_2_019CEA80
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E8DBF	5_2_019E8DBF
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CADE0	5_2_019CADE0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019DAD00	5_2_019DAD00
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6CD1F	5_2_01A6CD1F
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A70CB5	5_2_01A70CB5
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C0CF2	5_2_019C0CF2
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0C00	5_2_019D0C00
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4EFA0	5_2_01A4EFA0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C2FC8	5_2_019C2FC8
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019DCFE0	5_2_019DCFE0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A12F28	5_2_01A12F28
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A72F30	5_2_01A72F30
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F0F30	5_2_019F0F30
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A44F40	5_2_01A44F40
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E2E90	5_2_019E2E90
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A8CE93	5_2_01A8CE93
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A8EEDB	5_2_01A8EEDB
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A8EE26	5_2_01A8EE26
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0E59	5_2_019D0E59
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019DB1B0	5_2_019DB1B0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A9B16B	5_2_01A9B16B
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A0516C	5_2_01A0516C
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019BF172	5_2_019BF172
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A870E9	5_2_01A870E9
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A8F0E0	5_2_01A8F0E0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D70C0	5_2_019D70C0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A7F0CC	5_2_01A7F0CC
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A1739A	5_2_01A1739A
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A8132D	5_2_01A8132D
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019BD34C	5_2_019BD34C
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D52A0	5_2_019D52A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A712ED	5_2_01A712ED
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EB2C0	5_2_019EB2C0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6D5B0	5_2_01A6D5B0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A995C3	5_2_01A995C3
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A87571	5_2_01A87571
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A8F43F	5_2_01A8F43F
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C1460	5_2_019C1460
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A8F7B0	5_2_01A8F7B0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A816CC	5_2_01A816CC
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A15630	5_2_01A15630
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A65910	5_2_01A65910
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D9950	5_2_019D9950
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EB950	5_2_019EB950
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D38E0	5_2_019D38E0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3D800	5_2_01A3D800
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EFB80	5_2_019EFB80
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A45BF0	5_2_01A45BF0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A0DBF9	5_2_01A0DBF9
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A8FB76	5_2_01A8FB76
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A15AA0	5_2_01A15AA0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A71AA3	5_2_01A71AA3
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6DAAC	5_2_01A6DAAC
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A7DAC6	5_2_01A7DAC6
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A43A6C	5_2_01A43A6C
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A8FA49	5_2_01A8FA49
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A87A46	5_2_01A87A46
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EFDC0	5_2_019EFDC0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A87D73	5_2_01A87D73
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D3D40	5_2_019D3D40
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A81D5A	5_2_01A81D5A
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A8FCF2	5_2_01A8FCF2
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A49C32	5_2_01A49C32
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D1F92	5_2_019D1F92
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A8FFB1	5_2_01A8FFB1
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01993FD2	5_2_01993FD2
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01993FD5	5_2_01993FD5
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A8FF09	5_2_01A8FF09
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D9EB0	5_2_019D9EB0

Source: C:\Users\user\Desktop\PO1038854.exe	Code function: String function: 01A3EA12 appears 86 times
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: String function: 01A05130 appears 58 times
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: String function: 01A17E54 appears 111 times
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: String function: 019BB970 appears 280 times
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: String function: 01A4F290 appears 105 times

Source: PO1038854.exe, 00000000.00000002.2151567751.000000000A140000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs PO1038854.exe
Source: PO1038854.exe, 00000000.00000000.2124136505.0000000000B84000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRjdR.exe@ vs PO1038854.exe
Source: PO1038854.exe, 00000000.00000002.2136001690.000000000115E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PO1038854.exe
Source: PO1038854.exe, 00000005.00000002.2385119811.0000000001ABD000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PO1038854.exe
Source: PO1038854.exe	Binary or memory string: OriginalFilenameRjdR.exe@ vs PO1038854.exe

Source: PO1038854.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5.2.PO1038854.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 5.2.PO1038854.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2385912141.0000000001CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2384523939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: PO1038854.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, C6p2pqJV2lX1KN4pKa.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, C6p2pqJV2lX1KN4pKa.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, XhsEuGxgMg3yVMoqO1.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, XhsEuGxgMg3yVMoqO1.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, XhsEuGxgMg3yVMoqO1.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, XhsEuGxgMg3yVMoqO1.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, XhsEuGxgMg3yVMoqO1.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, XhsEuGxgMg3yVMoqO1.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, XhsEuGxgMg3yVMoqO1.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, XhsEuGxgMg3yVMoqO1.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, XhsEuGxgMg3yVMoqO1.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, C6p2pqJV2lX1KN4pKa.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/6@0/0

Source: C:\Users\user\Desktop\PO1038854.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO1038854.exe.log

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2024:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z5g0fnvv.pm2.ps1

Source: PO1038854.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PO1038854.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\PO1038854.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\PO1038854.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: PO1038854.exe

ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Users\user\Desktop\PO1038854.exe "C:\Users\user\Desktop\PO1038854.exe"
Source: C:\Users\user\Desktop\PO1038854.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO1038854.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO1038854.exe	Process created: C:\Users\user\Desktop\PO1038854.exe "C:\Users\user\Desktop\PO1038854.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\PO1038854.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO1038854.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process created: C:\Users\user\Desktop\PO1038854.exe "C:\Users\user\Desktop\PO1038854.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO1038854.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: C:\Users\user\Desktop\PO1038854.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains potential unpacker

Source: PO1038854.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO1038854.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wntdll.pdbUGP source: PO1038854.exe, 00000005.00000002.2385119811.0000000001990000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: PO1038854.exe, PO1038854.exe, 00000005.00000002.2385119811.0000000001990000.00000040.00001000.00020000.00000000.sdmp

Data Obfuscation

Source: 0.2.PO1038854.exe.3f19c80.2.raw.unpack, MainForm.cs	.Net Code: _200E_200C_200B_202B_202E_200E_200E_202D_200B_206C_202C_202B_200B_200F_200E_206F_206C_202C_202D_200E_206E_206E_200C_206D_202C_200B_200E_202B_200B_206A_202E_206A_202E_206E_206E_206A_206C_206A_206F_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO1038854.exe.3f31ea0.0.raw.unpack, MainForm.cs	.Net Code: _200E_200C_200B_202B_202E_200E_200E_202D_200B_206C_202C_202B_200B_200F_200E_206F_206C_202C_202D_200E_206E_206E_200C_206D_202C_200B_200E_202B_200B_206A_202E_206A_202E_206E_206E_206A_206C_206A_206F_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, XhsEuGxgMg3yVMoqO1.cs	.Net Code: PuapfsrokX System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, XhsEuGxgMg3yVMoqO1.cs	.Net Code: PuapfsrokX System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, XhsEuGxgMg3yVMoqO1.cs	.Net Code: PuapfsrokX System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO1038854.exe.7230000.5.raw.unpack, MainForm.cs	.Net Code: _200E_200C_200B_202B_202E_200E_200E_202D_200B_206C_202C_202B_200B_200F_200E_206F_206C_202C_202D_200E_206E_206E_200C_206D_202C_200B_200E_202B_200B_206A_202E_206A_202E_206E_206E_206A_206C_206A_206F_202E_202E System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_0727BF50 pushfd ; iretd	0_2_0727BF51
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_07276EEC push cs; ret	0_2_07276EEF
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 0_2_07533177 push dword ptr [edx+ebp*2-75h]; iretd	0_2_07533187
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_004150A8 push ss; iretd	5_2_004150B9
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_00414143 push ebp; iretd	5_2_00414189
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_00406377 push es; ret	5_2_00406381
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_0041FBDB push ebp; ret	5_2_0041FBDC
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_00411D04 pushad ; retf	5_2_00411D2D
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_00403780 push eax; ret	5_2_00403782
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_0199225F pushad ; ret	5_2_019927F9
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019927FA pushad ; ret	5_2_019927F9
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C09AD push ecx; mov dword ptr [esp], ecx	5_2_019C09B6
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_0199283D push eax; iretd	5_2_01992858
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01991200 push eax; iretd	5_2_01991369

Source: PO1038854.exe

Static PE information: section name: .text entropy: 7.870972260343742

Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, RLSg2R6IrZ2GD8sVjc.cs	High entropy of concatenated method names: 'U5fcJnbYU5', 'FgrcqVbTRn', 'i92cD0ElnJ', 'ob0crSH0W2', 'KaEcdTMcLH', 'zybceGLCa1', 'Jslcw2f3kC', 'Nc9cObKFJM', 'T3ocKs7hI1', 'wefc4xZdCh'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, gS5KKpZ2WTUXSwwu502.cs	High entropy of concatenated method names: 'jAauIpyItj', 'Iksui9Imgy', 'fNGufsSEqM', 'Gyfu0sUfNb', 'LnGuQ2rJp3', 'd1muWBpRDB', 'LWrumPJE7u', 'PZSuJX58ok', 'om2uqtrhLM', 'qOBu5oOjL5'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, Oex7JwwMJCxfYXMxrL.cs	High entropy of concatenated method names: 't8H8UhtG3f', 'NPm8XHR7PX', 'IaQ8PRDRUj', 'q7DP3y9NTF', 'T6JPzHchyu', 'SAj82TWNjK', 'ToX8ZinR9j', 'QBd8NgbPLY', 'TRd8hQnFvj', 'R5l8pmfenc'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, YHByLgCj8GJmh7Msgn.cs	High entropy of concatenated method names: 'ToString', 'mZut4OUWmn', 'yhKtrYaJ6S', 'g0ftRtJZFS', 'Ru7td9wbAJ', 'fPCtejkKWW', 'XFctBIpm2b', 'J0UtwZsveU', 'EFFtOnaEfM', 'iXotAYpJ3p'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, iAJcic5IQC1sEN6tQ0.cs	High entropy of concatenated method names: 'C8CkQh8ynU', 'EDJkmAGVKv', 'BxHXRMrjyb', 'JiWXdV4hui', 'c5iXeXhWsx', 'XGUXBaSUjw', 'qAYXwYwpvp', 'fa2XOdYNw8', 'jE8XArxu9J', 'Ks3XK6KpKA'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, XZIOZKAQoUDM9A8oeU.cs	High entropy of concatenated method names: 'Dq68IoIbbW', 'ALs8iMSk3P', 'eQi8fo64KI', 'zet80Nu38j', 'F4y8Qe3naQ', 'UNc8Wjw3dZ', 'dCm8mcxjek', 'BDx8JpuLMs', 'gMN8qV9plQ', 'Oad85yi0Ot'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, tgoFEGNSHmepVwhgEo.cs	High entropy of concatenated method names: 'Vbjfw6GR1', 'qer0VQQA9', 'tGlWX6SZR', 'BD7mMdQ3c', 'Aflq2ZNbo', 'jYE5BCHB2', 'u5vLVoTLhV1UqWXUfP', 'OwgEWYSMVX7eHA93h9', 'nL2agPkQF', 'RhhGTZlMD'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, C6p2pqJV2lX1KN4pKa.cs	High entropy of concatenated method names: 'Sm91jd3oRy', 'IZC1s7VXtv', 'ko31CZNHcj', 'fuj1gaF4SS', 'Ps81b3yg6q', 'Yxm1M2Z5Dn', 'pHx1V8OQ2d', 'gIY19eK2ha', 'B7Q1FELsUn', 'tcv13t63wS'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, d8bGjiZhYYG0p7Yq2Vp.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CB0GjKojBB', 'hxRGs8wuXj', 'KAqGC3RCCt', 'QMPGgGP3FC', 'rdtGbTsDsr', 'GmTGM5MlF6', 'qhoGVas7xX'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, XhsEuGxgMg3yVMoqO1.cs	High entropy of concatenated method names: 'VHIhnXjO9Q', 'ul0hUVKx9r', 'ncUh1iN8W0', 'mymhXsaa8S', 'NvWhkClvnL', 'dZPhPVfQcy', 'ae6h8NdQud', 'ASShxrUNa2', 'gDVhvRHI4q', 'wa3hltt0ft'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, hiC49dg7ThpoFoYW6F.cs	High entropy of concatenated method names: 'iHg7l2juDc', 'oos7EOEHxZ', 'ToString', 'S0r7U00Fsn', 'uKO71RS1QL', 'BYR7X89jMG', 'DNp7kl2IM6', 'Hxd7PROhLb', 'Evr78AhDMD', 'QFN7xgvXO6'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, VHaWpa9AAOhnegFN3k.cs	High entropy of concatenated method names: 'vH4aUlodM8', 'uYEa1xUh4X', 'zf3aXmBk75', 'E4RakUvqD4', 'pPSaPm7UMi', 'kI4a8UBJG8', 'fY8axeNyXV', 'RNZavuhtrS', 'uv4alIGguA', 'oqUaEv3dji'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, K4FQG6qRQZVKaJn6lH.cs	High entropy of concatenated method names: 'vwgX0U6f4T', 'LtTXWtnudO', 'eYpXJAF300', 'k72XqnLaZ5', 'atBXySlMUM', 'umUXtgugGf', 'rXwX7OlW4q', 'bItXamLvy0', 'FpZXuWflQP', 'NebXGMYjqZ'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, h0Ifh0M4uwrgl7JUXj.cs	High entropy of concatenated method names: 'ytl79NqFRQ', 'Uox73FvsMw', 'ag1a2rtkqH', 'rvwaZrDvqC', 'ELL74pnVOM', 'm6O7T9pHRZ', 'o30768hZFw', 'B1W7jccKC4', 'AZj7sew8n2', 'mVD7CVkWtH'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, M1hlmKFbfSonKR0FL6.cs	High entropy of concatenated method names: 'pGZaDf4rOV', 'pv3arRf4K3', 'yRHaRt71Z2', 'bgvadRfJgG', 'fFAajSisfU', 'gIiaeARWQT', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, v45muV32yLcWxVHmFr.cs	High entropy of concatenated method names: 'vKruZ1lLN5', 'qFruh7OZum', 'PqjupjdjgR', 'wdwuUvqudn', 'ivgu1oTBNs', 'Toauk3FUxD', 'FUMuPnp8Ye', 'NpFaVr9Mxa', 'Kyxa9JnfOg', 'dbJaFKMtDE'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, d7PkgCD1Icfh6t5u0R.cs	High entropy of concatenated method names: 'dJtPnvbdFd', 'MMhP1PvvYa', 'f8PPkEeXc5', 'BOPP8OjeF8', 'h4KPxZMbPg', 'ztQkbg9m7b', 'lUpkMhl4Vx', 'rmEkVKNIp4', 'KkGk9pkCFE', 'swikF6FQfi'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, J2wSlmpLsG1BMrtNTV.cs	High entropy of concatenated method names: 'bpmZ86p2pq', 'V2lZxX1KN4', 'QRQZlZVKaJ', 'e6lZEHPAJc', 'c6tZyQ0p7P', 'igCZt1Icfh', 'HMEJtJj4uhgY2Iw7JY', 'obyBpxfOG6fMawffu1', 'o9hZZnuGWN', 'Q0MZh5Cp8R'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, B6Uu1OZZW8FpZlqQ4RF.cs	High entropy of concatenated method names: 'ToString', 'cqlGhQYePL', 'EUVGpBMv9y', 'OaTGnPoSPN', 'jeXGUuxFdf', 'aVAG1kxNSQ', 'Np2GXqZriE', 'RybGkKXrJ1', 'hDUNjP4mSuENZdUhrkq', 'c6d3rQ4gHQlpjViC8x8'
Source: 0.2.PO1038854.exe.4980dc0.1.raw.unpack, JwOy8e1Oe81JxxIaL4.cs	High entropy of concatenated method names: 'Dispose', 'uZJZF3ZMEB', 'nxfNrcim0E', 'RjYHHjtPAi', 'zVHZ3aWpaA', 'NOhZznegFN', 'ProcessDialogKey', 'YkAN21hlmK', 'UfSNZonKR0', 'XL6NNo45mu'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, RLSg2R6IrZ2GD8sVjc.cs	High entropy of concatenated method names: 'U5fcJnbYU5', 'FgrcqVbTRn', 'i92cD0ElnJ', 'ob0crSH0W2', 'KaEcdTMcLH', 'zybceGLCa1', 'Jslcw2f3kC', 'Nc9cObKFJM', 'T3ocKs7hI1', 'wefc4xZdCh'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, gS5KKpZ2WTUXSwwu502.cs	High entropy of concatenated method names: 'jAauIpyItj', 'Iksui9Imgy', 'fNGufsSEqM', 'Gyfu0sUfNb', 'LnGuQ2rJp3', 'd1muWBpRDB', 'LWrumPJE7u', 'PZSuJX58ok', 'om2uqtrhLM', 'qOBu5oOjL5'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, Oex7JwwMJCxfYXMxrL.cs	High entropy of concatenated method names: 't8H8UhtG3f', 'NPm8XHR7PX', 'IaQ8PRDRUj', 'q7DP3y9NTF', 'T6JPzHchyu', 'SAj82TWNjK', 'ToX8ZinR9j', 'QBd8NgbPLY', 'TRd8hQnFvj', 'R5l8pmfenc'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, YHByLgCj8GJmh7Msgn.cs	High entropy of concatenated method names: 'ToString', 'mZut4OUWmn', 'yhKtrYaJ6S', 'g0ftRtJZFS', 'Ru7td9wbAJ', 'fPCtejkKWW', 'XFctBIpm2b', 'J0UtwZsveU', 'EFFtOnaEfM', 'iXotAYpJ3p'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, iAJcic5IQC1sEN6tQ0.cs	High entropy of concatenated method names: 'C8CkQh8ynU', 'EDJkmAGVKv', 'BxHXRMrjyb', 'JiWXdV4hui', 'c5iXeXhWsx', 'XGUXBaSUjw', 'qAYXwYwpvp', 'fa2XOdYNw8', 'jE8XArxu9J', 'Ks3XK6KpKA'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, XZIOZKAQoUDM9A8oeU.cs	High entropy of concatenated method names: 'Dq68IoIbbW', 'ALs8iMSk3P', 'eQi8fo64KI', 'zet80Nu38j', 'F4y8Qe3naQ', 'UNc8Wjw3dZ', 'dCm8mcxjek', 'BDx8JpuLMs', 'gMN8qV9plQ', 'Oad85yi0Ot'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, tgoFEGNSHmepVwhgEo.cs	High entropy of concatenated method names: 'Vbjfw6GR1', 'qer0VQQA9', 'tGlWX6SZR', 'BD7mMdQ3c', 'Aflq2ZNbo', 'jYE5BCHB2', 'u5vLVoTLhV1UqWXUfP', 'OwgEWYSMVX7eHA93h9', 'nL2agPkQF', 'RhhGTZlMD'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, C6p2pqJV2lX1KN4pKa.cs	High entropy of concatenated method names: 'Sm91jd3oRy', 'IZC1s7VXtv', 'ko31CZNHcj', 'fuj1gaF4SS', 'Ps81b3yg6q', 'Yxm1M2Z5Dn', 'pHx1V8OQ2d', 'gIY19eK2ha', 'B7Q1FELsUn', 'tcv13t63wS'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, d8bGjiZhYYG0p7Yq2Vp.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CB0GjKojBB', 'hxRGs8wuXj', 'KAqGC3RCCt', 'QMPGgGP3FC', 'rdtGbTsDsr', 'GmTGM5MlF6', 'qhoGVas7xX'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, XhsEuGxgMg3yVMoqO1.cs	High entropy of concatenated method names: 'VHIhnXjO9Q', 'ul0hUVKx9r', 'ncUh1iN8W0', 'mymhXsaa8S', 'NvWhkClvnL', 'dZPhPVfQcy', 'ae6h8NdQud', 'ASShxrUNa2', 'gDVhvRHI4q', 'wa3hltt0ft'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, hiC49dg7ThpoFoYW6F.cs	High entropy of concatenated method names: 'iHg7l2juDc', 'oos7EOEHxZ', 'ToString', 'S0r7U00Fsn', 'uKO71RS1QL', 'BYR7X89jMG', 'DNp7kl2IM6', 'Hxd7PROhLb', 'Evr78AhDMD', 'QFN7xgvXO6'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, VHaWpa9AAOhnegFN3k.cs	High entropy of concatenated method names: 'vH4aUlodM8', 'uYEa1xUh4X', 'zf3aXmBk75', 'E4RakUvqD4', 'pPSaPm7UMi', 'kI4a8UBJG8', 'fY8axeNyXV', 'RNZavuhtrS', 'uv4alIGguA', 'oqUaEv3dji'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, K4FQG6qRQZVKaJn6lH.cs	High entropy of concatenated method names: 'vwgX0U6f4T', 'LtTXWtnudO', 'eYpXJAF300', 'k72XqnLaZ5', 'atBXySlMUM', 'umUXtgugGf', 'rXwX7OlW4q', 'bItXamLvy0', 'FpZXuWflQP', 'NebXGMYjqZ'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, h0Ifh0M4uwrgl7JUXj.cs	High entropy of concatenated method names: 'ytl79NqFRQ', 'Uox73FvsMw', 'ag1a2rtkqH', 'rvwaZrDvqC', 'ELL74pnVOM', 'm6O7T9pHRZ', 'o30768hZFw', 'B1W7jccKC4', 'AZj7sew8n2', 'mVD7CVkWtH'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, M1hlmKFbfSonKR0FL6.cs	High entropy of concatenated method names: 'pGZaDf4rOV', 'pv3arRf4K3', 'yRHaRt71Z2', 'bgvadRfJgG', 'fFAajSisfU', 'gIiaeARWQT', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, v45muV32yLcWxVHmFr.cs	High entropy of concatenated method names: 'vKruZ1lLN5', 'qFruh7OZum', 'PqjupjdjgR', 'wdwuUvqudn', 'ivgu1oTBNs', 'Toauk3FUxD', 'FUMuPnp8Ye', 'NpFaVr9Mxa', 'Kyxa9JnfOg', 'dbJaFKMtDE'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, d7PkgCD1Icfh6t5u0R.cs	High entropy of concatenated method names: 'dJtPnvbdFd', 'MMhP1PvvYa', 'f8PPkEeXc5', 'BOPP8OjeF8', 'h4KPxZMbPg', 'ztQkbg9m7b', 'lUpkMhl4Vx', 'rmEkVKNIp4', 'KkGk9pkCFE', 'swikF6FQfi'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, J2wSlmpLsG1BMrtNTV.cs	High entropy of concatenated method names: 'bpmZ86p2pq', 'V2lZxX1KN4', 'QRQZlZVKaJ', 'e6lZEHPAJc', 'c6tZyQ0p7P', 'igCZt1Icfh', 'HMEJtJj4uhgY2Iw7JY', 'obyBpxfOG6fMawffu1', 'o9hZZnuGWN', 'Q0MZh5Cp8R'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, B6Uu1OZZW8FpZlqQ4RF.cs	High entropy of concatenated method names: 'ToString', 'cqlGhQYePL', 'EUVGpBMv9y', 'OaTGnPoSPN', 'jeXGUuxFdf', 'aVAG1kxNSQ', 'Np2GXqZriE', 'RybGkKXrJ1', 'hDUNjP4mSuENZdUhrkq', 'c6d3rQ4gHQlpjViC8x8'
Source: 0.2.PO1038854.exe.a140000.6.raw.unpack, JwOy8e1Oe81JxxIaL4.cs	High entropy of concatenated method names: 'Dispose', 'uZJZF3ZMEB', 'nxfNrcim0E', 'RjYHHjtPAi', 'zVHZ3aWpaA', 'NOhZznegFN', 'ProcessDialogKey', 'YkAN21hlmK', 'UfSNZonKR0', 'XL6NNo45mu'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, RLSg2R6IrZ2GD8sVjc.cs	High entropy of concatenated method names: 'U5fcJnbYU5', 'FgrcqVbTRn', 'i92cD0ElnJ', 'ob0crSH0W2', 'KaEcdTMcLH', 'zybceGLCa1', 'Jslcw2f3kC', 'Nc9cObKFJM', 'T3ocKs7hI1', 'wefc4xZdCh'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, gS5KKpZ2WTUXSwwu502.cs	High entropy of concatenated method names: 'jAauIpyItj', 'Iksui9Imgy', 'fNGufsSEqM', 'Gyfu0sUfNb', 'LnGuQ2rJp3', 'd1muWBpRDB', 'LWrumPJE7u', 'PZSuJX58ok', 'om2uqtrhLM', 'qOBu5oOjL5'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, Oex7JwwMJCxfYXMxrL.cs	High entropy of concatenated method names: 't8H8UhtG3f', 'NPm8XHR7PX', 'IaQ8PRDRUj', 'q7DP3y9NTF', 'T6JPzHchyu', 'SAj82TWNjK', 'ToX8ZinR9j', 'QBd8NgbPLY', 'TRd8hQnFvj', 'R5l8pmfenc'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, YHByLgCj8GJmh7Msgn.cs	High entropy of concatenated method names: 'ToString', 'mZut4OUWmn', 'yhKtrYaJ6S', 'g0ftRtJZFS', 'Ru7td9wbAJ', 'fPCtejkKWW', 'XFctBIpm2b', 'J0UtwZsveU', 'EFFtOnaEfM', 'iXotAYpJ3p'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, iAJcic5IQC1sEN6tQ0.cs	High entropy of concatenated method names: 'C8CkQh8ynU', 'EDJkmAGVKv', 'BxHXRMrjyb', 'JiWXdV4hui', 'c5iXeXhWsx', 'XGUXBaSUjw', 'qAYXwYwpvp', 'fa2XOdYNw8', 'jE8XArxu9J', 'Ks3XK6KpKA'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, XZIOZKAQoUDM9A8oeU.cs	High entropy of concatenated method names: 'Dq68IoIbbW', 'ALs8iMSk3P', 'eQi8fo64KI', 'zet80Nu38j', 'F4y8Qe3naQ', 'UNc8Wjw3dZ', 'dCm8mcxjek', 'BDx8JpuLMs', 'gMN8qV9plQ', 'Oad85yi0Ot'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, tgoFEGNSHmepVwhgEo.cs	High entropy of concatenated method names: 'Vbjfw6GR1', 'qer0VQQA9', 'tGlWX6SZR', 'BD7mMdQ3c', 'Aflq2ZNbo', 'jYE5BCHB2', 'u5vLVoTLhV1UqWXUfP', 'OwgEWYSMVX7eHA93h9', 'nL2agPkQF', 'RhhGTZlMD'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, C6p2pqJV2lX1KN4pKa.cs	High entropy of concatenated method names: 'Sm91jd3oRy', 'IZC1s7VXtv', 'ko31CZNHcj', 'fuj1gaF4SS', 'Ps81b3yg6q', 'Yxm1M2Z5Dn', 'pHx1V8OQ2d', 'gIY19eK2ha', 'B7Q1FELsUn', 'tcv13t63wS'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, d8bGjiZhYYG0p7Yq2Vp.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CB0GjKojBB', 'hxRGs8wuXj', 'KAqGC3RCCt', 'QMPGgGP3FC', 'rdtGbTsDsr', 'GmTGM5MlF6', 'qhoGVas7xX'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, XhsEuGxgMg3yVMoqO1.cs	High entropy of concatenated method names: 'VHIhnXjO9Q', 'ul0hUVKx9r', 'ncUh1iN8W0', 'mymhXsaa8S', 'NvWhkClvnL', 'dZPhPVfQcy', 'ae6h8NdQud', 'ASShxrUNa2', 'gDVhvRHI4q', 'wa3hltt0ft'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, hiC49dg7ThpoFoYW6F.cs	High entropy of concatenated method names: 'iHg7l2juDc', 'oos7EOEHxZ', 'ToString', 'S0r7U00Fsn', 'uKO71RS1QL', 'BYR7X89jMG', 'DNp7kl2IM6', 'Hxd7PROhLb', 'Evr78AhDMD', 'QFN7xgvXO6'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, VHaWpa9AAOhnegFN3k.cs	High entropy of concatenated method names: 'vH4aUlodM8', 'uYEa1xUh4X', 'zf3aXmBk75', 'E4RakUvqD4', 'pPSaPm7UMi', 'kI4a8UBJG8', 'fY8axeNyXV', 'RNZavuhtrS', 'uv4alIGguA', 'oqUaEv3dji'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, K4FQG6qRQZVKaJn6lH.cs	High entropy of concatenated method names: 'vwgX0U6f4T', 'LtTXWtnudO', 'eYpXJAF300', 'k72XqnLaZ5', 'atBXySlMUM', 'umUXtgugGf', 'rXwX7OlW4q', 'bItXamLvy0', 'FpZXuWflQP', 'NebXGMYjqZ'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, h0Ifh0M4uwrgl7JUXj.cs	High entropy of concatenated method names: 'ytl79NqFRQ', 'Uox73FvsMw', 'ag1a2rtkqH', 'rvwaZrDvqC', 'ELL74pnVOM', 'm6O7T9pHRZ', 'o30768hZFw', 'B1W7jccKC4', 'AZj7sew8n2', 'mVD7CVkWtH'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, M1hlmKFbfSonKR0FL6.cs	High entropy of concatenated method names: 'pGZaDf4rOV', 'pv3arRf4K3', 'yRHaRt71Z2', 'bgvadRfJgG', 'fFAajSisfU', 'gIiaeARWQT', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, v45muV32yLcWxVHmFr.cs	High entropy of concatenated method names: 'vKruZ1lLN5', 'qFruh7OZum', 'PqjupjdjgR', 'wdwuUvqudn', 'ivgu1oTBNs', 'Toauk3FUxD', 'FUMuPnp8Ye', 'NpFaVr9Mxa', 'Kyxa9JnfOg', 'dbJaFKMtDE'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, d7PkgCD1Icfh6t5u0R.cs	High entropy of concatenated method names: 'dJtPnvbdFd', 'MMhP1PvvYa', 'f8PPkEeXc5', 'BOPP8OjeF8', 'h4KPxZMbPg', 'ztQkbg9m7b', 'lUpkMhl4Vx', 'rmEkVKNIp4', 'KkGk9pkCFE', 'swikF6FQfi'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, J2wSlmpLsG1BMrtNTV.cs	High entropy of concatenated method names: 'bpmZ86p2pq', 'V2lZxX1KN4', 'QRQZlZVKaJ', 'e6lZEHPAJc', 'c6tZyQ0p7P', 'igCZt1Icfh', 'HMEJtJj4uhgY2Iw7JY', 'obyBpxfOG6fMawffu1', 'o9hZZnuGWN', 'Q0MZh5Cp8R'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, B6Uu1OZZW8FpZlqQ4RF.cs	High entropy of concatenated method names: 'ToString', 'cqlGhQYePL', 'EUVGpBMv9y', 'OaTGnPoSPN', 'jeXGUuxFdf', 'aVAG1kxNSQ', 'Np2GXqZriE', 'RybGkKXrJ1', 'hDUNjP4mSuENZdUhrkq', 'c6d3rQ4gHQlpjViC8x8'
Source: 0.2.PO1038854.exe.4a08fe0.3.raw.unpack, JwOy8e1Oe81JxxIaL4.cs	High entropy of concatenated method names: 'Dispose', 'uZJZF3ZMEB', 'nxfNrcim0E', 'RjYHHjtPAi', 'zVHZ3aWpaA', 'NOhZznegFN', 'ProcessDialogKey', 'YkAN21hlmK', 'UfSNZonKR0', 'XL6NNo45mu'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: PO1038854.exe PID: 4440, type: MEMORYSTR

Source: C:\Users\user\Desktop\PO1038854.exe	Memory allocated: 14F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Memory allocated: 2EF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Memory allocated: 2E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Memory allocated: 7A90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Memory allocated: 8A90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Memory allocated: 8C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Memory allocated: 9C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Memory allocated: A1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Memory allocated: B1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Memory allocated: C1D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\PO1038854.exe

Code function: 5_2_01A0096E rdtsc

5_2_01A0096E

Source: C:\Users\user\Desktop\PO1038854.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6802			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1370			Jump to behavior

Source: C:\Users\user\Desktop\PO1038854.exe

API coverage: 0.6 %

Source: C:\Users\user\Desktop\PO1038854.exe TID: 6236	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6532	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6112	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe TID: 4568	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\PO1038854.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\PO1038854.exe

Process queried: DebugPort

Source: C:\Users\user\Desktop\PO1038854.exe

Code function: 5_2_01A0096E rdtsc

5_2_01A0096E

Source: C:\Users\user\Desktop\PO1038854.exe

Code function: 5_2_00417DB3 LdrLoadDll,

5_2_00417DB3

Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019BA197 mov eax, dword ptr fs:[00000030h]	5_2_019BA197
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019BA197 mov eax, dword ptr fs:[00000030h]	5_2_019BA197
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019BA197 mov eax, dword ptr fs:[00000030h]	5_2_019BA197
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A00185 mov eax, dword ptr fs:[00000030h]	5_2_01A00185
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A64180 mov eax, dword ptr fs:[00000030h]	5_2_01A64180
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A64180 mov eax, dword ptr fs:[00000030h]	5_2_01A64180
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A7C188 mov eax, dword ptr fs:[00000030h]	5_2_01A7C188
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A7C188 mov eax, dword ptr fs:[00000030h]	5_2_01A7C188
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4019F mov eax, dword ptr fs:[00000030h]	5_2_01A4019F
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4019F mov eax, dword ptr fs:[00000030h]	5_2_01A4019F
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4019F mov eax, dword ptr fs:[00000030h]	5_2_01A4019F
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4019F mov eax, dword ptr fs:[00000030h]	5_2_01A4019F
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A961E5 mov eax, dword ptr fs:[00000030h]	5_2_01A961E5
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F01F8 mov eax, dword ptr fs:[00000030h]	5_2_019F01F8
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A861C3 mov eax, dword ptr fs:[00000030h]	5_2_01A861C3
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A861C3 mov eax, dword ptr fs:[00000030h]	5_2_01A861C3
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3E1D0 mov eax, dword ptr fs:[00000030h]	5_2_01A3E1D0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3E1D0 mov eax, dword ptr fs:[00000030h]	5_2_01A3E1D0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3E1D0 mov ecx, dword ptr fs:[00000030h]	5_2_01A3E1D0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3E1D0 mov eax, dword ptr fs:[00000030h]	5_2_01A3E1D0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3E1D0 mov eax, dword ptr fs:[00000030h]	5_2_01A3E1D0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6E10E mov eax, dword ptr fs:[00000030h]	5_2_01A6E10E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6E10E mov ecx, dword ptr fs:[00000030h]	5_2_01A6E10E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6E10E mov eax, dword ptr fs:[00000030h]	5_2_01A6E10E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6E10E mov eax, dword ptr fs:[00000030h]	5_2_01A6E10E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6E10E mov ecx, dword ptr fs:[00000030h]	5_2_01A6E10E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6E10E mov eax, dword ptr fs:[00000030h]	5_2_01A6E10E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6E10E mov eax, dword ptr fs:[00000030h]	5_2_01A6E10E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6E10E mov ecx, dword ptr fs:[00000030h]	5_2_01A6E10E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6E10E mov eax, dword ptr fs:[00000030h]	5_2_01A6E10E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6E10E mov ecx, dword ptr fs:[00000030h]	5_2_01A6E10E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F0124 mov eax, dword ptr fs:[00000030h]	5_2_019F0124
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A80115 mov eax, dword ptr fs:[00000030h]	5_2_01A80115
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6A118 mov ecx, dword ptr fs:[00000030h]	5_2_01A6A118
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6A118 mov eax, dword ptr fs:[00000030h]	5_2_01A6A118
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6A118 mov eax, dword ptr fs:[00000030h]	5_2_01A6A118
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6A118 mov eax, dword ptr fs:[00000030h]	5_2_01A6A118
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C6154 mov eax, dword ptr fs:[00000030h]	5_2_019C6154
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C6154 mov eax, dword ptr fs:[00000030h]	5_2_019C6154
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019BC156 mov eax, dword ptr fs:[00000030h]	5_2_019BC156
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A94164 mov eax, dword ptr fs:[00000030h]	5_2_01A94164
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A94164 mov eax, dword ptr fs:[00000030h]	5_2_01A94164
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A54144 mov eax, dword ptr fs:[00000030h]	5_2_01A54144
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A54144 mov eax, dword ptr fs:[00000030h]	5_2_01A54144
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A54144 mov ecx, dword ptr fs:[00000030h]	5_2_01A54144
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A54144 mov eax, dword ptr fs:[00000030h]	5_2_01A54144
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A54144 mov eax, dword ptr fs:[00000030h]	5_2_01A54144
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A58158 mov eax, dword ptr fs:[00000030h]	5_2_01A58158
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A580A8 mov eax, dword ptr fs:[00000030h]	5_2_01A580A8
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A860B8 mov eax, dword ptr fs:[00000030h]	5_2_01A860B8
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A860B8 mov ecx, dword ptr fs:[00000030h]	5_2_01A860B8
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C208A mov eax, dword ptr fs:[00000030h]	5_2_019C208A
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019B80A0 mov eax, dword ptr fs:[00000030h]	5_2_019B80A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A460E0 mov eax, dword ptr fs:[00000030h]	5_2_01A460E0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A020F0 mov ecx, dword ptr fs:[00000030h]	5_2_01A020F0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019BC0F0 mov eax, dword ptr fs:[00000030h]	5_2_019BC0F0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C80E9 mov eax, dword ptr fs:[00000030h]	5_2_019C80E9
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019BA0E3 mov ecx, dword ptr fs:[00000030h]	5_2_019BA0E3
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A420DE mov eax, dword ptr fs:[00000030h]	5_2_01A420DE
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019DE016 mov eax, dword ptr fs:[00000030h]	5_2_019DE016
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019DE016 mov eax, dword ptr fs:[00000030h]	5_2_019DE016
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019DE016 mov eax, dword ptr fs:[00000030h]	5_2_019DE016
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019DE016 mov eax, dword ptr fs:[00000030h]	5_2_019DE016
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A56030 mov eax, dword ptr fs:[00000030h]	5_2_01A56030
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A44000 mov ecx, dword ptr fs:[00000030h]	5_2_01A44000
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A62000 mov eax, dword ptr fs:[00000030h]	5_2_01A62000
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A62000 mov eax, dword ptr fs:[00000030h]	5_2_01A62000
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A62000 mov eax, dword ptr fs:[00000030h]	5_2_01A62000
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A62000 mov eax, dword ptr fs:[00000030h]	5_2_01A62000
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A62000 mov eax, dword ptr fs:[00000030h]	5_2_01A62000
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A62000 mov eax, dword ptr fs:[00000030h]	5_2_01A62000
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A62000 mov eax, dword ptr fs:[00000030h]	5_2_01A62000
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A62000 mov eax, dword ptr fs:[00000030h]	5_2_01A62000
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019BA020 mov eax, dword ptr fs:[00000030h]	5_2_019BA020
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019BC020 mov eax, dword ptr fs:[00000030h]	5_2_019BC020
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C2050 mov eax, dword ptr fs:[00000030h]	5_2_019C2050
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EC073 mov eax, dword ptr fs:[00000030h]	5_2_019EC073
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A46050 mov eax, dword ptr fs:[00000030h]	5_2_01A46050
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019B8397 mov eax, dword ptr fs:[00000030h]	5_2_019B8397
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019B8397 mov eax, dword ptr fs:[00000030h]	5_2_019B8397
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019B8397 mov eax, dword ptr fs:[00000030h]	5_2_019B8397
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E438F mov eax, dword ptr fs:[00000030h]	5_2_019E438F
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E438F mov eax, dword ptr fs:[00000030h]	5_2_019E438F
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019BE388 mov eax, dword ptr fs:[00000030h]	5_2_019BE388
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019BE388 mov eax, dword ptr fs:[00000030h]	5_2_019BE388
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019BE388 mov eax, dword ptr fs:[00000030h]	5_2_019BE388
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CA3C0 mov eax, dword ptr fs:[00000030h]	5_2_019CA3C0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CA3C0 mov eax, dword ptr fs:[00000030h]	5_2_019CA3C0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CA3C0 mov eax, dword ptr fs:[00000030h]	5_2_019CA3C0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CA3C0 mov eax, dword ptr fs:[00000030h]	5_2_019CA3C0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CA3C0 mov eax, dword ptr fs:[00000030h]	5_2_019CA3C0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CA3C0 mov eax, dword ptr fs:[00000030h]	5_2_019CA3C0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C83C0 mov eax, dword ptr fs:[00000030h]	5_2_019C83C0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C83C0 mov eax, dword ptr fs:[00000030h]	5_2_019C83C0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C83C0 mov eax, dword ptr fs:[00000030h]	5_2_019C83C0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C83C0 mov eax, dword ptr fs:[00000030h]	5_2_019C83C0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F63FF mov eax, dword ptr fs:[00000030h]	5_2_019F63FF
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A463C0 mov eax, dword ptr fs:[00000030h]	5_2_01A463C0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A7C3CD mov eax, dword ptr fs:[00000030h]	5_2_01A7C3CD
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019DE3F0 mov eax, dword ptr fs:[00000030h]	5_2_019DE3F0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019DE3F0 mov eax, dword ptr fs:[00000030h]	5_2_019DE3F0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019DE3F0 mov eax, dword ptr fs:[00000030h]	5_2_019DE3F0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A643D4 mov eax, dword ptr fs:[00000030h]	5_2_01A643D4
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A643D4 mov eax, dword ptr fs:[00000030h]	5_2_01A643D4
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D03E9 mov eax, dword ptr fs:[00000030h]	5_2_019D03E9
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D03E9 mov eax, dword ptr fs:[00000030h]	5_2_019D03E9
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D03E9 mov eax, dword ptr fs:[00000030h]	5_2_019D03E9
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D03E9 mov eax, dword ptr fs:[00000030h]	5_2_019D03E9
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D03E9 mov eax, dword ptr fs:[00000030h]	5_2_019D03E9
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D03E9 mov eax, dword ptr fs:[00000030h]	5_2_019D03E9
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D03E9 mov eax, dword ptr fs:[00000030h]	5_2_019D03E9
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D03E9 mov eax, dword ptr fs:[00000030h]	5_2_019D03E9
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6E3DB mov eax, dword ptr fs:[00000030h]	5_2_01A6E3DB
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6E3DB mov eax, dword ptr fs:[00000030h]	5_2_01A6E3DB
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6E3DB mov ecx, dword ptr fs:[00000030h]	5_2_01A6E3DB
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6E3DB mov eax, dword ptr fs:[00000030h]	5_2_01A6E3DB
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019BC310 mov ecx, dword ptr fs:[00000030h]	5_2_019BC310
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A98324 mov eax, dword ptr fs:[00000030h]	5_2_01A98324
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A98324 mov ecx, dword ptr fs:[00000030h]	5_2_01A98324
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A98324 mov eax, dword ptr fs:[00000030h]	5_2_01A98324
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A98324 mov eax, dword ptr fs:[00000030h]	5_2_01A98324
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E0310 mov ecx, dword ptr fs:[00000030h]	5_2_019E0310
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FA30B mov eax, dword ptr fs:[00000030h]	5_2_019FA30B
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FA30B mov eax, dword ptr fs:[00000030h]	5_2_019FA30B
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FA30B mov eax, dword ptr fs:[00000030h]	5_2_019FA30B
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6437C mov eax, dword ptr fs:[00000030h]	5_2_01A6437C
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A9634F mov eax, dword ptr fs:[00000030h]	5_2_01A9634F
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h]	5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h]	5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h]	5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h]	5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h]	5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h]	5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h]	5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h]	5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h]	5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h]	5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h]	5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h]	5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h]	5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h]	5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A42349 mov eax, dword ptr fs:[00000030h]	5_2_01A42349
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A68350 mov ecx, dword ptr fs:[00000030h]	5_2_01A68350
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4035C mov eax, dword ptr fs:[00000030h]	5_2_01A4035C
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4035C mov eax, dword ptr fs:[00000030h]	5_2_01A4035C
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4035C mov eax, dword ptr fs:[00000030h]	5_2_01A4035C
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4035C mov ecx, dword ptr fs:[00000030h]	5_2_01A4035C
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4035C mov eax, dword ptr fs:[00000030h]	5_2_01A4035C
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4035C mov eax, dword ptr fs:[00000030h]	5_2_01A4035C
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A8A352 mov eax, dword ptr fs:[00000030h]	5_2_01A8A352
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A562A0 mov eax, dword ptr fs:[00000030h]	5_2_01A562A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A562A0 mov ecx, dword ptr fs:[00000030h]	5_2_01A562A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A562A0 mov eax, dword ptr fs:[00000030h]	5_2_01A562A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A562A0 mov eax, dword ptr fs:[00000030h]	5_2_01A562A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A562A0 mov eax, dword ptr fs:[00000030h]	5_2_01A562A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A562A0 mov eax, dword ptr fs:[00000030h]	5_2_01A562A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FE284 mov eax, dword ptr fs:[00000030h]	5_2_019FE284
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FE284 mov eax, dword ptr fs:[00000030h]	5_2_019FE284
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A40283 mov eax, dword ptr fs:[00000030h]	5_2_01A40283
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A40283 mov eax, dword ptr fs:[00000030h]	5_2_01A40283
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A40283 mov eax, dword ptr fs:[00000030h]	5_2_01A40283
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CA2C3 mov eax, dword ptr fs:[00000030h]	5_2_019CA2C3
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CA2C3 mov eax, dword ptr fs:[00000030h]	5_2_019CA2C3
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CA2C3 mov eax, dword ptr fs:[00000030h]	5_2_019CA2C3
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CA2C3 mov eax, dword ptr fs:[00000030h]	5_2_019CA2C3
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CA2C3 mov eax, dword ptr fs:[00000030h]	5_2_019CA2C3
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D02E1 mov eax, dword ptr fs:[00000030h]	5_2_019D02E1
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D02E1 mov eax, dword ptr fs:[00000030h]	5_2_019D02E1
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D02E1 mov eax, dword ptr fs:[00000030h]	5_2_019D02E1
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A962D6 mov eax, dword ptr fs:[00000030h]	5_2_01A962D6
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019B823B mov eax, dword ptr fs:[00000030h]	5_2_019B823B
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C6259 mov eax, dword ptr fs:[00000030h]	5_2_019C6259
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019BA250 mov eax, dword ptr fs:[00000030h]	5_2_019BA250
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h]	5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h]	5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h]	5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h]	5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h]	5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h]	5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h]	5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h]	5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h]	5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h]	5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h]	5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A70274 mov eax, dword ptr fs:[00000030h]	5_2_01A70274
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A48243 mov eax, dword ptr fs:[00000030h]	5_2_01A48243
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A48243 mov ecx, dword ptr fs:[00000030h]	5_2_01A48243
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019B826B mov eax, dword ptr fs:[00000030h]	5_2_019B826B
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A9625D mov eax, dword ptr fs:[00000030h]	5_2_01A9625D
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A7A250 mov eax, dword ptr fs:[00000030h]	5_2_01A7A250
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A7A250 mov eax, dword ptr fs:[00000030h]	5_2_01A7A250
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C4260 mov eax, dword ptr fs:[00000030h]	5_2_019C4260
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C4260 mov eax, dword ptr fs:[00000030h]	5_2_019C4260
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C4260 mov eax, dword ptr fs:[00000030h]	5_2_019C4260
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FE59C mov eax, dword ptr fs:[00000030h]	5_2_019FE59C
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A405A7 mov eax, dword ptr fs:[00000030h]	5_2_01A405A7
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A405A7 mov eax, dword ptr fs:[00000030h]	5_2_01A405A7
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A405A7 mov eax, dword ptr fs:[00000030h]	5_2_01A405A7
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F4588 mov eax, dword ptr fs:[00000030h]	5_2_019F4588
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C2582 mov eax, dword ptr fs:[00000030h]	5_2_019C2582
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C2582 mov ecx, dword ptr fs:[00000030h]	5_2_019C2582
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E45B1 mov eax, dword ptr fs:[00000030h]	5_2_019E45B1
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E45B1 mov eax, dword ptr fs:[00000030h]	5_2_019E45B1
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C65D0 mov eax, dword ptr fs:[00000030h]	5_2_019C65D0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FA5D0 mov eax, dword ptr fs:[00000030h]	5_2_019FA5D0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FA5D0 mov eax, dword ptr fs:[00000030h]	5_2_019FA5D0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FE5CF mov eax, dword ptr fs:[00000030h]	5_2_019FE5CF
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FE5CF mov eax, dword ptr fs:[00000030h]	5_2_019FE5CF
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FC5ED mov eax, dword ptr fs:[00000030h]	5_2_019FC5ED
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FC5ED mov eax, dword ptr fs:[00000030h]	5_2_019FC5ED
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EE5E7 mov eax, dword ptr fs:[00000030h]	5_2_019EE5E7
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EE5E7 mov eax, dword ptr fs:[00000030h]	5_2_019EE5E7
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EE5E7 mov eax, dword ptr fs:[00000030h]	5_2_019EE5E7
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EE5E7 mov eax, dword ptr fs:[00000030h]	5_2_019EE5E7
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EE5E7 mov eax, dword ptr fs:[00000030h]	5_2_019EE5E7
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EE5E7 mov eax, dword ptr fs:[00000030h]	5_2_019EE5E7
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EE5E7 mov eax, dword ptr fs:[00000030h]	5_2_019EE5E7
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EE5E7 mov eax, dword ptr fs:[00000030h]	5_2_019EE5E7
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C25E0 mov eax, dword ptr fs:[00000030h]	5_2_019C25E0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EE53E mov eax, dword ptr fs:[00000030h]	5_2_019EE53E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EE53E mov eax, dword ptr fs:[00000030h]	5_2_019EE53E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EE53E mov eax, dword ptr fs:[00000030h]	5_2_019EE53E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EE53E mov eax, dword ptr fs:[00000030h]	5_2_019EE53E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EE53E mov eax, dword ptr fs:[00000030h]	5_2_019EE53E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A56500 mov eax, dword ptr fs:[00000030h]	5_2_01A56500
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0535 mov eax, dword ptr fs:[00000030h]	5_2_019D0535
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0535 mov eax, dword ptr fs:[00000030h]	5_2_019D0535
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0535 mov eax, dword ptr fs:[00000030h]	5_2_019D0535
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0535 mov eax, dword ptr fs:[00000030h]	5_2_019D0535
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0535 mov eax, dword ptr fs:[00000030h]	5_2_019D0535
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0535 mov eax, dword ptr fs:[00000030h]	5_2_019D0535
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A94500 mov eax, dword ptr fs:[00000030h]	5_2_01A94500
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A94500 mov eax, dword ptr fs:[00000030h]	5_2_01A94500
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A94500 mov eax, dword ptr fs:[00000030h]	5_2_01A94500
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A94500 mov eax, dword ptr fs:[00000030h]	5_2_01A94500
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A94500 mov eax, dword ptr fs:[00000030h]	5_2_01A94500
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A94500 mov eax, dword ptr fs:[00000030h]	5_2_01A94500
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A94500 mov eax, dword ptr fs:[00000030h]	5_2_01A94500
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C8550 mov eax, dword ptr fs:[00000030h]	5_2_019C8550
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C8550 mov eax, dword ptr fs:[00000030h]	5_2_019C8550
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F656A mov eax, dword ptr fs:[00000030h]	5_2_019F656A
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F656A mov eax, dword ptr fs:[00000030h]	5_2_019F656A
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F656A mov eax, dword ptr fs:[00000030h]	5_2_019F656A
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4A4B0 mov eax, dword ptr fs:[00000030h]	5_2_01A4A4B0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F44B0 mov ecx, dword ptr fs:[00000030h]	5_2_019F44B0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C64AB mov eax, dword ptr fs:[00000030h]	5_2_019C64AB
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A7A49A mov eax, dword ptr fs:[00000030h]	5_2_01A7A49A
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C04E5 mov ecx, dword ptr fs:[00000030h]	5_2_019C04E5
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A46420 mov eax, dword ptr fs:[00000030h]	5_2_01A46420
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A46420 mov eax, dword ptr fs:[00000030h]	5_2_01A46420
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A46420 mov eax, dword ptr fs:[00000030h]	5_2_01A46420
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A46420 mov eax, dword ptr fs:[00000030h]	5_2_01A46420
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A46420 mov eax, dword ptr fs:[00000030h]	5_2_01A46420
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A46420 mov eax, dword ptr fs:[00000030h]	5_2_01A46420
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A46420 mov eax, dword ptr fs:[00000030h]	5_2_01A46420
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F8402 mov eax, dword ptr fs:[00000030h]	5_2_019F8402
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F8402 mov eax, dword ptr fs:[00000030h]	5_2_019F8402
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F8402 mov eax, dword ptr fs:[00000030h]	5_2_019F8402
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FA430 mov eax, dword ptr fs:[00000030h]	5_2_019FA430
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019BE420 mov eax, dword ptr fs:[00000030h]	5_2_019BE420
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019BE420 mov eax, dword ptr fs:[00000030h]	5_2_019BE420
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019BE420 mov eax, dword ptr fs:[00000030h]	5_2_019BE420
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019BC427 mov eax, dword ptr fs:[00000030h]	5_2_019BC427
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E245A mov eax, dword ptr fs:[00000030h]	5_2_019E245A
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4C460 mov ecx, dword ptr fs:[00000030h]	5_2_01A4C460
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019B645D mov eax, dword ptr fs:[00000030h]	5_2_019B645D
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FE443 mov eax, dword ptr fs:[00000030h]	5_2_019FE443
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FE443 mov eax, dword ptr fs:[00000030h]	5_2_019FE443
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FE443 mov eax, dword ptr fs:[00000030h]	5_2_019FE443
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FE443 mov eax, dword ptr fs:[00000030h]	5_2_019FE443
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FE443 mov eax, dword ptr fs:[00000030h]	5_2_019FE443
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FE443 mov eax, dword ptr fs:[00000030h]	5_2_019FE443
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FE443 mov eax, dword ptr fs:[00000030h]	5_2_019FE443
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FE443 mov eax, dword ptr fs:[00000030h]	5_2_019FE443
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EA470 mov eax, dword ptr fs:[00000030h]	5_2_019EA470
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EA470 mov eax, dword ptr fs:[00000030h]	5_2_019EA470
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EA470 mov eax, dword ptr fs:[00000030h]	5_2_019EA470
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A7A456 mov eax, dword ptr fs:[00000030h]	5_2_01A7A456
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A747A0 mov eax, dword ptr fs:[00000030h]	5_2_01A747A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6678E mov eax, dword ptr fs:[00000030h]	5_2_01A6678E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C07AF mov eax, dword ptr fs:[00000030h]	5_2_019C07AF
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4E7E1 mov eax, dword ptr fs:[00000030h]	5_2_01A4E7E1
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CC7C0 mov eax, dword ptr fs:[00000030h]	5_2_019CC7C0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C47FB mov eax, dword ptr fs:[00000030h]	5_2_019C47FB
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C47FB mov eax, dword ptr fs:[00000030h]	5_2_019C47FB
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A407C3 mov eax, dword ptr fs:[00000030h]	5_2_01A407C3
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E27ED mov eax, dword ptr fs:[00000030h]	5_2_019E27ED
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E27ED mov eax, dword ptr fs:[00000030h]	5_2_019E27ED
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E27ED mov eax, dword ptr fs:[00000030h]	5_2_019E27ED
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C0710 mov eax, dword ptr fs:[00000030h]	5_2_019C0710
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F0710 mov eax, dword ptr fs:[00000030h]	5_2_019F0710
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3C730 mov eax, dword ptr fs:[00000030h]	5_2_01A3C730
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FC700 mov eax, dword ptr fs:[00000030h]	5_2_019FC700
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F273C mov eax, dword ptr fs:[00000030h]	5_2_019F273C
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F273C mov ecx, dword ptr fs:[00000030h]	5_2_019F273C
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F273C mov eax, dword ptr fs:[00000030h]	5_2_019F273C
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FC720 mov eax, dword ptr fs:[00000030h]	5_2_019FC720
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FC720 mov eax, dword ptr fs:[00000030h]	5_2_019FC720
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C0750 mov eax, dword ptr fs:[00000030h]	5_2_019C0750
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F674D mov esi, dword ptr fs:[00000030h]	5_2_019F674D
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F674D mov eax, dword ptr fs:[00000030h]	5_2_019F674D
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F674D mov eax, dword ptr fs:[00000030h]	5_2_019F674D
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C8770 mov eax, dword ptr fs:[00000030h]	5_2_019C8770
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h]	5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h]	5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h]	5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h]	5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h]	5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h]	5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h]	5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h]	5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h]	5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h]	5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h]	5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0770 mov eax, dword ptr fs:[00000030h]	5_2_019D0770
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02750 mov eax, dword ptr fs:[00000030h]	5_2_01A02750
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02750 mov eax, dword ptr fs:[00000030h]	5_2_01A02750
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A44755 mov eax, dword ptr fs:[00000030h]	5_2_01A44755
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4E75D mov eax, dword ptr fs:[00000030h]	5_2_01A4E75D
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C4690 mov eax, dword ptr fs:[00000030h]	5_2_019C4690
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C4690 mov eax, dword ptr fs:[00000030h]	5_2_019C4690
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F66B0 mov eax, dword ptr fs:[00000030h]	5_2_019F66B0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FC6A6 mov eax, dword ptr fs:[00000030h]	5_2_019FC6A6
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3E6F2 mov eax, dword ptr fs:[00000030h]	5_2_01A3E6F2
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3E6F2 mov eax, dword ptr fs:[00000030h]	5_2_01A3E6F2
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3E6F2 mov eax, dword ptr fs:[00000030h]	5_2_01A3E6F2
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3E6F2 mov eax, dword ptr fs:[00000030h]	5_2_01A3E6F2
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A406F1 mov eax, dword ptr fs:[00000030h]	5_2_01A406F1
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A406F1 mov eax, dword ptr fs:[00000030h]	5_2_01A406F1
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FA6C7 mov ebx, dword ptr fs:[00000030h]	5_2_019FA6C7
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FA6C7 mov eax, dword ptr fs:[00000030h]	5_2_019FA6C7
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D260B mov eax, dword ptr fs:[00000030h]	5_2_019D260B
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D260B mov eax, dword ptr fs:[00000030h]	5_2_019D260B
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D260B mov eax, dword ptr fs:[00000030h]	5_2_019D260B
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D260B mov eax, dword ptr fs:[00000030h]	5_2_019D260B
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D260B mov eax, dword ptr fs:[00000030h]	5_2_019D260B
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D260B mov eax, dword ptr fs:[00000030h]	5_2_019D260B
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D260B mov eax, dword ptr fs:[00000030h]	5_2_019D260B
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3E609 mov eax, dword ptr fs:[00000030h]	5_2_01A3E609
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C262C mov eax, dword ptr fs:[00000030h]	5_2_019C262C
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A02619 mov eax, dword ptr fs:[00000030h]	5_2_01A02619
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019DE627 mov eax, dword ptr fs:[00000030h]	5_2_019DE627
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F6620 mov eax, dword ptr fs:[00000030h]	5_2_019F6620
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F8620 mov eax, dword ptr fs:[00000030h]	5_2_019F8620
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A8866E mov eax, dword ptr fs:[00000030h]	5_2_01A8866E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A8866E mov eax, dword ptr fs:[00000030h]	5_2_01A8866E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019DC640 mov eax, dword ptr fs:[00000030h]	5_2_019DC640
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F2674 mov eax, dword ptr fs:[00000030h]	5_2_019F2674
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FA660 mov eax, dword ptr fs:[00000030h]	5_2_019FA660
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FA660 mov eax, dword ptr fs:[00000030h]	5_2_019FA660
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A489B3 mov esi, dword ptr fs:[00000030h]	5_2_01A489B3
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A489B3 mov eax, dword ptr fs:[00000030h]	5_2_01A489B3
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A489B3 mov eax, dword ptr fs:[00000030h]	5_2_01A489B3
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C09AD mov eax, dword ptr fs:[00000030h]	5_2_019C09AD
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C09AD mov eax, dword ptr fs:[00000030h]	5_2_019C09AD
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h]	5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h]	5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h]	5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h]	5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h]	5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h]	5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h]	5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h]	5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h]	5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h]	5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h]	5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h]	5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D29A0 mov eax, dword ptr fs:[00000030h]	5_2_019D29A0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4E9E0 mov eax, dword ptr fs:[00000030h]	5_2_01A4E9E0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CA9D0 mov eax, dword ptr fs:[00000030h]	5_2_019CA9D0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CA9D0 mov eax, dword ptr fs:[00000030h]	5_2_019CA9D0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CA9D0 mov eax, dword ptr fs:[00000030h]	5_2_019CA9D0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CA9D0 mov eax, dword ptr fs:[00000030h]	5_2_019CA9D0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CA9D0 mov eax, dword ptr fs:[00000030h]	5_2_019CA9D0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CA9D0 mov eax, dword ptr fs:[00000030h]	5_2_019CA9D0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F49D0 mov eax, dword ptr fs:[00000030h]	5_2_019F49D0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A569C0 mov eax, dword ptr fs:[00000030h]	5_2_01A569C0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F29F9 mov eax, dword ptr fs:[00000030h]	5_2_019F29F9
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F29F9 mov eax, dword ptr fs:[00000030h]	5_2_019F29F9
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A8A9D3 mov eax, dword ptr fs:[00000030h]	5_2_01A8A9D3
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019B8918 mov eax, dword ptr fs:[00000030h]	5_2_019B8918
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019B8918 mov eax, dword ptr fs:[00000030h]	5_2_019B8918
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4892A mov eax, dword ptr fs:[00000030h]	5_2_01A4892A
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A5892B mov eax, dword ptr fs:[00000030h]	5_2_01A5892B
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3E908 mov eax, dword ptr fs:[00000030h]	5_2_01A3E908
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3E908 mov eax, dword ptr fs:[00000030h]	5_2_01A3E908
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4C912 mov eax, dword ptr fs:[00000030h]	5_2_01A4C912
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A0096E mov eax, dword ptr fs:[00000030h]	5_2_01A0096E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A0096E mov edx, dword ptr fs:[00000030h]	5_2_01A0096E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A0096E mov eax, dword ptr fs:[00000030h]	5_2_01A0096E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4C97C mov eax, dword ptr fs:[00000030h]	5_2_01A4C97C
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A64978 mov eax, dword ptr fs:[00000030h]	5_2_01A64978
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A64978 mov eax, dword ptr fs:[00000030h]	5_2_01A64978
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A40946 mov eax, dword ptr fs:[00000030h]	5_2_01A40946
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A94940 mov eax, dword ptr fs:[00000030h]	5_2_01A94940
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E6962 mov eax, dword ptr fs:[00000030h]	5_2_019E6962
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E6962 mov eax, dword ptr fs:[00000030h]	5_2_019E6962
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E6962 mov eax, dword ptr fs:[00000030h]	5_2_019E6962
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C0887 mov eax, dword ptr fs:[00000030h]	5_2_019C0887
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4C89D mov eax, dword ptr fs:[00000030h]	5_2_01A4C89D
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A8A8E4 mov eax, dword ptr fs:[00000030h]	5_2_01A8A8E4
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EE8C0 mov eax, dword ptr fs:[00000030h]	5_2_019EE8C0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FC8F9 mov eax, dword ptr fs:[00000030h]	5_2_019FC8F9
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FC8F9 mov eax, dword ptr fs:[00000030h]	5_2_019FC8F9
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A908C0 mov eax, dword ptr fs:[00000030h]	5_2_01A908C0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6483A mov eax, dword ptr fs:[00000030h]	5_2_01A6483A
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6483A mov eax, dword ptr fs:[00000030h]	5_2_01A6483A
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E2835 mov eax, dword ptr fs:[00000030h]	5_2_019E2835
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E2835 mov eax, dword ptr fs:[00000030h]	5_2_019E2835
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E2835 mov eax, dword ptr fs:[00000030h]	5_2_019E2835
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E2835 mov ecx, dword ptr fs:[00000030h]	5_2_019E2835
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E2835 mov eax, dword ptr fs:[00000030h]	5_2_019E2835
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E2835 mov eax, dword ptr fs:[00000030h]	5_2_019E2835
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FA830 mov eax, dword ptr fs:[00000030h]	5_2_019FA830
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4C810 mov eax, dword ptr fs:[00000030h]	5_2_01A4C810
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C4859 mov eax, dword ptr fs:[00000030h]	5_2_019C4859
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C4859 mov eax, dword ptr fs:[00000030h]	5_2_019C4859
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F0854 mov eax, dword ptr fs:[00000030h]	5_2_019F0854
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A56870 mov eax, dword ptr fs:[00000030h]	5_2_01A56870
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A56870 mov eax, dword ptr fs:[00000030h]	5_2_01A56870
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4E872 mov eax, dword ptr fs:[00000030h]	5_2_01A4E872
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4E872 mov eax, dword ptr fs:[00000030h]	5_2_01A4E872
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D2840 mov ecx, dword ptr fs:[00000030h]	5_2_019D2840
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A74BB0 mov eax, dword ptr fs:[00000030h]	5_2_01A74BB0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A74BB0 mov eax, dword ptr fs:[00000030h]	5_2_01A74BB0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0BBE mov eax, dword ptr fs:[00000030h]	5_2_019D0BBE
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0BBE mov eax, dword ptr fs:[00000030h]	5_2_019D0BBE
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C0BCD mov eax, dword ptr fs:[00000030h]	5_2_019C0BCD
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C0BCD mov eax, dword ptr fs:[00000030h]	5_2_019C0BCD
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C0BCD mov eax, dword ptr fs:[00000030h]	5_2_019C0BCD
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4CBF0 mov eax, dword ptr fs:[00000030h]	5_2_01A4CBF0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E0BCB mov eax, dword ptr fs:[00000030h]	5_2_019E0BCB
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E0BCB mov eax, dword ptr fs:[00000030h]	5_2_019E0BCB
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E0BCB mov eax, dword ptr fs:[00000030h]	5_2_019E0BCB
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EEBFC mov eax, dword ptr fs:[00000030h]	5_2_019EEBFC
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C8BF0 mov eax, dword ptr fs:[00000030h]	5_2_019C8BF0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C8BF0 mov eax, dword ptr fs:[00000030h]	5_2_019C8BF0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C8BF0 mov eax, dword ptr fs:[00000030h]	5_2_019C8BF0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6EBD0 mov eax, dword ptr fs:[00000030h]	5_2_01A6EBD0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A88B28 mov eax, dword ptr fs:[00000030h]	5_2_01A88B28
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A88B28 mov eax, dword ptr fs:[00000030h]	5_2_01A88B28
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A94B00 mov eax, dword ptr fs:[00000030h]	5_2_01A94B00
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3EB1D mov eax, dword ptr fs:[00000030h]	5_2_01A3EB1D
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3EB1D mov eax, dword ptr fs:[00000030h]	5_2_01A3EB1D
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3EB1D mov eax, dword ptr fs:[00000030h]	5_2_01A3EB1D
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3EB1D mov eax, dword ptr fs:[00000030h]	5_2_01A3EB1D
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3EB1D mov eax, dword ptr fs:[00000030h]	5_2_01A3EB1D
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3EB1D mov eax, dword ptr fs:[00000030h]	5_2_01A3EB1D
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3EB1D mov eax, dword ptr fs:[00000030h]	5_2_01A3EB1D
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3EB1D mov eax, dword ptr fs:[00000030h]	5_2_01A3EB1D
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A3EB1D mov eax, dword ptr fs:[00000030h]	5_2_01A3EB1D
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EEB20 mov eax, dword ptr fs:[00000030h]	5_2_019EEB20
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EEB20 mov eax, dword ptr fs:[00000030h]	5_2_019EEB20
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019B8B50 mov eax, dword ptr fs:[00000030h]	5_2_019B8B50
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A68B42 mov eax, dword ptr fs:[00000030h]	5_2_01A68B42
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A56B40 mov eax, dword ptr fs:[00000030h]	5_2_01A56B40
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A56B40 mov eax, dword ptr fs:[00000030h]	5_2_01A56B40
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019BCB7E mov eax, dword ptr fs:[00000030h]	5_2_019BCB7E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A8AB40 mov eax, dword ptr fs:[00000030h]	5_2_01A8AB40
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A74B4B mov eax, dword ptr fs:[00000030h]	5_2_01A74B4B
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A74B4B mov eax, dword ptr fs:[00000030h]	5_2_01A74B4B
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6EB50 mov eax, dword ptr fs:[00000030h]	5_2_01A6EB50
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A92B57 mov eax, dword ptr fs:[00000030h]	5_2_01A92B57
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A92B57 mov eax, dword ptr fs:[00000030h]	5_2_01A92B57
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A92B57 mov eax, dword ptr fs:[00000030h]	5_2_01A92B57
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A92B57 mov eax, dword ptr fs:[00000030h]	5_2_01A92B57
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A16AA4 mov eax, dword ptr fs:[00000030h]	5_2_01A16AA4
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F8A90 mov edx, dword ptr fs:[00000030h]	5_2_019F8A90
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CEA80 mov eax, dword ptr fs:[00000030h]	5_2_019CEA80
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CEA80 mov eax, dword ptr fs:[00000030h]	5_2_019CEA80
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CEA80 mov eax, dword ptr fs:[00000030h]	5_2_019CEA80
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CEA80 mov eax, dword ptr fs:[00000030h]	5_2_019CEA80
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CEA80 mov eax, dword ptr fs:[00000030h]	5_2_019CEA80
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CEA80 mov eax, dword ptr fs:[00000030h]	5_2_019CEA80
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CEA80 mov eax, dword ptr fs:[00000030h]	5_2_019CEA80
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CEA80 mov eax, dword ptr fs:[00000030h]	5_2_019CEA80
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019CEA80 mov eax, dword ptr fs:[00000030h]	5_2_019CEA80
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A94A80 mov eax, dword ptr fs:[00000030h]	5_2_01A94A80
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C8AA0 mov eax, dword ptr fs:[00000030h]	5_2_019C8AA0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C8AA0 mov eax, dword ptr fs:[00000030h]	5_2_019C8AA0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C0AD0 mov eax, dword ptr fs:[00000030h]	5_2_019C0AD0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F4AD0 mov eax, dword ptr fs:[00000030h]	5_2_019F4AD0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019F4AD0 mov eax, dword ptr fs:[00000030h]	5_2_019F4AD0
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A16ACC mov eax, dword ptr fs:[00000030h]	5_2_01A16ACC
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A16ACC mov eax, dword ptr fs:[00000030h]	5_2_01A16ACC
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A16ACC mov eax, dword ptr fs:[00000030h]	5_2_01A16ACC
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FAAEE mov eax, dword ptr fs:[00000030h]	5_2_019FAAEE
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FAAEE mov eax, dword ptr fs:[00000030h]	5_2_019FAAEE
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FCA38 mov eax, dword ptr fs:[00000030h]	5_2_019FCA38
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E4A35 mov eax, dword ptr fs:[00000030h]	5_2_019E4A35
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019E4A35 mov eax, dword ptr fs:[00000030h]	5_2_019E4A35
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019EEA2E mov eax, dword ptr fs:[00000030h]	5_2_019EEA2E
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A4CA11 mov eax, dword ptr fs:[00000030h]	5_2_01A4CA11
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019FCA24 mov eax, dword ptr fs:[00000030h]	5_2_019FCA24
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0A5B mov eax, dword ptr fs:[00000030h]	5_2_019D0A5B
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019D0A5B mov eax, dword ptr fs:[00000030h]	5_2_019D0A5B
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_01A6EA60 mov eax, dword ptr fs:[00000030h]	5_2_01A6EA60
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C6A50 mov eax, dword ptr fs:[00000030h]	5_2_019C6A50
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C6A50 mov eax, dword ptr fs:[00000030h]	5_2_019C6A50
Source: C:\Users\user\Desktop\PO1038854.exe	Code function: 5_2_019C6A50 mov eax, dword ptr fs:[00000030h]	5_2_019C6A50

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\PO1038854.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\PO1038854.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO1038854.exe"
Source: C:\Users\user\Desktop\PO1038854.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO1038854.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\PO1038854.exe

Memory written: C:\Users\user\Desktop\PO1038854.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\PO1038854.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO1038854.exe"			Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Process created: C:\Users\user\Desktop\PO1038854.exe "C:\Users\user\Desktop\PO1038854.exe"			Jump to behavior

Source: C:\Users\user\Desktop\PO1038854.exe	Queries volume information: C:\Users\user\Desktop\PO1038854.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO1038854.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO1038854.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match	File source: 5.2.PO1038854.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO1038854.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2385912141.0000000001CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2384523939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Source: Yara match	File source: 5.2.PO1038854.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PO1038854.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2385912141.0000000001CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2384523939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	OS Credential Dumping	2 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO1038854.exe	24%	ReversingLabs	ByteCode-MSIL.Trojan.Genie8DN
PO1038854.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PO1038854.exe, 00000000.00000002.2137118655.000000000316E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522761
Start date and time:	2024-09-30 16:32:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO1038854.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/6@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 46 Number of non-executed functions: 287
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: PO1038854.exe

Simulations

Behavior and APIs

Time	Type	Description
10:32:54	API Interceptor	4x Sleep call for process: PO1038854.exe modified
10:32:55	API Interceptor	16x Sleep call for process: powershell.exe modified

Process:	C:\Users\user\Desktop\PO1038854.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380805901110357
Encrypted:	false
SSDEEP:	48:lylWSU4xympjgs4RIoU99tK8NPZHUl7u1iMugeC/ZM0Uyus:lGLHxvCsIfA2KRHmOugw1s
MD5:	2841736A1E367C6D039C41512DA2893E
SHA1:	8AE1356D954F14390DD115EB92E2B01F86E98141
SHA-256:	70D4743FAB5C407020B872595615D3B018AC17A6F504084BF1E95B061C97047E
SHA-512:	E11A1F186A9B75658F905B7128526E054CEE572A4F55BBB864B5E8B5DC3D8B62D1E160F31472213DB0CEB8A612D71B23DAE03EBC6AB5BC0D8933732F2007EF6C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5dkr3tbb.vhm.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dqn1tp34.0dg.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qdxuiqie.alq.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z5g0fnvv.pm2.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.862060183775342
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	PO1038854.exe
File size:	793'600 bytes
MD5:	0b8096803c8a92e49a117832e8005e90
SHA1:	b897636e60d041c518422da34325c7810c1f3404
SHA256:	85e703636c2e5c837b37714c02a838dca4f2ac440d45c0bedfbf56b8e01c4820
SHA512:	c43dece156354bee9110a6025030066cf54e44144ab730c233a03caad1e0b1e6d9a1f329949360e44285206e71d2b11fbab1be1b94578d53352c69d6e47a9532
SSDEEP:	12288:+Xusruc84Pww5Bg6i6os91E3x3u2yoVKlF62aQqurR4FxRnifrmTeUEP3p2NUp:+Mc9DV1QumMlqur+Ni6Q5
TLSH:	3FF402086AF8EE1AD56E477694B0415067FAB8DAA673F31F1FC230F51F26784C904B62
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f............................./... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4c2fce
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FAA780 [Mon Sep 30 13:28:32 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2f80	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x800	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc0fd4	0xc1000	ede9d21db9d59d8582ba92dfb7cd54ae	False	0.9190844600064767	data	7.870972260343742	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc4000	0x800	0x800	3a4d30278c462bc7ad9fa275918f756c	False	0.337890625	data	3.476399585705256	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc6000	0xc	0x200	4d28466b59bd2b8bc85d243877b86e54	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc4090	0x39c	data			0.41883116883116883
RT_MANIFEST	0xc443c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Target ID:	0
Start time:	10:32:53
Start date:	30/09/2024
Path:	C:\Users\user\Desktop\PO1038854.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO1038854.exe"
Imagebase:	0xac0000
File size:	793'600 bytes
MD5 hash:	0B8096803C8A92E49A117832E8005E90
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	10:32:54
Start date:	30/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO1038854.exe"
Imagebase:	0x470000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	10:32:54
Start date:	30/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	10:32:54
Start date:	30/09/2024
Path:	C:\Users\user\Desktop\PO1038854.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO1038854.exe"
Imagebase:	0xf10000
File size:	793'600 bytes
MD5 hash:	0B8096803C8A92E49A117832E8005E90
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2385912141.0000000001CE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.2385912141.0000000001CE0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2384523939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.2384523939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	6
Start time:	10:32:57
Start date:	30/09/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true