Windows Analysis Report
Oogoninia.exe

Overview

General Information

Sample name: Oogoninia.exe
Analysis ID: 1529338
MD5: 18fb2cccaa9ac71624eaceada006e938
SHA1: a25055a3b29ce0ee64d7e20eccced0f72ec737db
SHA256: 9b00715d77438200a4f54fa8f47ac17aab0cc166e95fc6737c2a78021b69a64e
Infos:

Detection

FormBook, GuLoader
Score: 96
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Yara detected GuLoader
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Oogoninia.exe ReversingLabs: Detection: 39%
Yara detected FormBook
Source: Yara match File source: 00000009.00000002.2899878533.0000000004A20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1365396637.00000000321D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2899793805.00000000049D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Machine Learning detection for sample
Source: Oogoninia.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: Oogoninia.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 142.250.80.78:443 -> 192.168.11.20:49705 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.251.40.129:443 -> 192.168.11.20:49706 version: TLS 1.2
Source: Oogoninia.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: grpconv.pdb source: Oogoninia.exe, 00000002.00000002.1354974337.0000000002246000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: grpconv.pdbGCTL source: Oogoninia.exe, 00000002.00000002.1354974337.0000000002246000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mshtml.pdb source: Oogoninia.exe, 00000002.00000001.1095360708.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source: Binary string: wntdll.pdbUGP source: Oogoninia.exe, 00000002.00000003.1266200701.0000000032185000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000002.1365528846.00000000324F0000.00000040.00001000.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1269709171.000000003233F000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000002.1365528846.000000003261D000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, 00000009.00000002.2900077757.0000000004D5D000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, 00000009.00000003.1352249094.00000000048C5000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000009.00000003.1355628174.0000000004A7E000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000009.00000002.2900077757.0000000004C30000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: Oogoninia.exe, Oogoninia.exe, 00000002.00000003.1266200701.0000000032185000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000002.1365528846.00000000324F0000.00000040.00001000.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1269709171.000000003233F000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000002.1365528846.000000003261D000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, grpconv.exe, 00000009.00000002.2900077757.0000000004D5D000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, 00000009.00000003.1352249094.00000000048C5000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000009.00000003.1355628174.0000000004A7E000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000009.00000002.2900077757.0000000004C30000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: mshtml.pdbUGP source: Oogoninia.exe, 00000002.00000001.1095360708.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 0_2_00405642 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 0_2_00405642
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 0_2_004060A4 FindFirstFileA,FindClose, 0_2_004060A4
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 0_2_0040270B FindFirstFileA, 0_2_0040270B
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Code function: 4x nop then mov ebx, 00000004h 4_2_04117D06
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 4x nop then mov ebx, 00000004h 9_2_04B204E1
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49705 -> 142.250.80.78:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /uc?export=download&id=1ebPjn97g6Md1czlcx8nGPFrA4sVz_tMd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /download?id=1ebPjn97g6Md1czlcx8nGPFrA4sVz_tMd&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /uc?export=download&id=1ebPjn97g6Md1czlcx8nGPFrA4sVz_tMd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /download?id=1ebPjn97g6Md1czlcx8nGPFrA4sVz_tMd&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: drive.google.com
Source: global traffic DNS traffic detected: DNS query: drive.usercontent.google.com
Source: explorer.exe, 0000000F.00000000.2836002415.000000000E073000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.5994248157.000000000E073000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2830216566.0000000009FCF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.5986237494.0000000009FCF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: Oogoninia.exe, 00000002.00000003.1190652532.00000000021FE000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1266904582.00000000021FE000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1190121446.00000000021FC000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000002.1354638492.0000000002200000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1266629669.00000000021FC000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1156475256.0000000002200000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1156646275.0000000002200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Oogoninia.exe, 00000002.00000003.1190652532.00000000021FE000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1266904582.00000000021FE000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1190121446.00000000021FC000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000002.1354638492.0000000002200000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1266629669.00000000021FC000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1156475256.0000000002200000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1156646275.0000000002200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: explorer.exe, 0000000F.00000000.2836002415.000000000E073000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.5994248157.000000000E073000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2830216566.0000000009FCF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.5986237494.0000000009FCF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: Oogoninia.exe, 00000002.00000001.1095360708.0000000000649000.00000020.00000001.01000000.00000006.sdmp String found in binary or memory: http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.
Source: Oogoninia.exe String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: Oogoninia.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 0000000F.00000000.2836002415.000000000E073000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.5994248157.000000000E073000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2830216566.0000000009FCF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.5986237494.0000000009FCF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 0000000F.00000000.2830216566.0000000009F57000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.5986237494.0000000009F57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crl
Source: explorer.exe, 0000000F.00000002.5987815503.000000000A410000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.2825779872.00000000017A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.2831622571.000000000AE70000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://schemas.micro
Source: Oogoninia.exe, 00000002.00000001.1095360708.0000000000649000.00000020.00000001.01000000.00000006.sdmp String found in binary or memory: http://www.gopher.ftp://ftp.
Source: Oogoninia.exe, 00000002.00000001.1095360708.0000000000626000.00000020.00000001.01000000.00000006.sdmp String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD
Source: Oogoninia.exe, 00000002.00000003.1190652532.00000000021FE000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1266904582.00000000021FE000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1190121446.00000000021FC000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000002.1354638492.0000000002200000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1266629669.00000000021FC000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1156475256.0000000002200000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1156646275.0000000002200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.quovadis.bm0
Source: Oogoninia.exe, 00000002.00000001.1095360708.00000000005F2000.00000020.00000001.01000000.00000006.sdmp String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Source: Oogoninia.exe, 00000002.00000001.1095360708.00000000005F2000.00000020.00000001.01000000.00000006.sdmp String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
Source: explorer.exe, 0000000F.00000002.5985932285.0000000009DC1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2830063439.0000000009E31000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/odirm
Source: explorer.exe, 0000000F.00000000.2833665275.000000000DAFB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.5991554898.000000000DAFB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/B
Source: explorer.exe, 0000000F.00000000.2833665275.000000000DAFB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.5991554898.000000000DAFB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/J
Source: explorer.exe, 0000000F.00000000.2829964726.0000000009DC1000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 0000000F.00000000.2833665275.000000000DAFB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.5991554898.000000000DAFB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=DC09251A71C5472DA2BDFD73DC109609&timeOut=5000&oc
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2833665275.000000000DAFB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.5991554898.000000000DAFB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: Oogoninia.exe, 00000002.00000003.1156475256.0000000002200000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1156646275.0000000002200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://apis.google.com
Source: explorer.exe, 0000000F.00000002.5985932285.0000000009DC1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829964726.0000000009DC1000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://arc.msn.comO
Source: explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Stock_In
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/taskbar/icons/earnings/svg/light/blue.svg
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/MostlyCloudyNight.pn
Source: explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/MostlyCloudyNight.sv
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Teaser/humidity.png
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Teaser/humidity.svg
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/20240402.1/Weather/W36_Most
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/20240402.1/WeatherInsight/W
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C3A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C3A000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.m
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fgwm
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fgwm-dark
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gowI
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gowI-dark
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gyvW
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gyvW-dark
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi3
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi3-dark
Source: Oogoninia.exe, 00000002.00000002.1354263850.0000000002178000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/
Source: Oogoninia.exe, 00000002.00000002.1354263850.0000000002178000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000002.1364783984.00000000318B0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=1ebPjn97g6Md1czlcx8nGPFrA4sVz_tMd
Source: Oogoninia.exe, 00000002.00000002.1354263850.0000000002178000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=1ebPjn97g6Md1czlcx8nGPFrA4sVz_tMdBSX
Source: Oogoninia.exe, 00000002.00000002.1354263850.0000000002178000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=1ebPjn97g6Md1czlcx8nGPFrA4sVz_tMdXSN
Source: Oogoninia.exe, 00000002.00000002.1354263850.0000000002178000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=1ebPjn97g6Md1czlcx8nGPFrA4sVz_tMds2
Source: Oogoninia.exe, 00000002.00000003.1190652532.00000000021FE000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1266904582.00000000021FE000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1190121446.00000000021FC000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000002.1354638492.0000000002200000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1266629669.00000000021FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/
Source: Oogoninia.exe, 00000002.00000003.1190652532.00000000021FE000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1266904582.00000000021FE000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1190121446.00000000021FC000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000002.1354638492.0000000002200000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1266629669.00000000021FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/OlG
Source: Oogoninia.exe, 00000002.00000003.1190652532.00000000021FE000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1266904582.00000000021FE000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1190121446.00000000021FC000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000002.1354638492.0000000002200000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1266629669.00000000021FC000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1156475256.0000000002200000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1156646275.0000000002200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1ebPjn97g6Md1czlcx8nGPFrA4sVz_tMd&export=download
Source: Oogoninia.exe, 00000002.00000003.1266977009.00000000021D6000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000002.1354263850.00000000021D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1ebPjn97g6Md1czlcx8nGPFrA4sVz_tMd&export=download88
Source: Oogoninia.exe, 00000002.00000002.1354263850.00000000021CD000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1266977009.00000000021CC000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1267464453.00000000021CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1ebPjn97g6Md1czlcx8nGPFrA4sVz_tMd&export=download;8
Source: Oogoninia.exe, 00000002.00000003.1190652532.00000000021FE000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1266904582.00000000021FE000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1190121446.00000000021FC000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000002.1354638492.0000000002200000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1266629669.00000000021FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1ebPjn97g6Md1czlcx8nGPFrA4sVz_tMd&export=downloade
Source: explorer.exe, 0000000F.00000000.2833665275.000000000DAFB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.5991554898.000000000DAFB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://excel.office.com
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA179X84.img
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1g7bhz.img
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1lLvot.img
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1nsFzx.img
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAUhLdx.img
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAY97Jf.img
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAaeOki.img
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C3A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C3A000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyPU
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyxkRJ.img
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1d0ujS.img
Source: Oogoninia.exe, 00000002.00000001.1095360708.0000000000649000.00000020.00000001.01000000.00000006.sdmp String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
Source: explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://ntp.msn.com/edge/ntp?cm=en-us&ocid=widgetonlockscreenwin10&cvid=a7af015c-55f5-465b-b0e4-6fef
Source: Oogoninia.exe, 00000002.00000003.1190652532.00000000021FE000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1266904582.00000000021FE000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1190121446.00000000021FC000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000002.1354638492.0000000002200000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1266629669.00000000021FC000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1156475256.0000000002200000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1156646275.0000000002200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: explorer.exe, 0000000F.00000002.5985932285.0000000009DC1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2830063439.0000000009E31000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.comO
Source: explorer.exe, 0000000F.00000000.2836002415.000000000E073000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.5994248157.000000000E073000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://powerpoint.office.comEM
Source: Oogoninia.exe, 00000002.00000003.1156475256.0000000002200000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1156646275.0000000002200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ssl.gstatic.com
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-US&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-US&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000000F.00000002.5996841586.0000000011914000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2838101876.0000000011914000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://word.office.com64.exe
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.glamour.com/story/shag-haircut-photos-products
Source: Oogoninia.exe, 00000002.00000003.1156475256.0000000002200000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1156646275.0000000002200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com;report-uri
Source: Oogoninia.exe, 00000002.00000003.1156475256.0000000002200000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1156646275.0000000002200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: Oogoninia.exe, 00000002.00000003.1156475256.0000000002200000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1156646275.0000000002200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.com
Source: Oogoninia.exe, 00000002.00000003.1156475256.0000000002200000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1156646275.0000000002200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.instyle.com/hair/shag-haircut-face-shape
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/autos/other/24-used-sports-cars-that-are-notoriously-reliable-yet-crazy-ch
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/channel/source/AZ%20Animals%20US/sr-vid-7etr9q8xun6k6508c3nufaum0de3dqktiq
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/entertainment/news/james-earl-jones-dies-at-93-all-about-his-son-flynn/ar-
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/feed
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/foodanddrink/recipes/i-asked-3-farmers-the-best-way-to-cook-zucchini-they-
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/health/medical/2-egg-brands-have-been-recalled-due-to-a-serious-salmonella
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/lifestyle/beauty/40-shag-haircuts-to-inspire-your-next-salon-visit/ss-AA1p
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/markets?id=a33k6h
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/markets?id=a3oxnm
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/markets?id=a6qja2
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/18-everyday-household-items-that-are-surprisingly-va
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/retirement/a-youtuber-asked-a-group-of-americans-aged-70-to-80-what-
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/retirement/middle-aged-americans-are-leaving-work-for-months-years-t
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/crime/dick-van-dyke-forever-young/ar-AA1lDpRD
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/crime/tyreek-hill-s-traffic-stop-shows-interactions-with-police-can-b
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/6-things-to-watch-for-when-kamala-harris-debates-donald-trum
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/chris-christie-former-trump-debate-coach-offers-key-pieces-o
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/jd-vance-spreads-outrageous-lie-about-haitian-immigrants/ar-
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/james-earl-jones-s-talents-went-far-far-beyond-his-magnificent-voi
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/trump-repeats-false-claims-that-children-are-undergoing-transgende
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/world/gaza-authorities-say-deadly-blasts-hit-humanitarian-zone/ar-AA1
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/sports/nba/johnny-gaudreau-s-wife-reveals-in-eulogy-she-s-pregnant-expecti
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/sports/nfl/49ers-win-over-jets-ends-with-final-score-that-s-never-been-see
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/travel/news/scientists-finally-solve-mystery-behind-bermuda-triangle-disap
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/tv/news/the-bold-the-beautiful-young-and-the-restless-more-get-premiere-da
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/forecast/in-Santa-Clara%2CCalifornia?loc=eyJsIjoiU2FudGEgQ2xhcmEiL
Source: explorer.exe, 0000000F.00000002.5985329547.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2829503548.0000000009C4D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/hourlyforecast/in-Santa-Clara%2CCalifornia?loc=eyJsIjoiU2FudGEgQ2x
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown HTTPS traffic detected: 142.250.80.78:443 -> 192.168.11.20:49705 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.251.40.129:443 -> 192.168.11.20:49706 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 0_2_004050F7 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_004050F7

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 00000009.00000002.2899878533.0000000004A20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1365396637.00000000321D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2899793805.00000000049D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 00000009.00000002.2899878533.0000000004A20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1365396637.00000000321D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.2899793805.00000000049D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325634E0 NtCreateMutant,LdrInitializeThunk, 2_2_325634E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562BC0 NtQueryInformationToken,LdrInitializeThunk, 2_2_32562BC0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562B90 NtFreeVirtualMemory,LdrInitializeThunk, 2_2_32562B90
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562EB0 NtProtectVirtualMemory,LdrInitializeThunk, 2_2_32562EB0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562D10 NtQuerySystemInformation,LdrInitializeThunk, 2_2_32562D10
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32564260 NtSetContextThread, 2_2_32564260
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32564570 NtSuspendThread, 2_2_32564570
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562A10 NtWriteFile, 2_2_32562A10
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562AC0 NtEnumerateValueKey, 2_2_32562AC0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562A80 NtClose, 2_2_32562A80
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562AA0 NtQueryInformationFile, 2_2_32562AA0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562B10 NtAllocateVirtualMemory, 2_2_32562B10
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562B00 NtQueryValueKey, 2_2_32562B00
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562B20 NtQueryInformationProcess, 2_2_32562B20
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562BE0 NtQueryVirtualMemory, 2_2_32562BE0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562B80 NtCreateKey, 2_2_32562B80
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325638D0 NtGetContextThread, 2_2_325638D0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325629D0 NtWaitForSingleObject, 2_2_325629D0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325629F0 NtReadFile, 2_2_325629F0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562E50 NtCreateSection, 2_2_32562E50
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562E00 NtQueueApcThread, 2_2_32562E00
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562ED0 NtResumeThread, 2_2_32562ED0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562EC0 NtQuerySection, 2_2_32562EC0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562E80 NtCreateProcessEx, 2_2_32562E80
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562F00 NtCreateFile, 2_2_32562F00
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562F30 NtOpenDirectoryObject, 2_2_32562F30
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562FB0 NtSetValueKey, 2_2_32562FB0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562C50 NtUnmapViewOfSection, 2_2_32562C50
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562C10 NtOpenProcess, 2_2_32562C10
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32563C30 NtOpenProcessToken, 2_2_32563C30
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562C30 NtMapViewOfSection, 2_2_32562C30
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562C20 NtSetInformationFile, 2_2_32562C20
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562CD0 NtEnumerateKey, 2_2_32562CD0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562CF0 NtDelayExecution, 2_2_32562CF0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32563C90 NtOpenThread, 2_2_32563C90
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562D50 NtWriteVirtualMemory, 2_2_32562D50
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Code function: 4_2_0411B88D SleepEx,NtResumeThread, 4_2_0411B88D
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Code function: 4_2_0411B670 SleepEx,NtCreateSection, 4_2_0411B670
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA34E0 NtCreateMutant,LdrInitializeThunk, 9_2_04CA34E0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2CF0 NtDelayExecution,LdrInitializeThunk, 9_2_04CA2CF0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2C30 NtMapViewOfSection,LdrInitializeThunk, 9_2_04CA2C30
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2D10 NtQuerySystemInformation,LdrInitializeThunk, 9_2_04CA2D10
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2E50 NtCreateSection,LdrInitializeThunk, 9_2_04CA2E50
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2F00 NtCreateFile,LdrInitializeThunk, 9_2_04CA2F00
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA29F0 NtReadFile,LdrInitializeThunk, 9_2_04CA29F0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2A80 NtClose,LdrInitializeThunk, 9_2_04CA2A80
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2BC0 NtQueryInformationToken,LdrInitializeThunk, 9_2_04CA2BC0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2B80 NtCreateKey,LdrInitializeThunk, 9_2_04CA2B80
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2B90 NtFreeVirtualMemory,LdrInitializeThunk, 9_2_04CA2B90
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2B00 NtQueryValueKey,LdrInitializeThunk, 9_2_04CA2B00
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2B10 NtAllocateVirtualMemory,LdrInitializeThunk, 9_2_04CA2B10
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA4570 NtSuspendThread, 9_2_04CA4570
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA4260 NtSetContextThread, 9_2_04CA4260
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2CD0 NtEnumerateKey, 9_2_04CA2CD0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA3C90 NtOpenThread, 9_2_04CA3C90
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2C50 NtUnmapViewOfSection, 9_2_04CA2C50
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2C10 NtOpenProcess, 9_2_04CA2C10
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2C20 NtSetInformationFile, 9_2_04CA2C20
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA3C30 NtOpenProcessToken, 9_2_04CA3C30
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2DC0 NtAdjustPrivilegesToken, 9_2_04CA2DC0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2DA0 NtReadVirtualMemory, 9_2_04CA2DA0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2D50 NtWriteVirtualMemory, 9_2_04CA2D50
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2EC0 NtQuerySection, 9_2_04CA2EC0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2ED0 NtResumeThread, 9_2_04CA2ED0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2E80 NtCreateProcessEx, 9_2_04CA2E80
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2EB0 NtProtectVirtualMemory, 9_2_04CA2EB0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2E00 NtQueueApcThread, 9_2_04CA2E00
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2FB0 NtSetValueKey, 9_2_04CA2FB0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2F30 NtOpenDirectoryObject, 9_2_04CA2F30
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA38D0 NtGetContextThread, 9_2_04CA38D0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA29D0 NtWaitForSingleObject, 9_2_04CA29D0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2AC0 NtEnumerateValueKey, 9_2_04CA2AC0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2AA0 NtQueryInformationFile, 9_2_04CA2AA0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2A10 NtWriteFile, 9_2_04CA2A10
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2BE0 NtQueryVirtualMemory, 9_2_04CA2BE0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CA2B20 NtQueryInformationProcess, 9_2_04CA2B20
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04B2EFFE NtQueryInformationProcess, 9_2_04B2EFFE
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04B33568 NtSetContextThread, 9_2_04B33568
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04B33EC8 NtQueueApcThread, 9_2_04B33EC8
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04B33888 NtSuspendThread, 9_2_04B33888
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04B33BA8 NtResumeThread, 9_2_04B33BA8
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 0_2_00403180 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403180
Creates files inside the system directory
Source: C:\Users\user\Desktop\Oogoninia.exe File created: C:\Windows\Fonts\prelegacy Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe File created: C:\Windows\Fonts\prelegacy\prster Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 0_2_00404936 0_2_00404936
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_324F2245 2_2_324F2245
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325E124C 2_2_325E124C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254D210 2_2_3254D210
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251D2EC 2_2_3251D2EC
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3253E310 2_2_3253E310
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325EF330 2_2_325EF330
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32521380 2_2_32521380
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325DE076 2_2_325DE076
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3253B0D0 2_2_3253B0D0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325200A0 2_2_325200A0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3257717A 2_2_3257717A
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325F010E 2_2_325F010E
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325CD130 2_2_325CD130
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325351C0 2_2_325351C0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254B1E0 2_2_3254B1E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325DD646 2_2_325DD646
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32554670 2_2_32554670
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254C600 2_2_3254C600
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325CD62C 2_2_325CD62C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325EF6F6 2_2_325EF6F6
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252C6E0 2_2_3252C6E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325A36EC 2_2_325A36EC
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325E6757 2_2_325E6757
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3253A760 2_2_3253A760
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252170C 2_2_3252170C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32530445 2_2_32530445
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325FA526 2_2_325FA526
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325EF5C9 2_2_325EF5C9
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325E75C6 2_2_325E75C6
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325EEA5B 2_2_325EEA5B
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325ECA13 2_2_325ECA13
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325EFA89 2_2_325EFA89
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254FAA0 2_2_3254FAA0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32530B10 2_2_32530B10
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3256DB19 2_2_3256DB19
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325A4BC0 2_2_325A4BC0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32539870 2_2_32539870
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254B870 2_2_3254B870
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32516868 2_2_32516868
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255E810 2_2_3255E810
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32533800 2_2_32533800
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325D0835 2_2_325D0835
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325E18DA 2_2_325E18DA
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325328C0 2_2_325328C0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325E78F3 2_2_325E78F3
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32546882 2_2_32546882
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325358B0 2_2_325358B0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325A98B2 2_2_325A98B2
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325759C0 2_2_325759C0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_324F99E8 2_2_324F99E8
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252E9A0 2_2_3252E9A0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325EE9A6 2_2_325EE9A6
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32550E50 2_2_32550E50
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32572E48 2_2_32572E48
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325D0E6D 2_2_325D0E6D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325E9ED2 2_2_325E9ED2
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32522EE8 2_2_32522EE8
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32531EB2 2_2_32531EB2
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325E0EAD 2_2_325E0EAD
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325EFF63 2_2_325EFF63
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3253CF00 2_2_3253CF00
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325E1FC6 2_2_325E1FC6
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325EEFBF 2_2_325EEFBF
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325DEC4C 2_2_325DEC4C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32533C60 2_2_32533C60
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325E6C69 2_2_325E6C69
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325EEC60 2_2_325EEC60
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32520C12 2_2_32520C12
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3253AC20 2_2_3253AC20
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32548CDF 2_2_32548CDF
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32538CE0 2_2_32538CE0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325FACEB 2_2_325FACEB
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254FCE0 2_2_3254FCE0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325C9C98 2_2_325C9C98
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325E7D4C 2_2_325E7D4C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32530D69 2_2_32530D69
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Code function: 4_2_04126002 4_2_04126002
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Code function: 4_2_04125C69 4_2_04125C69
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Code function: 4_2_0412506D 4_2_0412506D
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Code function: 4_2_04124308 4_2_04124308
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Code function: 4_2_04125B49 4_2_04125B49
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CDD480 9_2_04CDD480
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C70445 9_2_04C70445
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D275C6 9_2_04D275C6
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D2F5C9 9_2_04D2F5C9
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D3A526 9_2_04D3A526
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CE36EC 9_2_04CE36EC
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D2F6F6 9_2_04D2F6F6
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C6C6E0 9_2_04C6C6E0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D1D646 9_2_04D1D646
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C94670 9_2_04C94670
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C8C600 9_2_04C8C600
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D0D62C 9_2_04D0D62C
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D26757 9_2_04D26757
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C7A760 9_2_04C7A760
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C6170C 9_2_04C6170C
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C7B0D0 9_2_04C7B0D0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C600A0 9_2_04C600A0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D1E076 9_2_04D1E076
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C751C0 9_2_04C751C0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C8B1E0 9_2_04C8B1E0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CB717A 9_2_04CB717A
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C5F113 9_2_04C5F113
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D3010E 9_2_04D3010E
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D0D130 9_2_04D0D130
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C5D2EC 9_2_04C5D2EC
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C32245 9_2_04C32245
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D2124C 9_2_04D2124C
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C8D210 9_2_04C8D210
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C61380 9_2_04C61380
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C7E310 9_2_04C7E310
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D2F330 9_2_04D2F330
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C88CDF 9_2_04C88CDF
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C78CE0 9_2_04C78CE0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C8FCE0 9_2_04C8FCE0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D3ACEB 9_2_04D3ACEB
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D09C98 9_2_04D09C98
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D1EC4C 9_2_04D1EC4C
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C73C60 9_2_04C73C60
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D2EC60 9_2_04D2EC60
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D26C69 9_2_04D26C69
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C60C12 9_2_04C60C12
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C7AC20 9_2_04C7AC20
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C79DD0 9_2_04C79DD0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D0FDF4 9_2_04D0FDF4
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C82DB0 9_2_04C82DB0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D27D4C 9_2_04D27D4C
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C70D69 9_2_04C70D69
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C6AD00 9_2_04C6AD00
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D31D2E 9_2_04D31D2E
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D29ED2 9_2_04D29ED2
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C62EE8 9_2_04C62EE8
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C71EB2 9_2_04C71EB2
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D20EAD 9_2_04D20EAD
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CB2E48 9_2_04CB2E48
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C90E50 9_2_04C90E50
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D10E6D 9_2_04D10E6D
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D21FC6 9_2_04D21FC6
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D2EFBF 9_2_04D2EFBF
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D2FF63 9_2_04D2FF63
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C7CF00 9_2_04C7CF00
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C728C0 9_2_04C728C0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D218DA 9_2_04D218DA
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D278F3 9_2_04D278F3
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C86882 9_2_04C86882
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C758B0 9_2_04C758B0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CE98B2 9_2_04CE98B2
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C56868 9_2_04C56868
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C79870 9_2_04C79870
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C8B870 9_2_04C8B870
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C73800 9_2_04C73800
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C9E810 9_2_04C9E810
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D10835 9_2_04D10835
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CB59C0 9_2_04CB59C0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C399E8 9_2_04C399E8
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C6E9A0 9_2_04C6E9A0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D2E9A6 9_2_04D2E9A6
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D2FA89 9_2_04D2FA89
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C8FAA0 9_2_04C8FAA0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D2EA5B 9_2_04D2EA5B
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04D2CA13 9_2_04D2CA13
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CE4BC0 9_2_04CE4BC0
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04CADB19 9_2_04CADB19
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C70B10 9_2_04C70B10
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04B2EFFE 9_2_04B2EFFE
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04B2E444 9_2_04B2E444
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04B2E7DD 9_2_04B2E7DD
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04B2D848 9_2_04B2D848
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04B2CAE3 9_2_04B2CAE3
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04B2E324 9_2_04B2E324
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\grpconv.exe Code function: String function: 04CB7BE4 appears 88 times
Source: C:\Windows\SysWOW64\grpconv.exe Code function: String function: 04CA5050 appears 36 times
Source: C:\Windows\SysWOW64\grpconv.exe Code function: String function: 04C5B910 appears 251 times
Source: C:\Windows\SysWOW64\grpconv.exe Code function: String function: 04CEEF10 appears 105 times
Source: C:\Windows\SysWOW64\grpconv.exe Code function: String function: 04CDE692 appears 84 times
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: String function: 32577BE4 appears 84 times
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: String function: 3251B910 appears 229 times
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: String function: 3259E692 appears 80 times
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: String function: 325AEF10 appears 89 times
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: String function: 32565050 appears 34 times
PE / OLE file has an invalid certificate
Source: Oogoninia.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: Oogoninia.exe, 00000002.00000002.1365528846.00000000327C0000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs Oogoninia.exe
Source: Oogoninia.exe, 00000002.00000003.1266200701.00000000322A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs Oogoninia.exe
Source: Oogoninia.exe, 00000002.00000002.1354974337.000000000225B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGRPCONV.EXEj% vs Oogoninia.exe
Source: Oogoninia.exe, 00000002.00000003.1269709171.000000003246C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs Oogoninia.exe
Source: Oogoninia.exe, 00000002.00000002.1365528846.000000003261D000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs Oogoninia.exe
Source: Oogoninia.exe, 00000002.00000002.1354974337.0000000002246000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGRPCONV.EXEj% vs Oogoninia.exe
Uses 32bit PE files
Source: Oogoninia.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Yara signature match
Source: 00000009.00000002.2899878533.0000000004A20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1365396637.00000000321D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.2899793805.00000000049D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: classification engine Classification label: mal96.troj.evad.winEXE@5/7@2/2
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 0_2_00403180 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403180
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 0_2_004043C3 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 0_2_004043C3
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 0_2_004020CD CoCreateInstance,MultiByteToWideChar, 0_2_004020CD
Source: C:\Users\user\Desktop\Oogoninia.exe File created: C:\Program Files (x86)\Fljtenists.ini Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe File created: C:\Users\user\slavelivets Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe File created: C:\Users\user\AppData\Local\Temp\nsqBBFA.tmp Jump to behavior
Source: Oogoninia.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Oogoninia.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Oogoninia.exe ReversingLabs: Detection: 39%
Source: C:\Users\user\Desktop\Oogoninia.exe File read: C:\Users\user\Desktop\Oogoninia.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Oogoninia.exe "C:\Users\user\Desktop\Oogoninia.exe"
Source: C:\Users\user\Desktop\Oogoninia.exe Process created: C:\Users\user\Desktop\Oogoninia.exe "C:\Users\user\Desktop\Oogoninia.exe"
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Process created: C:\Windows\SysWOW64\grpconv.exe "C:\Windows\SysWOW64\grpconv.exe"
Source: C:\Users\user\Desktop\Oogoninia.exe Process created: C:\Users\user\Desktop\Oogoninia.exe "C:\Users\user\Desktop\Oogoninia.exe" Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Process created: C:\Windows\SysWOW64\grpconv.exe "C:\Windows\SysWOW64\grpconv.exe" Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.cloudstore.schema.shell.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe File written: C:\Program Files (x86)\Fljtenists.ini Jump to behavior
Source: Oogoninia.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: grpconv.pdb source: Oogoninia.exe, 00000002.00000002.1354974337.0000000002246000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: grpconv.pdbGCTL source: Oogoninia.exe, 00000002.00000002.1354974337.0000000002246000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mshtml.pdb source: Oogoninia.exe, 00000002.00000001.1095360708.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source: Binary string: wntdll.pdbUGP source: Oogoninia.exe, 00000002.00000003.1266200701.0000000032185000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000002.1365528846.00000000324F0000.00000040.00001000.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1269709171.000000003233F000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000002.1365528846.000000003261D000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, 00000009.00000002.2900077757.0000000004D5D000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, 00000009.00000003.1352249094.00000000048C5000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000009.00000003.1355628174.0000000004A7E000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000009.00000002.2900077757.0000000004C30000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: Oogoninia.exe, Oogoninia.exe, 00000002.00000003.1266200701.0000000032185000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000002.1365528846.00000000324F0000.00000040.00001000.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000003.1269709171.000000003233F000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000002.1365528846.000000003261D000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, grpconv.exe, 00000009.00000002.2900077757.0000000004D5D000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, 00000009.00000003.1352249094.00000000048C5000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000009.00000003.1355628174.0000000004A7E000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000009.00000002.2900077757.0000000004C30000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: mshtml.pdbUGP source: Oogoninia.exe, 00000002.00000001.1095360708.0000000000649000.00000020.00000001.01000000.00000006.sdmp

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000000.00000002.1193487825.0000000002E02000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA, 0_2_10001A5D
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 0_2_10002D20 push eax; ret 0_2_10002D4E
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_324F21AD pushad ; retf 0004h 2_2_324F223F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_324F97A1 push es; iretd 2_2_324F97A8
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325208CD push ecx; mov dword ptr [esp], ecx 2_2_325208D6
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Code function: 4_2_0412D01C pushad ; retf 4_2_0412D022
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Code function: 4_2_0412843F push edi; ret 4_2_04128440
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Code function: 4_2_0412D029 pushad ; retf 4_2_0412D036
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Code function: 4_2_0411FC43 push ds; ret 4_2_0411FC44
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Code function: 4_2_0411D901 push 78CA8A45h; iretd 4_2_0411D906
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Code function: 4_2_0411ED5F push edx; retf 4_2_0411ED60
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Code function: 4_2_0412C9B7 push eax; ret 4_2_0412C9B9
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Code function: 4_2_0411E32E push ecx; ret 4_2_0411E32F
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Code function: 4_2_04120BD1 push esp; iretd 4_2_04120BD9
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C3E7CB push cs; retn 0009h 9_2_04C3E7A1
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C3E798 push cs; retn 0009h 9_2_04C3E7A1
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C397A1 push es; iretd 9_2_04C397A8
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C3E7A4 push esp; retn 0009h 9_2_04C3E7A9
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C3E7B8 push ss; ret 9_2_04C3E7C1
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C3E060 push eax; retf 0008h 9_2_04C3E06D
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C3E074 pushfd ; retf 9_2_04C3E075
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C321AD pushad ; retf 0004h 9_2_04C3223F
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C31210 push edx; ret 9_2_04C31216
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C3733B push eax; retf 0004h 9_2_04C3734E
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04C608CD push ecx; mov dword ptr [esp], ecx 9_2_04C608D6
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04B30C1A push edi; ret 9_2_04B30C1B
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04B2841E push ds; ret 9_2_04B2841F
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04B2753A push edx; retf 9_2_04B2753B
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04B30624 pushad ; iretd 9_2_04B3062C
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04B260DC push 78CA8A45h; iretd 9_2_04B260E1
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04B35192 push eax; ret 9_2_04B35194
Source: C:\Windows\SysWOW64\grpconv.exe Code function: 9_2_04B293AC push esp; iretd 9_2_04B293B4
Drops PE files
Source: C:\Users\user\Desktop\Oogoninia.exe File created: C:\Users\user\AppData\Local\Temp\nsqBBFB.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\Oogoninia.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Switches to a custom stack to bypass stack traces
Source: C:\Users\user\Desktop\Oogoninia.exe API/Special instruction interceptor: Address: 30733AC
Source: C:\Users\user\Desktop\Oogoninia.exe API/Special instruction interceptor: Address: 1A533AC
Source: C:\Users\user\Desktop\Oogoninia.exe API/Special instruction interceptor: Address: 7FFEEA0F0594
Source: C:\Users\user\Desktop\Oogoninia.exe API/Special instruction interceptor: Address: 7FFEEA0EFF74
Source: C:\Users\user\Desktop\Oogoninia.exe API/Special instruction interceptor: Address: 7FFEEA0ED6C4
Source: C:\Users\user\Desktop\Oogoninia.exe API/Special instruction interceptor: Address: 7FFEEA0ED864
Source: C:\Windows\SysWOW64\grpconv.exe API/Special instruction interceptor: Address: 7FFEEA0ED144
Source: C:\Windows\SysWOW64\grpconv.exe API/Special instruction interceptor: Address: 7FFEEA0F0594
Source: C:\Windows\SysWOW64\grpconv.exe API/Special instruction interceptor: Address: 7FFEEA0ED764
Source: C:\Windows\SysWOW64\grpconv.exe API/Special instruction interceptor: Address: 7FFEEA0ED324
Source: C:\Windows\SysWOW64\grpconv.exe API/Special instruction interceptor: Address: 7FFEEA0ED364
Source: C:\Windows\SysWOW64\grpconv.exe API/Special instruction interceptor: Address: 7FFEEA0ED004
Source: C:\Windows\SysWOW64\grpconv.exe API/Special instruction interceptor: Address: 7FFEEA0EFF74
Source: C:\Windows\SysWOW64\grpconv.exe API/Special instruction interceptor: Address: 7FFEEA0ED6C4
Source: C:\Windows\SysWOW64\grpconv.exe API/Special instruction interceptor: Address: 7FFEEA0ED864
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32561763 rdtsc 2_2_32561763
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\grpconv.exe Window / User API: threadDelayed 9852 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 882 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 868 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\Oogoninia.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqBBFB.tmp\System.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\Oogoninia.exe API coverage: 0.4 %
Source: C:\Windows\SysWOW64\grpconv.exe API coverage: 1.2 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\grpconv.exe TID: 6904 Thread sleep count: 122 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe TID: 6904 Thread sleep time: -244000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe TID: 6904 Thread sleep count: 9852 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe TID: 6904 Thread sleep time: -19704000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\grpconv.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\grpconv.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 0_2_00405642 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 0_2_00405642
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 0_2_004060A4 FindFirstFileA,FindClose, 0_2_004060A4
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 0_2_0040270B FindFirstFileA, 0_2_0040270B
Source: Oogoninia.exe, 00000002.00000003.1266977009.00000000021D6000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000002.1354263850.00000000021D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2836002415.000000000E073000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2834223466.000000000DDBC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.5986237494.0000000009FC3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.5994248157.000000000E073000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.5992234952.000000000DDBC000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Oogoninia.exe, 00000002.00000002.1354263850.0000000002178000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWh
Source: grpconv.exe, 00000009.00000002.2899155555.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\Oogoninia.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\Oogoninia.exe API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\grpconv.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\grpconv.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32561763 rdtsc 2_2_32561763
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 0_2_00402B0E RegOpenKeyExA,RegEnumKeyA,RegEnumKeyA,RegCloseKey,LdrInitializeThunk,RegCloseKey,RegDeleteKeyA, 0_2_00402B0E
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA, 0_2_10001A5D
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325E124C mov eax, dword ptr fs:[00000030h] 2_2_325E124C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325E124C mov eax, dword ptr fs:[00000030h] 2_2_325E124C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325E124C mov eax, dword ptr fs:[00000030h] 2_2_325E124C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325E124C mov eax, dword ptr fs:[00000030h] 2_2_325E124C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325DF247 mov eax, dword ptr fs:[00000030h] 2_2_325DF247
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254F24A mov eax, dword ptr fs:[00000030h] 2_2_3254F24A
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251B273 mov eax, dword ptr fs:[00000030h] 2_2_3251B273
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251B273 mov eax, dword ptr fs:[00000030h] 2_2_3251B273
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251B273 mov eax, dword ptr fs:[00000030h] 2_2_3251B273
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325B327E mov eax, dword ptr fs:[00000030h] 2_2_325B327E
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325B327E mov eax, dword ptr fs:[00000030h] 2_2_325B327E
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325B327E mov eax, dword ptr fs:[00000030h] 2_2_325B327E
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325B327E mov eax, dword ptr fs:[00000030h] 2_2_325B327E
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325B327E mov eax, dword ptr fs:[00000030h] 2_2_325B327E
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325B327E mov eax, dword ptr fs:[00000030h] 2_2_325B327E
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325DD270 mov eax, dword ptr fs:[00000030h] 2_2_325DD270
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251821B mov eax, dword ptr fs:[00000030h] 2_2_3251821B
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325AB214 mov eax, dword ptr fs:[00000030h] 2_2_325AB214
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325AB214 mov eax, dword ptr fs:[00000030h] 2_2_325AB214
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251A200 mov eax, dword ptr fs:[00000030h] 2_2_3251A200
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32540230 mov ecx, dword ptr fs:[00000030h] 2_2_32540230
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325A0227 mov eax, dword ptr fs:[00000030h] 2_2_325A0227
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325A0227 mov eax, dword ptr fs:[00000030h] 2_2_325A0227
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325A0227 mov eax, dword ptr fs:[00000030h] 2_2_325A0227
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255A22B mov eax, dword ptr fs:[00000030h] 2_2_3255A22B
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255A22B mov eax, dword ptr fs:[00000030h] 2_2_3255A22B
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255A22B mov eax, dword ptr fs:[00000030h] 2_2_3255A22B
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325432C5 mov eax, dword ptr fs:[00000030h] 2_2_325432C5
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325F32C9 mov eax, dword ptr fs:[00000030h] 2_2_325F32C9
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325302F9 mov eax, dword ptr fs:[00000030h] 2_2_325302F9
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325302F9 mov eax, dword ptr fs:[00000030h] 2_2_325302F9
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325302F9 mov eax, dword ptr fs:[00000030h] 2_2_325302F9
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325302F9 mov eax, dword ptr fs:[00000030h] 2_2_325302F9
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325302F9 mov eax, dword ptr fs:[00000030h] 2_2_325302F9
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325302F9 mov eax, dword ptr fs:[00000030h] 2_2_325302F9
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325302F9 mov eax, dword ptr fs:[00000030h] 2_2_325302F9
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325302F9 mov eax, dword ptr fs:[00000030h] 2_2_325302F9
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325172E0 mov eax, dword ptr fs:[00000030h] 2_2_325172E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252A2E0 mov eax, dword ptr fs:[00000030h] 2_2_3252A2E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252A2E0 mov eax, dword ptr fs:[00000030h] 2_2_3252A2E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252A2E0 mov eax, dword ptr fs:[00000030h] 2_2_3252A2E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252A2E0 mov eax, dword ptr fs:[00000030h] 2_2_3252A2E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252A2E0 mov eax, dword ptr fs:[00000030h] 2_2_3252A2E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252A2E0 mov eax, dword ptr fs:[00000030h] 2_2_3252A2E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325282E0 mov eax, dword ptr fs:[00000030h] 2_2_325282E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325282E0 mov eax, dword ptr fs:[00000030h] 2_2_325282E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325282E0 mov eax, dword ptr fs:[00000030h] 2_2_325282E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325282E0 mov eax, dword ptr fs:[00000030h] 2_2_325282E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251D2EC mov eax, dword ptr fs:[00000030h] 2_2_3251D2EC
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251D2EC mov eax, dword ptr fs:[00000030h] 2_2_3251D2EC
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3259E289 mov eax, dword ptr fs:[00000030h] 2_2_3259E289
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251C2B0 mov ecx, dword ptr fs:[00000030h] 2_2_3251C2B0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325FB2BC mov eax, dword ptr fs:[00000030h] 2_2_325FB2BC
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325FB2BC mov eax, dword ptr fs:[00000030h] 2_2_325FB2BC
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325FB2BC mov eax, dword ptr fs:[00000030h] 2_2_325FB2BC
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325FB2BC mov eax, dword ptr fs:[00000030h] 2_2_325FB2BC
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325DF2AE mov eax, dword ptr fs:[00000030h] 2_2_325DF2AE
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325E92AB mov eax, dword ptr fs:[00000030h] 2_2_325E92AB
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325442AF mov eax, dword ptr fs:[00000030h] 2_2_325442AF
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325442AF mov eax, dword ptr fs:[00000030h] 2_2_325442AF
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325192AF mov eax, dword ptr fs:[00000030h] 2_2_325192AF
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255A350 mov eax, dword ptr fs:[00000030h] 2_2_3255A350
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32518347 mov eax, dword ptr fs:[00000030h] 2_2_32518347
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32518347 mov eax, dword ptr fs:[00000030h] 2_2_32518347
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32518347 mov eax, dword ptr fs:[00000030h] 2_2_32518347
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3259E372 mov eax, dword ptr fs:[00000030h] 2_2_3259E372
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3259E372 mov eax, dword ptr fs:[00000030h] 2_2_3259E372
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3259E372 mov eax, dword ptr fs:[00000030h] 2_2_3259E372
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3259E372 mov eax, dword ptr fs:[00000030h] 2_2_3259E372
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325A0371 mov eax, dword ptr fs:[00000030h] 2_2_325A0371
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325A0371 mov eax, dword ptr fs:[00000030h] 2_2_325A0371
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254237A mov eax, dword ptr fs:[00000030h] 2_2_3254237A
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252B360 mov eax, dword ptr fs:[00000030h] 2_2_3252B360
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252B360 mov eax, dword ptr fs:[00000030h] 2_2_3252B360
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252B360 mov eax, dword ptr fs:[00000030h] 2_2_3252B360
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252B360 mov eax, dword ptr fs:[00000030h] 2_2_3252B360
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252B360 mov eax, dword ptr fs:[00000030h] 2_2_3252B360
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252B360 mov eax, dword ptr fs:[00000030h] 2_2_3252B360
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255E363 mov eax, dword ptr fs:[00000030h] 2_2_3255E363
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255E363 mov eax, dword ptr fs:[00000030h] 2_2_3255E363
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255E363 mov eax, dword ptr fs:[00000030h] 2_2_3255E363
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255E363 mov eax, dword ptr fs:[00000030h] 2_2_3255E363
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255E363 mov eax, dword ptr fs:[00000030h] 2_2_3255E363
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255E363 mov eax, dword ptr fs:[00000030h] 2_2_3255E363
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255E363 mov eax, dword ptr fs:[00000030h] 2_2_3255E363
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255E363 mov eax, dword ptr fs:[00000030h] 2_2_3255E363
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3253E310 mov eax, dword ptr fs:[00000030h] 2_2_3253E310
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3253E310 mov eax, dword ptr fs:[00000030h] 2_2_3253E310
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3253E310 mov eax, dword ptr fs:[00000030h] 2_2_3253E310
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32539319 mov eax, dword ptr fs:[00000030h] 2_2_32539319
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255631F mov eax, dword ptr fs:[00000030h] 2_2_3255631F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32519303 mov eax, dword ptr fs:[00000030h] 2_2_32519303
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32519303 mov eax, dword ptr fs:[00000030h] 2_2_32519303
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325A330C mov eax, dword ptr fs:[00000030h] 2_2_325A330C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325A330C mov eax, dword ptr fs:[00000030h] 2_2_325A330C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325A330C mov eax, dword ptr fs:[00000030h] 2_2_325A330C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325A330C mov eax, dword ptr fs:[00000030h] 2_2_325A330C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325DF30A mov eax, dword ptr fs:[00000030h] 2_2_325DF30A
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325F3336 mov eax, dword ptr fs:[00000030h] 2_2_325F3336
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32558322 mov eax, dword ptr fs:[00000030h] 2_2_32558322
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32558322 mov eax, dword ptr fs:[00000030h] 2_2_32558322
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32558322 mov eax, dword ptr fs:[00000030h] 2_2_32558322
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254332D mov eax, dword ptr fs:[00000030h] 2_2_3254332D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251E328 mov eax, dword ptr fs:[00000030h] 2_2_3251E328
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251E328 mov eax, dword ptr fs:[00000030h] 2_2_3251E328
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251E328 mov eax, dword ptr fs:[00000030h] 2_2_3251E328
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325533D0 mov eax, dword ptr fs:[00000030h] 2_2_325533D0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325543D0 mov ecx, dword ptr fs:[00000030h] 2_2_325543D0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325A43D5 mov eax, dword ptr fs:[00000030h] 2_2_325A43D5
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251E3C0 mov eax, dword ptr fs:[00000030h] 2_2_3251E3C0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251E3C0 mov eax, dword ptr fs:[00000030h] 2_2_3251E3C0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251E3C0 mov eax, dword ptr fs:[00000030h] 2_2_3251E3C0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251C3C7 mov eax, dword ptr fs:[00000030h] 2_2_3251C3C7
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325263CB mov eax, dword ptr fs:[00000030h] 2_2_325263CB
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254A390 mov eax, dword ptr fs:[00000030h] 2_2_3254A390
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254A390 mov eax, dword ptr fs:[00000030h] 2_2_3254A390
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254A390 mov eax, dword ptr fs:[00000030h] 2_2_3254A390
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32521380 mov eax, dword ptr fs:[00000030h] 2_2_32521380
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32521380 mov eax, dword ptr fs:[00000030h] 2_2_32521380
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32521380 mov eax, dword ptr fs:[00000030h] 2_2_32521380
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32521380 mov eax, dword ptr fs:[00000030h] 2_2_32521380
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32521380 mov eax, dword ptr fs:[00000030h] 2_2_32521380
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3253F380 mov eax, dword ptr fs:[00000030h] 2_2_3253F380
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3253F380 mov eax, dword ptr fs:[00000030h] 2_2_3253F380
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3253F380 mov eax, dword ptr fs:[00000030h] 2_2_3253F380
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3253F380 mov eax, dword ptr fs:[00000030h] 2_2_3253F380
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3253F380 mov eax, dword ptr fs:[00000030h] 2_2_3253F380
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3253F380 mov eax, dword ptr fs:[00000030h] 2_2_3253F380
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325DF38A mov eax, dword ptr fs:[00000030h] 2_2_325DF38A
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3259C3B0 mov eax, dword ptr fs:[00000030h] 2_2_3259C3B0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325293A6 mov eax, dword ptr fs:[00000030h] 2_2_325293A6
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325293A6 mov eax, dword ptr fs:[00000030h] 2_2_325293A6
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32521051 mov eax, dword ptr fs:[00000030h] 2_2_32521051
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32521051 mov eax, dword ptr fs:[00000030h] 2_2_32521051
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325F505B mov eax, dword ptr fs:[00000030h] 2_2_325F505B
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32550044 mov eax, dword ptr fs:[00000030h] 2_2_32550044
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32527072 mov eax, dword ptr fs:[00000030h] 2_2_32527072
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32526074 mov eax, dword ptr fs:[00000030h] 2_2_32526074
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32526074 mov eax, dword ptr fs:[00000030h] 2_2_32526074
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325C9060 mov eax, dword ptr fs:[00000030h] 2_2_325C9060
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562010 mov ecx, dword ptr fs:[00000030h] 2_2_32562010
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32545004 mov eax, dword ptr fs:[00000030h] 2_2_32545004
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32545004 mov ecx, dword ptr fs:[00000030h] 2_2_32545004
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32528009 mov eax, dword ptr fs:[00000030h] 2_2_32528009
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251D02D mov eax, dword ptr fs:[00000030h] 2_2_3251D02D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3253B0D0 mov eax, dword ptr fs:[00000030h] 2_2_3253B0D0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251B0D6 mov eax, dword ptr fs:[00000030h] 2_2_3251B0D6
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251B0D6 mov eax, dword ptr fs:[00000030h] 2_2_3251B0D6
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251B0D6 mov eax, dword ptr fs:[00000030h] 2_2_3251B0D6
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251B0D6 mov eax, dword ptr fs:[00000030h] 2_2_3251B0D6
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255D0F0 mov eax, dword ptr fs:[00000030h] 2_2_3255D0F0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255D0F0 mov ecx, dword ptr fs:[00000030h] 2_2_3255D0F0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251C0F6 mov eax, dword ptr fs:[00000030h] 2_2_3251C0F6
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325190F8 mov eax, dword ptr fs:[00000030h] 2_2_325190F8
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325190F8 mov eax, dword ptr fs:[00000030h] 2_2_325190F8
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325190F8 mov eax, dword ptr fs:[00000030h] 2_2_325190F8
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325190F8 mov eax, dword ptr fs:[00000030h] 2_2_325190F8
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251C090 mov eax, dword ptr fs:[00000030h] 2_2_3251C090
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251A093 mov ecx, dword ptr fs:[00000030h] 2_2_3251A093
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325F4080 mov eax, dword ptr fs:[00000030h] 2_2_325F4080
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325F4080 mov eax, dword ptr fs:[00000030h] 2_2_325F4080
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325F4080 mov eax, dword ptr fs:[00000030h] 2_2_325F4080
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325F4080 mov eax, dword ptr fs:[00000030h] 2_2_325F4080
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325F4080 mov eax, dword ptr fs:[00000030h] 2_2_325F4080
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325F4080 mov eax, dword ptr fs:[00000030h] 2_2_325F4080
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325F4080 mov eax, dword ptr fs:[00000030h] 2_2_325F4080
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325DB0AF mov eax, dword ptr fs:[00000030h] 2_2_325DB0AF
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325600A5 mov eax, dword ptr fs:[00000030h] 2_2_325600A5
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325F3157 mov eax, dword ptr fs:[00000030h] 2_2_325F3157
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325F3157 mov eax, dword ptr fs:[00000030h] 2_2_325F3157
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325F3157 mov eax, dword ptr fs:[00000030h] 2_2_325F3157
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255415F mov eax, dword ptr fs:[00000030h] 2_2_3255415F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325B314A mov eax, dword ptr fs:[00000030h] 2_2_325B314A
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325B314A mov eax, dword ptr fs:[00000030h] 2_2_325B314A
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325B314A mov eax, dword ptr fs:[00000030h] 2_2_325B314A
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325B314A mov eax, dword ptr fs:[00000030h] 2_2_325B314A
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251A147 mov eax, dword ptr fs:[00000030h] 2_2_3251A147
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251A147 mov eax, dword ptr fs:[00000030h] 2_2_3251A147
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251A147 mov eax, dword ptr fs:[00000030h] 2_2_3251A147
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325F5149 mov eax, dword ptr fs:[00000030h] 2_2_325F5149
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32526179 mov eax, dword ptr fs:[00000030h] 2_2_32526179
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3257717A mov eax, dword ptr fs:[00000030h] 2_2_3257717A
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3257717A mov eax, dword ptr fs:[00000030h] 2_2_3257717A
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255716D mov eax, dword ptr fs:[00000030h] 2_2_3255716D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 mov eax, dword ptr fs:[00000030h] 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 mov eax, dword ptr fs:[00000030h] 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 mov eax, dword ptr fs:[00000030h] 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 mov eax, dword ptr fs:[00000030h] 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 mov eax, dword ptr fs:[00000030h] 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 mov eax, dword ptr fs:[00000030h] 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 mov eax, dword ptr fs:[00000030h] 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 mov eax, dword ptr fs:[00000030h] 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 mov eax, dword ptr fs:[00000030h] 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 mov eax, dword ptr fs:[00000030h] 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 mov eax, dword ptr fs:[00000030h] 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 mov eax, dword ptr fs:[00000030h] 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 mov eax, dword ptr fs:[00000030h] 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 mov eax, dword ptr fs:[00000030h] 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 mov eax, dword ptr fs:[00000030h] 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 mov eax, dword ptr fs:[00000030h] 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 mov eax, dword ptr fs:[00000030h] 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 mov eax, dword ptr fs:[00000030h] 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 mov eax, dword ptr fs:[00000030h] 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 mov eax, dword ptr fs:[00000030h] 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F113 mov eax, dword ptr fs:[00000030h] 2_2_3251F113
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32550118 mov eax, dword ptr fs:[00000030h] 2_2_32550118
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254510F mov eax, dword ptr fs:[00000030h] 2_2_3254510F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254510F mov eax, dword ptr fs:[00000030h] 2_2_3254510F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254510F mov eax, dword ptr fs:[00000030h] 2_2_3254510F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254510F mov eax, dword ptr fs:[00000030h] 2_2_3254510F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254510F mov eax, dword ptr fs:[00000030h] 2_2_3254510F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254510F mov eax, dword ptr fs:[00000030h] 2_2_3254510F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254510F mov eax, dword ptr fs:[00000030h] 2_2_3254510F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254510F mov eax, dword ptr fs:[00000030h] 2_2_3254510F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254510F mov eax, dword ptr fs:[00000030h] 2_2_3254510F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254510F mov eax, dword ptr fs:[00000030h] 2_2_3254510F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254510F mov eax, dword ptr fs:[00000030h] 2_2_3254510F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254510F mov eax, dword ptr fs:[00000030h] 2_2_3254510F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254510F mov eax, dword ptr fs:[00000030h] 2_2_3254510F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252510D mov eax, dword ptr fs:[00000030h] 2_2_3252510D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325DF13E mov eax, dword ptr fs:[00000030h] 2_2_325DF13E
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325AA130 mov eax, dword ptr fs:[00000030h] 2_2_325AA130
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32557128 mov eax, dword ptr fs:[00000030h] 2_2_32557128
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32557128 mov eax, dword ptr fs:[00000030h] 2_2_32557128
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325301C0 mov eax, dword ptr fs:[00000030h] 2_2_325301C0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325301C0 mov eax, dword ptr fs:[00000030h] 2_2_325301C0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325351C0 mov eax, dword ptr fs:[00000030h] 2_2_325351C0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325351C0 mov eax, dword ptr fs:[00000030h] 2_2_325351C0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325351C0 mov eax, dword ptr fs:[00000030h] 2_2_325351C0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325351C0 mov eax, dword ptr fs:[00000030h] 2_2_325351C0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325191F0 mov eax, dword ptr fs:[00000030h] 2_2_325191F0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325191F0 mov eax, dword ptr fs:[00000030h] 2_2_325191F0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325301F1 mov eax, dword ptr fs:[00000030h] 2_2_325301F1
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325301F1 mov eax, dword ptr fs:[00000030h] 2_2_325301F1
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325301F1 mov eax, dword ptr fs:[00000030h] 2_2_325301F1
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254F1F0 mov eax, dword ptr fs:[00000030h] 2_2_3254F1F0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254F1F0 mov eax, dword ptr fs:[00000030h] 2_2_3254F1F0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325E81EE mov eax, dword ptr fs:[00000030h] 2_2_325E81EE
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325E81EE mov eax, dword ptr fs:[00000030h] 2_2_325E81EE
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252A1E3 mov eax, dword ptr fs:[00000030h] 2_2_3252A1E3
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252A1E3 mov eax, dword ptr fs:[00000030h] 2_2_3252A1E3
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252A1E3 mov eax, dword ptr fs:[00000030h] 2_2_3252A1E3
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252A1E3 mov eax, dword ptr fs:[00000030h] 2_2_3252A1E3
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252A1E3 mov eax, dword ptr fs:[00000030h] 2_2_3252A1E3
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254B1E0 mov eax, dword ptr fs:[00000030h] 2_2_3254B1E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254B1E0 mov eax, dword ptr fs:[00000030h] 2_2_3254B1E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254B1E0 mov eax, dword ptr fs:[00000030h] 2_2_3254B1E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254B1E0 mov eax, dword ptr fs:[00000030h] 2_2_3254B1E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254B1E0 mov eax, dword ptr fs:[00000030h] 2_2_3254B1E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254B1E0 mov eax, dword ptr fs:[00000030h] 2_2_3254B1E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254B1E0 mov eax, dword ptr fs:[00000030h] 2_2_3254B1E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325291E5 mov eax, dword ptr fs:[00000030h] 2_2_325291E5
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325291E5 mov eax, dword ptr fs:[00000030h] 2_2_325291E5
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325181EB mov eax, dword ptr fs:[00000030h] 2_2_325181EB
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32549194 mov eax, dword ptr fs:[00000030h] 2_2_32549194
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32561190 mov eax, dword ptr fs:[00000030h] 2_2_32561190
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32561190 mov eax, dword ptr fs:[00000030h] 2_2_32561190
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32524180 mov eax, dword ptr fs:[00000030h] 2_2_32524180
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32524180 mov eax, dword ptr fs:[00000030h] 2_2_32524180
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32524180 mov eax, dword ptr fs:[00000030h] 2_2_32524180
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325F51B6 mov eax, dword ptr fs:[00000030h] 2_2_325F51B6
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325531BE mov eax, dword ptr fs:[00000030h] 2_2_325531BE
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325531BE mov eax, dword ptr fs:[00000030h] 2_2_325531BE
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325541BB mov ecx, dword ptr fs:[00000030h] 2_2_325541BB
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325541BB mov eax, dword ptr fs:[00000030h] 2_2_325541BB
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325541BB mov eax, dword ptr fs:[00000030h] 2_2_325541BB
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255E1A4 mov eax, dword ptr fs:[00000030h] 2_2_3255E1A4
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255E1A4 mov eax, dword ptr fs:[00000030h] 2_2_3255E1A4
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32555654 mov eax, dword ptr fs:[00000030h] 2_2_32555654
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252965A mov eax, dword ptr fs:[00000030h] 2_2_3252965A
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252965A mov eax, dword ptr fs:[00000030h] 2_2_3252965A
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255265C mov eax, dword ptr fs:[00000030h] 2_2_3255265C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255265C mov ecx, dword ptr fs:[00000030h] 2_2_3255265C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255265C mov eax, dword ptr fs:[00000030h] 2_2_3255265C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32523640 mov eax, dword ptr fs:[00000030h] 2_2_32523640
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3253F640 mov eax, dword ptr fs:[00000030h] 2_2_3253F640
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3253F640 mov eax, dword ptr fs:[00000030h] 2_2_3253F640
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3253F640 mov eax, dword ptr fs:[00000030h] 2_2_3253F640
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255C640 mov eax, dword ptr fs:[00000030h] 2_2_3255C640
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255C640 mov eax, dword ptr fs:[00000030h] 2_2_3255C640
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251D64A mov eax, dword ptr fs:[00000030h] 2_2_3251D64A
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251D64A mov eax, dword ptr fs:[00000030h] 2_2_3251D64A
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32520670 mov eax, dword ptr fs:[00000030h] 2_2_32520670
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562670 mov eax, dword ptr fs:[00000030h] 2_2_32562670
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32562670 mov eax, dword ptr fs:[00000030h] 2_2_32562670
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32517662 mov eax, dword ptr fs:[00000030h] 2_2_32517662
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32517662 mov eax, dword ptr fs:[00000030h] 2_2_32517662
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32517662 mov eax, dword ptr fs:[00000030h] 2_2_32517662
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32533660 mov eax, dword ptr fs:[00000030h] 2_2_32533660
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32533660 mov eax, dword ptr fs:[00000030h] 2_2_32533660
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32533660 mov eax, dword ptr fs:[00000030h] 2_2_32533660
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255666D mov esi, dword ptr fs:[00000030h] 2_2_3255666D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255666D mov eax, dword ptr fs:[00000030h] 2_2_3255666D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255666D mov eax, dword ptr fs:[00000030h] 2_2_3255666D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325B3608 mov eax, dword ptr fs:[00000030h] 2_2_325B3608
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325B3608 mov eax, dword ptr fs:[00000030h] 2_2_325B3608
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325B3608 mov eax, dword ptr fs:[00000030h] 2_2_325B3608
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325B3608 mov eax, dword ptr fs:[00000030h] 2_2_325B3608
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325B3608 mov eax, dword ptr fs:[00000030h] 2_2_325B3608
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325B3608 mov eax, dword ptr fs:[00000030h] 2_2_325B3608
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254D600 mov eax, dword ptr fs:[00000030h] 2_2_3254D600
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254D600 mov eax, dword ptr fs:[00000030h] 2_2_3254D600
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325DF607 mov eax, dword ptr fs:[00000030h] 2_2_325DF607
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255360F mov eax, dword ptr fs:[00000030h] 2_2_3255360F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325F4600 mov eax, dword ptr fs:[00000030h] 2_2_325F4600
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32520630 mov eax, dword ptr fs:[00000030h] 2_2_32520630
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32550630 mov eax, dword ptr fs:[00000030h] 2_2_32550630
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325A8633 mov esi, dword ptr fs:[00000030h] 2_2_325A8633
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325A8633 mov eax, dword ptr fs:[00000030h] 2_2_325A8633
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325A8633 mov eax, dword ptr fs:[00000030h] 2_2_325A8633
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255F63F mov eax, dword ptr fs:[00000030h] 2_2_3255F63F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255F63F mov eax, dword ptr fs:[00000030h] 2_2_3255F63F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325CD62C mov ecx, dword ptr fs:[00000030h] 2_2_325CD62C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325CD62C mov ecx, dword ptr fs:[00000030h] 2_2_325CD62C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325CD62C mov eax, dword ptr fs:[00000030h] 2_2_325CD62C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32525622 mov eax, dword ptr fs:[00000030h] 2_2_32525622
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32525622 mov eax, dword ptr fs:[00000030h] 2_2_32525622
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32527623 mov eax, dword ptr fs:[00000030h] 2_2_32527623
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255C620 mov eax, dword ptr fs:[00000030h] 2_2_3255C620
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254D6D0 mov eax, dword ptr fs:[00000030h] 2_2_3254D6D0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325206CF mov eax, dword ptr fs:[00000030h] 2_2_325206CF
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325C86C2 mov eax, dword ptr fs:[00000030h] 2_2_325C86C2
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3259C6F2 mov eax, dword ptr fs:[00000030h] 2_2_3259C6F2
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3259C6F2 mov eax, dword ptr fs:[00000030h] 2_2_3259C6F2
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325196E0 mov eax, dword ptr fs:[00000030h] 2_2_325196E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325196E0 mov eax, dword ptr fs:[00000030h] 2_2_325196E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252C6E0 mov eax, dword ptr fs:[00000030h] 2_2_3252C6E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325256E0 mov eax, dword ptr fs:[00000030h] 2_2_325256E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325256E0 mov eax, dword ptr fs:[00000030h] 2_2_325256E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325256E0 mov eax, dword ptr fs:[00000030h] 2_2_325256E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325466E0 mov eax, dword ptr fs:[00000030h] 2_2_325466E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325466E0 mov eax, dword ptr fs:[00000030h] 2_2_325466E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32528690 mov eax, dword ptr fs:[00000030h] 2_2_32528690
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3259D69D mov eax, dword ptr fs:[00000030h] 2_2_3259D69D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325AC691 mov eax, dword ptr fs:[00000030h] 2_2_325AC691
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325DF68C mov eax, dword ptr fs:[00000030h] 2_2_325DF68C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325E86A8 mov eax, dword ptr fs:[00000030h] 2_2_325E86A8
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325E86A8 mov eax, dword ptr fs:[00000030h] 2_2_325E86A8
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32542755 mov eax, dword ptr fs:[00000030h] 2_2_32542755
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32542755 mov eax, dword ptr fs:[00000030h] 2_2_32542755
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32542755 mov eax, dword ptr fs:[00000030h] 2_2_32542755
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32542755 mov ecx, dword ptr fs:[00000030h] 2_2_32542755
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32542755 mov eax, dword ptr fs:[00000030h] 2_2_32542755
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32542755 mov eax, dword ptr fs:[00000030h] 2_2_32542755
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255A750 mov eax, dword ptr fs:[00000030h] 2_2_3255A750
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F75B mov eax, dword ptr fs:[00000030h] 2_2_3251F75B
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F75B mov eax, dword ptr fs:[00000030h] 2_2_3251F75B
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F75B mov eax, dword ptr fs:[00000030h] 2_2_3251F75B
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F75B mov eax, dword ptr fs:[00000030h] 2_2_3251F75B
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F75B mov eax, dword ptr fs:[00000030h] 2_2_3251F75B
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F75B mov eax, dword ptr fs:[00000030h] 2_2_3251F75B
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F75B mov eax, dword ptr fs:[00000030h] 2_2_3251F75B
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F75B mov eax, dword ptr fs:[00000030h] 2_2_3251F75B
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251F75B mov eax, dword ptr fs:[00000030h] 2_2_3251F75B
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325CE750 mov eax, dword ptr fs:[00000030h] 2_2_325CE750
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32553740 mov eax, dword ptr fs:[00000030h] 2_2_32553740
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255174A mov eax, dword ptr fs:[00000030h] 2_2_3255174A
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32550774 mov eax, dword ptr fs:[00000030h] 2_2_32550774
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32524779 mov eax, dword ptr fs:[00000030h] 2_2_32524779
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32524779 mov eax, dword ptr fs:[00000030h] 2_2_32524779
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32561763 mov eax, dword ptr fs:[00000030h] 2_2_32561763
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32561763 mov eax, dword ptr fs:[00000030h] 2_2_32561763
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32561763 mov eax, dword ptr fs:[00000030h] 2_2_32561763
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32561763 mov eax, dword ptr fs:[00000030h] 2_2_32561763
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32561763 mov eax, dword ptr fs:[00000030h] 2_2_32561763
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32561763 mov eax, dword ptr fs:[00000030h] 2_2_32561763
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252471B mov eax, dword ptr fs:[00000030h] 2_2_3252471B
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252471B mov eax, dword ptr fs:[00000030h] 2_2_3252471B
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325DF717 mov eax, dword ptr fs:[00000030h] 2_2_325DF717
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252D700 mov ecx, dword ptr fs:[00000030h] 2_2_3252D700
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251B705 mov eax, dword ptr fs:[00000030h] 2_2_3251B705
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251B705 mov eax, dword ptr fs:[00000030h] 2_2_3251B705
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251B705 mov eax, dword ptr fs:[00000030h] 2_2_3251B705
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251B705 mov eax, dword ptr fs:[00000030h] 2_2_3251B705
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254270D mov eax, dword ptr fs:[00000030h] 2_2_3254270D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254270D mov eax, dword ptr fs:[00000030h] 2_2_3254270D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254270D mov eax, dword ptr fs:[00000030h] 2_2_3254270D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252170C mov eax, dword ptr fs:[00000030h] 2_2_3252170C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252170C mov eax, dword ptr fs:[00000030h] 2_2_3252170C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252170C mov eax, dword ptr fs:[00000030h] 2_2_3252170C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32523722 mov eax, dword ptr fs:[00000030h] 2_2_32523722
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32523722 mov eax, dword ptr fs:[00000030h] 2_2_32523722
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32549723 mov eax, dword ptr fs:[00000030h] 2_2_32549723
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325DF7CF mov eax, dword ptr fs:[00000030h] 2_2_325DF7CF
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254E7E0 mov eax, dword ptr fs:[00000030h] 2_2_3254E7E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325237E4 mov eax, dword ptr fs:[00000030h] 2_2_325237E4
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325237E4 mov eax, dword ptr fs:[00000030h] 2_2_325237E4
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325237E4 mov eax, dword ptr fs:[00000030h] 2_2_325237E4
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325237E4 mov eax, dword ptr fs:[00000030h] 2_2_325237E4
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325237E4 mov eax, dword ptr fs:[00000030h] 2_2_325237E4
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325237E4 mov eax, dword ptr fs:[00000030h] 2_2_325237E4
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325237E4 mov eax, dword ptr fs:[00000030h] 2_2_325237E4
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32551796 mov eax, dword ptr fs:[00000030h] 2_2_32551796
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32551796 mov eax, dword ptr fs:[00000030h] 2_2_32551796
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3259E79D mov eax, dword ptr fs:[00000030h] 2_2_3259E79D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3259E79D mov eax, dword ptr fs:[00000030h] 2_2_3259E79D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3259E79D mov eax, dword ptr fs:[00000030h] 2_2_3259E79D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3259E79D mov eax, dword ptr fs:[00000030h] 2_2_3259E79D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3259E79D mov eax, dword ptr fs:[00000030h] 2_2_3259E79D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3259E79D mov eax, dword ptr fs:[00000030h] 2_2_3259E79D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3259E79D mov eax, dword ptr fs:[00000030h] 2_2_3259E79D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3259E79D mov eax, dword ptr fs:[00000030h] 2_2_3259E79D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3259E79D mov eax, dword ptr fs:[00000030h] 2_2_3259E79D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325FB781 mov eax, dword ptr fs:[00000030h] 2_2_325FB781
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325FB781 mov eax, dword ptr fs:[00000030h] 2_2_325FB781
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325F17BC mov eax, dword ptr fs:[00000030h] 2_2_325F17BC
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325207A7 mov eax, dword ptr fs:[00000030h] 2_2_325207A7
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325ED7A7 mov eax, dword ptr fs:[00000030h] 2_2_325ED7A7
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325ED7A7 mov eax, dword ptr fs:[00000030h] 2_2_325ED7A7
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325ED7A7 mov eax, dword ptr fs:[00000030h] 2_2_325ED7A7
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255D450 mov eax, dword ptr fs:[00000030h] 2_2_3255D450
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255D450 mov eax, dword ptr fs:[00000030h] 2_2_3255D450
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252D454 mov eax, dword ptr fs:[00000030h] 2_2_3252D454
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252D454 mov eax, dword ptr fs:[00000030h] 2_2_3252D454
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252D454 mov eax, dword ptr fs:[00000030h] 2_2_3252D454
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252D454 mov eax, dword ptr fs:[00000030h] 2_2_3252D454
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252D454 mov eax, dword ptr fs:[00000030h] 2_2_3252D454
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252D454 mov eax, dword ptr fs:[00000030h] 2_2_3252D454
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254E45E mov eax, dword ptr fs:[00000030h] 2_2_3254E45E
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254E45E mov eax, dword ptr fs:[00000030h] 2_2_3254E45E
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254E45E mov eax, dword ptr fs:[00000030h] 2_2_3254E45E
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254E45E mov eax, dword ptr fs:[00000030h] 2_2_3254E45E
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254E45E mov eax, dword ptr fs:[00000030h] 2_2_3254E45E
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32530445 mov eax, dword ptr fs:[00000030h] 2_2_32530445
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32530445 mov eax, dword ptr fs:[00000030h] 2_2_32530445
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32530445 mov eax, dword ptr fs:[00000030h] 2_2_32530445
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32530445 mov eax, dword ptr fs:[00000030h] 2_2_32530445
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32530445 mov eax, dword ptr fs:[00000030h] 2_2_32530445
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32530445 mov eax, dword ptr fs:[00000030h] 2_2_32530445
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32528470 mov eax, dword ptr fs:[00000030h] 2_2_32528470
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32528470 mov eax, dword ptr fs:[00000030h] 2_2_32528470
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325DF478 mov eax, dword ptr fs:[00000030h] 2_2_325DF478
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325EA464 mov eax, dword ptr fs:[00000030h] 2_2_325EA464
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325DF409 mov eax, dword ptr fs:[00000030h] 2_2_325DF409
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325B6400 mov eax, dword ptr fs:[00000030h] 2_2_325B6400
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325B6400 mov eax, dword ptr fs:[00000030h] 2_2_325B6400
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251640D mov eax, dword ptr fs:[00000030h] 2_2_3251640D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32557425 mov eax, dword ptr fs:[00000030h] 2_2_32557425
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32557425 mov ecx, dword ptr fs:[00000030h] 2_2_32557425
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3251B420 mov eax, dword ptr fs:[00000030h] 2_2_3251B420
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325A9429 mov eax, dword ptr fs:[00000030h] 2_2_325A9429
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325AF42F mov eax, dword ptr fs:[00000030h] 2_2_325AF42F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325AF42F mov eax, dword ptr fs:[00000030h] 2_2_325AF42F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325AF42F mov eax, dword ptr fs:[00000030h] 2_2_325AF42F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325AF42F mov eax, dword ptr fs:[00000030h] 2_2_325AF42F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325AF42F mov eax, dword ptr fs:[00000030h] 2_2_325AF42F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254F4D0 mov eax, dword ptr fs:[00000030h] 2_2_3254F4D0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254F4D0 mov eax, dword ptr fs:[00000030h] 2_2_3254F4D0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254F4D0 mov eax, dword ptr fs:[00000030h] 2_2_3254F4D0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254F4D0 mov eax, dword ptr fs:[00000030h] 2_2_3254F4D0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254F4D0 mov eax, dword ptr fs:[00000030h] 2_2_3254F4D0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254F4D0 mov eax, dword ptr fs:[00000030h] 2_2_3254F4D0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254F4D0 mov eax, dword ptr fs:[00000030h] 2_2_3254F4D0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254F4D0 mov eax, dword ptr fs:[00000030h] 2_2_3254F4D0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3254F4D0 mov eax, dword ptr fs:[00000030h] 2_2_3254F4D0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325444D1 mov eax, dword ptr fs:[00000030h] 2_2_325444D1
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325444D1 mov eax, dword ptr fs:[00000030h] 2_2_325444D1
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325414C9 mov eax, dword ptr fs:[00000030h] 2_2_325414C9
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325414C9 mov eax, dword ptr fs:[00000030h] 2_2_325414C9
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325414C9 mov eax, dword ptr fs:[00000030h] 2_2_325414C9
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325414C9 mov eax, dword ptr fs:[00000030h] 2_2_325414C9
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325414C9 mov eax, dword ptr fs:[00000030h] 2_2_325414C9
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325DF4FD mov eax, dword ptr fs:[00000030h] 2_2_325DF4FD
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325264F0 mov eax, dword ptr fs:[00000030h] 2_2_325264F0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255A4F0 mov eax, dword ptr fs:[00000030h] 2_2_3255A4F0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255A4F0 mov eax, dword ptr fs:[00000030h] 2_2_3255A4F0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325494FA mov eax, dword ptr fs:[00000030h] 2_2_325494FA
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325554E0 mov eax, dword ptr fs:[00000030h] 2_2_325554E0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255E4EF mov eax, dword ptr fs:[00000030h] 2_2_3255E4EF
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255E4EF mov eax, dword ptr fs:[00000030h] 2_2_3255E4EF
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255B490 mov eax, dword ptr fs:[00000030h] 2_2_3255B490
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255B490 mov eax, dword ptr fs:[00000030h] 2_2_3255B490
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325AC490 mov eax, dword ptr fs:[00000030h] 2_2_325AC490
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32520485 mov ecx, dword ptr fs:[00000030h] 2_2_32520485
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255648A mov eax, dword ptr fs:[00000030h] 2_2_3255648A
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255648A mov eax, dword ptr fs:[00000030h] 2_2_3255648A
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255648A mov eax, dword ptr fs:[00000030h] 2_2_3255648A
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3255E4BC mov eax, dword ptr fs:[00000030h] 2_2_3255E4BC
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325224A2 mov eax, dword ptr fs:[00000030h] 2_2_325224A2
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325224A2 mov ecx, dword ptr fs:[00000030h] 2_2_325224A2
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325AD4A0 mov ecx, dword ptr fs:[00000030h] 2_2_325AD4A0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325AD4A0 mov eax, dword ptr fs:[00000030h] 2_2_325AD4A0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325AD4A0 mov eax, dword ptr fs:[00000030h] 2_2_325AD4A0
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325544A8 mov eax, dword ptr fs:[00000030h] 2_2_325544A8
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325FB55F mov eax, dword ptr fs:[00000030h] 2_2_325FB55F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325FB55F mov eax, dword ptr fs:[00000030h] 2_2_325FB55F
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325EA553 mov eax, dword ptr fs:[00000030h] 2_2_325EA553
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3253E547 mov eax, dword ptr fs:[00000030h] 2_2_3253E547
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32556540 mov eax, dword ptr fs:[00000030h] 2_2_32556540
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32558540 mov eax, dword ptr fs:[00000030h] 2_2_32558540
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3252254C mov eax, dword ptr fs:[00000030h] 2_2_3252254C
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_3253C560 mov eax, dword ptr fs:[00000030h] 2_2_3253C560
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32541514 mov eax, dword ptr fs:[00000030h] 2_2_32541514
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32541514 mov eax, dword ptr fs:[00000030h] 2_2_32541514
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32541514 mov eax, dword ptr fs:[00000030h] 2_2_32541514
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32541514 mov eax, dword ptr fs:[00000030h] 2_2_32541514
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32541514 mov eax, dword ptr fs:[00000030h] 2_2_32541514
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_32541514 mov eax, dword ptr fs:[00000030h] 2_2_32541514
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325AC51D mov eax, dword ptr fs:[00000030h] 2_2_325AC51D
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 2_2_325CF51B mov eax, dword ptr fs:[00000030h] 2_2_325CF51B

HIPS / PFW / Operating System Protection Evasion
barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Users\user\Desktop\Oogoninia.exe NtSetContextThread: Indirect: 0x32233749 Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe NtQueueApcThread: Indirect: 0x3222F552 Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe NtProtectVirtualMemory: Direct from: 0x7FFEEA0A2651 Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe NtDelayExecution: Direct from: 0x411B8E8 Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe NtProtectVirtualMemory: Direct from: 0x41234E2 Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe NtDelayExecution: Direct from: 0x411B727 Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe NtSuspendThread: Indirect: 0x32233A69 Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe NtResumeThread: Direct from: 0x411B959 Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe NtResumeThread: Indirect: 0x32233D89 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Oogoninia.exe Section loaded: NULL target: C:\Windows\SysWOW64\grpconv.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: read write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\Oogoninia.exe Thread register set: target process: 6496 Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe Thread register set: target process: 6496 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\Oogoninia.exe Thread APC queued: target process: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Oogoninia.exe Process created: C:\Users\user\Desktop\Oogoninia.exe "C:\Users\user\Desktop\Oogoninia.exe" Jump to behavior
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe Process created: C:\Windows\SysWOW64\grpconv.exe "C:\Windows\SysWOW64\grpconv.exe" Jump to behavior
Source: explorer.exe, 0000000F.00000002.5978085761.0000000001339000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.2825363719.0000000001339000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 1Progman3
Source: Oogoninia.exe, 00000002.00000002.1354974337.0000000002246000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FSoftware\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders".lnk%HOMEDRIVE%%HOMEPATH%.pif%USERPROFILE%setup.iniprogman.groupsprogman.onlydesktop.groupsstartup.groupssendto.groupsrecentdocs.groupsSoftware\Microsoft\Windows\CurrentVersionPreConvRenameFilesDeleteFilesRenameFilesSoftware\Microsoft\Windows\CurrentVersion\GrpConv/o-o.grpExceptionReturnHrLogHrFailFast%hs(%u)\%hs!%p: %hs!%p: (caller: %p) %hs(%d) tid(%x) %08X %ws Msg:[%ws] CallContext:[%hs] [%hs(%hs)]
Source: RAVCpl64.exe, 00000004.00000000.1286870284.0000000000DB1000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000004.00000002.5980029495.0000000000DB1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.2826323511.00000000038E0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: RAVCpl64.exe, 00000004.00000000.1286870284.0000000000DB1000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000004.00000002.5980029495.0000000000DB1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.2825907492.0000000001B51000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: RAVCpl64.exe, 00000004.00000000.1286870284.0000000000DB1000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000004.00000002.5980029495.0000000000DB1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.2825907492.0000000001B51000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: RAVCpl64.exe, 00000004.00000000.1286870284.0000000000DB1000.00000002.00000001.00040000.00000000.sdmp, RAVCpl64.exe, 00000004.00000002.5980029495.0000000000DB1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.2825907492.0000000001B51000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Managerj<1
Source: Oogoninia.exe, 00000002.00000002.1354974337.000000000225B000.00000004.00000020.00020000.00000000.sdmp, Oogoninia.exe, 00000002.00000002.1354974337.0000000002246000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FileDescriptionWindows Progman Group Converterh$
Source: C:\Users\user\Desktop\Oogoninia.exe Code function: 0_2_00405DC2 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA, 0_2_00405DC2

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 00000009.00000002.2899878533.0000000004A20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1365396637.00000000321D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2899793805.00000000049D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 00000009.00000002.2899878533.0000000004A20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1365396637.00000000321D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2899793805.00000000049D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1529338 Sample: Oogoninia.exe Startdate: 08/10/2024 Architecture: WINDOWS Score: 96 28 drive.usercontent.google.com 2->28 30 drive.google.com 2->30 38 Malicious sample detected (through community Yara rule) 2->38 40 Multi AV Scanner detection for submitted file 2->40 42 Yara detected FormBook 2->42 44 2 other signatures 2->44 10 Oogoninia.exe 1 511 2->10         started        signatures3 process4 file5 26 C:\Users\user\AppData\Local\...\System.dll, PE32 10->26 dropped 52 Switches to a custom stack to bypass stack traces 10->52 14 Oogoninia.exe 6 10->14         started        signatures6 process7 dnsIp8 32 drive.google.com 142.250.80.78, 443, 49705 GOOGLEUS United States 14->32 34 drive.usercontent.google.com 142.251.40.129, 443, 49706 GOOGLEUS United States 14->34 54 Modifies the context of a thread in another process (thread injection) 14->54 56 Maps a DLL or memory area into another process 14->56 58 Queues an APC in another process (thread injection) 14->58 60 Found direct / indirect Syscall (likely to bypass EDR) 14->60 18 RAVCpl64.exe 14->18 injected signatures9 process10 signatures11 36 Found direct / indirect Syscall (likely to bypass EDR) 18->36 21 grpconv.exe 18->21         started        process12 signatures13 46 Modifies the context of a thread in another process (thread injection) 21->46 48 Maps a DLL or memory area into another process 21->48 50 Switches to a custom stack to bypass stack traces 21->50 24 explorer.exe 68 1 21->24 injected process14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.251.40.129
 drive.usercontent.google.com United States
15169 GOOGLEUS false
142.250.80.78
 drive.google.com United States
15169 GOOGLEUS false

Contacted Domains

Name IP Active
drive.google.com 142.250.80.78 true
drive.usercontent.google.com 142.251.40.129 true