Windows Analysis Report
2998MOD PO.exe

Overview

General Information

Sample name: 2998MOD PO.exe
Analysis ID: 1542414
MD5: eba2ade6a60568538d8b918f65fa2f44
SHA1: fbb6cb7c1c403502560bfe74340b06f31775a7eb
SHA256: 7b70d479034f458a6b695cc3c8aefd50c771ec183b749276aa66d18a6a33466c
Tags: exeuser-threatcat_ch
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
AI detected suspicious sample
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Queues an APC in another process (thread injection)
Sigma detected: Suspicious Creation with Colorcpl
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: 2998MOD PO.exe ReversingLabs: Detection: 68%
Yara detected FormBook
Source: Yara match File source: 4.2.2998MOD PO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.2998MOD PO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.2288704216.0000000004A40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2041194663.00000000018F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2040454369.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2288668245.00000000049F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.3564602723.0000000004DF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.3560962985.0000000002F60000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2042765684.0000000001E20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: 2998MOD PO.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: 2998MOD PO.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 2998MOD PO.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: colorcpl.pdbGCTL source: 2998MOD PO.exe, 00000004.00000002.2040956683.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, sePlrCtAXqpc.exe, 00000007.00000002.3560731508.00000000014D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: colorcpl.pdb source: 2998MOD PO.exe, 00000004.00000002.2040956683.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, sePlrCtAXqpc.exe, 00000007.00000002.3560731508.00000000014D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: sePlrCtAXqpc.exe, 00000007.00000002.3560434817.0000000000DBE000.00000002.00000001.01000000.0000000C.sdmp, sePlrCtAXqpc.exe, 00000009.00000002.3562689546.0000000000DBE000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: wntdll.pdbUGP source: 2998MOD PO.exe, 00000004.00000002.2041370277.0000000001950000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000008.00000003.2043927456.0000000004AD7000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000008.00000002.2288885160.0000000004E1E000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000008.00000003.2041561877.0000000004929000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000008.00000002.2288885160.0000000004C80000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: 2998MOD PO.exe, 2998MOD PO.exe, 00000004.00000002.2041370277.0000000001950000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, colorcpl.exe, 00000008.00000003.2043927456.0000000004AD7000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000008.00000002.2288885160.0000000004E1E000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000008.00000003.2041561877.0000000004929000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000008.00000002.2288885160.0000000004C80000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: SWBp.pdb source: 2998MOD PO.exe
Source: Binary string: SWBp.pdbSHA256Y source: 2998MOD PO.exe
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 4x nop then mov ebx, 00000004h 8_2_04B404E0

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49741 -> 3.33.130.190:80
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 3.33.130.190 3.33.130.190
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AMAZONEXPANSIONGB AMAZONEXPANSIONGB
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /up8i/?Ax=9lO0gd2hrt6dKrz&1b80hL3=FonQAt5G6G0h5a/xcW34pfv7cxcrms3RfG5nxPFgUs1csnhs+lBXewxt89Cj5Voixu7jLVxWB2hHsNPmnpQdsR1nmqFV7MzuwwVkSFycHqtReIUzDRqobl4= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.ladylawher.orgUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0 IceDragon/26.0.0.2
Source: global traffic DNS traffic detected: DNS query: www.ladylawher.org
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: 2998MOD PO.exe, 00000000.00000002.1873899778.0000000006F22000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: colorcpl.exe, 00000008.00000003.2230772392.0000000007FE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: colorcpl.exe, 00000008.00000003.2230772392.0000000007FE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: colorcpl.exe, 00000008.00000003.2230772392.0000000007FE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: colorcpl.exe, 00000008.00000003.2230772392.0000000007FE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: colorcpl.exe, 00000008.00000003.2230772392.0000000007FE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: colorcpl.exe, 00000008.00000003.2230772392.0000000007FE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: colorcpl.exe, 00000008.00000003.2230772392.0000000007FE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: colorcpl.exe, 00000008.00000002.2287863958.0000000002F6B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: colorcpl.exe, 00000008.00000002.2287863958.0000000002F6B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: colorcpl.exe, 00000008.00000002.2287863958.0000000002F6B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: colorcpl.exe, 00000008.00000002.2287863958.0000000002F6B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033/
Source: colorcpl.exe, 00000008.00000002.2287863958.0000000002F6B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: colorcpl.exe, 00000008.00000002.2287863958.0000000002F6B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: colorcpl.exe, 00000008.00000003.2221615291.0000000007FD9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: colorcpl.exe, 00000008.00000003.2230772392.0000000007FE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: colorcpl.exe, 00000008.00000003.2230772392.0000000007FE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 4.2.2998MOD PO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.2998MOD PO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.2288704216.0000000004A40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2041194663.00000000018F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2040454369.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2288668245.00000000049F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.3564602723.0000000004DF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.3560962985.0000000002F60000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2042765684.0000000001E20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Contains functionality to call native functions
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0042C433 NtClose, 4_2_0042C433
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0040A9E3 NtResumeThread, 4_2_0040A9E3
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2B60 NtClose,LdrInitializeThunk, 4_2_019C2B60
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2DF0 NtQuerySystemInformation,LdrInitializeThunk, 4_2_019C2DF0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2C70 NtFreeVirtualMemory,LdrInitializeThunk, 4_2_019C2C70
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C35C0 NtCreateMutant,LdrInitializeThunk, 4_2_019C35C0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C4340 NtSetContextThread, 4_2_019C4340
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C4650 NtSuspendThread, 4_2_019C4650
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2B80 NtQueryInformationFile, 4_2_019C2B80
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2BA0 NtEnumerateValueKey, 4_2_019C2BA0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2BF0 NtAllocateVirtualMemory, 4_2_019C2BF0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2BE0 NtQueryValueKey, 4_2_019C2BE0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2AB0 NtWaitForSingleObject, 4_2_019C2AB0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2AD0 NtReadFile, 4_2_019C2AD0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2AF0 NtWriteFile, 4_2_019C2AF0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2DB0 NtEnumerateKey, 4_2_019C2DB0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2DD0 NtDelayExecution, 4_2_019C2DD0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2D10 NtMapViewOfSection, 4_2_019C2D10
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2D00 NtSetInformationFile, 4_2_019C2D00
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2D30 NtUnmapViewOfSection, 4_2_019C2D30
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2CA0 NtQueryInformationToken, 4_2_019C2CA0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2CC0 NtQueryVirtualMemory, 4_2_019C2CC0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2CF0 NtOpenProcess, 4_2_019C2CF0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2C00 NtQueryInformationProcess, 4_2_019C2C00
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2C60 NtCreateKey, 4_2_019C2C60
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2F90 NtProtectVirtualMemory, 4_2_019C2F90
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2FB0 NtResumeThread, 4_2_019C2FB0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2FA0 NtQuerySection, 4_2_019C2FA0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2FE0 NtCreateFile, 4_2_019C2FE0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2F30 NtCreateSection, 4_2_019C2F30
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2F60 NtCreateProcessEx, 4_2_019C2F60
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2E80 NtReadVirtualMemory, 4_2_019C2E80
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2EA0 NtAdjustPrivilegesToken, 4_2_019C2EA0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2EE0 NtQueueApcThread, 4_2_019C2EE0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2E30 NtWriteVirtualMemory, 4_2_019C2E30
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C3090 NtSetValueKey, 4_2_019C3090
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C3010 NtOpenDirectoryObject, 4_2_019C3010
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C39B0 NtGetContextThread, 4_2_019C39B0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C3D10 NtOpenProcessToken, 4_2_019C3D10
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C3D70 NtOpenThread, 4_2_019C3D70
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF4650 NtSuspendThread,LdrInitializeThunk, 8_2_04CF4650
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF4340 NtSetContextThread,LdrInitializeThunk, 8_2_04CF4340
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2CA0 NtQueryInformationToken,LdrInitializeThunk, 8_2_04CF2CA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2C60 NtCreateKey,LdrInitializeThunk, 8_2_04CF2C60
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2C70 NtFreeVirtualMemory,LdrInitializeThunk, 8_2_04CF2C70
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2DD0 NtDelayExecution,LdrInitializeThunk, 8_2_04CF2DD0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2DF0 NtQuerySystemInformation,LdrInitializeThunk, 8_2_04CF2DF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2D10 NtMapViewOfSection,LdrInitializeThunk, 8_2_04CF2D10
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2D30 NtUnmapViewOfSection,LdrInitializeThunk, 8_2_04CF2D30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2EE0 NtQueueApcThread,LdrInitializeThunk, 8_2_04CF2EE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2E80 NtReadVirtualMemory,LdrInitializeThunk, 8_2_04CF2E80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2FE0 NtCreateFile,LdrInitializeThunk, 8_2_04CF2FE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2FB0 NtResumeThread,LdrInitializeThunk, 8_2_04CF2FB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2F30 NtCreateSection,LdrInitializeThunk, 8_2_04CF2F30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2AD0 NtReadFile,LdrInitializeThunk, 8_2_04CF2AD0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2AF0 NtWriteFile,LdrInitializeThunk, 8_2_04CF2AF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2BE0 NtQueryValueKey,LdrInitializeThunk, 8_2_04CF2BE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 8_2_04CF2BF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2BA0 NtEnumerateValueKey,LdrInitializeThunk, 8_2_04CF2BA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2B60 NtClose,LdrInitializeThunk, 8_2_04CF2B60
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF35C0 NtCreateMutant,LdrInitializeThunk, 8_2_04CF35C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF39B0 NtGetContextThread,LdrInitializeThunk, 8_2_04CF39B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2CC0 NtQueryVirtualMemory, 8_2_04CF2CC0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2CF0 NtOpenProcess, 8_2_04CF2CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2C00 NtQueryInformationProcess, 8_2_04CF2C00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2DB0 NtEnumerateKey, 8_2_04CF2DB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2D00 NtSetInformationFile, 8_2_04CF2D00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2EA0 NtAdjustPrivilegesToken, 8_2_04CF2EA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2E30 NtWriteVirtualMemory, 8_2_04CF2E30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2F90 NtProtectVirtualMemory, 8_2_04CF2F90
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2FA0 NtQuerySection, 8_2_04CF2FA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2F60 NtCreateProcessEx, 8_2_04CF2F60
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2AB0 NtWaitForSingleObject, 8_2_04CF2AB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF2B80 NtQueryInformationFile, 8_2_04CF2B80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF3090 NtSetValueKey, 8_2_04CF3090
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF3010 NtOpenDirectoryObject, 8_2_04CF3010
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF3D70 NtOpenThread, 8_2_04CF3D70
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF3D10 NtOpenProcessToken, 8_2_04CF3D10
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04B4EF7E NtQueryInformationProcess,NtReadVirtualMemory, 8_2_04B4EF7E
Detected potential crypto function
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 0_2_0117D5FC 0_2_0117D5FC
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 0_2_05640F28 0_2_05640F28
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 0_2_056437E1 0_2_056437E1
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 0_2_056437F0 0_2_056437F0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 0_2_05641788 0_2_05641788
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 0_2_05641798 0_2_05641798
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 0_2_05642E40 0_2_05642E40
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 0_2_05642E30 0_2_05642E30
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 0_2_05641360 0_2_05641360
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 0_2_05641350 0_2_05641350
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_004183D3 4_2_004183D3
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_00401110 4_2_00401110
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0040E13B 4_2_0040E13B
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0042EAD3 4_2_0042EAD3
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_00402370 4_2_00402370
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0040FCC3 4_2_0040FCC3
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_00416613 4_2_00416613
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0040FEE3 4_2_0040FEE3
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0040DF63 4_2_0040DF63
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_00402710 4_2_00402710
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_00402FD0 4_2_00402FD0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A441A2 4_2_01A441A2
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A501AA 4_2_01A501AA
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A481CC 4_2_01A481CC
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01980100 4_2_01980100
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2A118 4_2_01A2A118
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A18158 4_2_01A18158
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A22000 4_2_01A22000
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A503E6 4_2_01A503E6
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0199E3F0 4_2_0199E3F0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A4A352 4_2_01A4A352
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A102C0 4_2_01A102C0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A30274 4_2_01A30274
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A50591 4_2_01A50591
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990535 4_2_01990535
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A3E4F6 4_2_01A3E4F6
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A34420 4_2_01A34420
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A42446 4_2_01A42446
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198C7C0 4_2_0198C7C0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B4750 4_2_019B4750
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990770 4_2_01990770
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AC6E0 4_2_019AC6E0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A5A9A6 4_2_01A5A9A6
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019929A0 4_2_019929A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A6962 4_2_019A6962
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019768B8 4_2_019768B8
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BE8F0 4_2_019BE8F0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0199A840 4_2_0199A840
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01992840 4_2_01992840
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A46BD7 4_2_01A46BD7
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A4AB40 4_2_01A4AB40
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198EA80 4_2_0198EA80
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A8DBF 4_2_019A8DBF
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198ADE0 4_2_0198ADE0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0199AD00 4_2_0199AD00
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2CD1F 4_2_01A2CD1F
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A30CB5 4_2_01A30CB5
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01980CF2 4_2_01980CF2
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990C00 4_2_01990C00
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0EFA0 4_2_01A0EFA0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01982FC8 4_2_01982FC8
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A32F30 4_2_01A32F30
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B0F30 4_2_019B0F30
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019D2F28 4_2_019D2F28
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A04F40 4_2_01A04F40
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A2E90 4_2_019A2E90
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A4CE93 4_2_01A4CE93
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A4EEDB 4_2_01A4EEDB
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A4EE26 4_2_01A4EE26
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990E59 4_2_01990E59
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0199B1B0 4_2_0199B1B0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A5B16B 4_2_01A5B16B
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197F172 4_2_0197F172
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C516C 4_2_019C516C
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A4F0E0 4_2_01A4F0E0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A470E9 4_2_01A470E9
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019970C0 4_2_019970C0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A3F0CC 4_2_01A3F0CC
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019D739A 4_2_019D739A
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A4132D 4_2_01A4132D
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197D34C 4_2_0197D34C
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019952A0 4_2_019952A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A312ED 4_2_01A312ED
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AB2C0 4_2_019AB2C0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AD2F0 4_2_019AD2F0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2D5B0 4_2_01A2D5B0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A47571 4_2_01A47571
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A4F43F 4_2_01A4F43F
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01981460 4_2_01981460
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A4F7B0 4_2_01A4F7B0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A416CC 4_2_01A416CC
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019D5630 4_2_019D5630
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A25910 4_2_01A25910
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01999950 4_2_01999950
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AB950 4_2_019AB950
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019938E0 4_2_019938E0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FD800 4_2_019FD800
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AFB80 4_2_019AFB80
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A05BF0 4_2_01A05BF0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019CDBF9 4_2_019CDBF9
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A4FB76 4_2_01A4FB76
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A31AA3 4_2_01A31AA3
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2DAAC 4_2_01A2DAAC
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019D5AA0 4_2_019D5AA0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A3DAC6 4_2_01A3DAC6
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A03A6C 4_2_01A03A6C
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A47A46 4_2_01A47A46
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A4FA49 4_2_01A4FA49
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AFDC0 4_2_019AFDC0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A47D73 4_2_01A47D73
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01993D40 4_2_01993D40
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A41D5A 4_2_01A41D5A
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A4FCF2 4_2_01A4FCF2
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A09C32 4_2_01A09C32
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01991F92 4_2_01991F92
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A4FFB1 4_2_01A4FFB1
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A4FF09 4_2_01A4FF09
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01999EB0 4_2_01999EB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D6E4F6 8_2_04D6E4F6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D72446 8_2_04D72446
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D64420 8_2_04D64420
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D80591 8_2_04D80591
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CC0535 8_2_04CC0535
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CDC6E0 8_2_04CDC6E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CBC7C0 8_2_04CBC7C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CE4750 8_2_04CE4750
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CC0770 8_2_04CC0770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D52000 8_2_04D52000
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D781CC 8_2_04D781CC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D801AA 8_2_04D801AA
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D741A2 8_2_04D741A2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D48158 8_2_04D48158
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CB0100 8_2_04CB0100
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D5A118 8_2_04D5A118
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D402C0 8_2_04D402C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D60274 8_2_04D60274
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CCE3F0 8_2_04CCE3F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D803E6 8_2_04D803E6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D7A352 8_2_04D7A352
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CB0CF2 8_2_04CB0CF2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D60CB5 8_2_04D60CB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CC0C00 8_2_04CC0C00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CBADE0 8_2_04CBADE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CD8DBF 8_2_04CD8DBF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D5CD1F 8_2_04D5CD1F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CCAD00 8_2_04CCAD00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D7EEDB 8_2_04D7EEDB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D7CE93 8_2_04D7CE93
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CD2E90 8_2_04CD2E90
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CC0E59 8_2_04CC0E59
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D7EE26 8_2_04D7EE26
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CB2FC8 8_2_04CB2FC8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D3EFA0 8_2_04D3EFA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D34F40 8_2_04D34F40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D62F30 8_2_04D62F30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D02F28 8_2_04D02F28
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CE0F30 8_2_04CE0F30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CEE8F0 8_2_04CEE8F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CA68B8 8_2_04CA68B8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CCA840 8_2_04CCA840
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CC2840 8_2_04CC2840
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CC29A0 8_2_04CC29A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D8A9A6 8_2_04D8A9A6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CD6962 8_2_04CD6962
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CBEA80 8_2_04CBEA80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D76BD7 8_2_04D76BD7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D7AB40 8_2_04D7AB40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CB1460 8_2_04CB1460
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D7F43F 8_2_04D7F43F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D895C3 8_2_04D895C3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D5D5B0 8_2_04D5D5B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D77571 8_2_04D77571
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D716CC 8_2_04D716CC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D05630 8_2_04D05630
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D7F7B0 8_2_04D7F7B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CC70C0 8_2_04CC70C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D6F0CC 8_2_04D6F0CC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D7F0E0 8_2_04D7F0E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D770E9 8_2_04D770E9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CCB1B0 8_2_04CCB1B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CF516C 8_2_04CF516C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D8B16B 8_2_04D8B16B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CAF172 8_2_04CAF172
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CDB2C0 8_2_04CDB2C0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D612ED 8_2_04D612ED
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CDD2F0 8_2_04CDD2F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CC52A0 8_2_04CC52A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D0739A 8_2_04D0739A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CAD34C 8_2_04CAD34C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D7132D 8_2_04D7132D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D7FCF2 8_2_04D7FCF2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D39C32 8_2_04D39C32
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CDFDC0 8_2_04CDFDC0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CC3D40 8_2_04CC3D40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D71D5A 8_2_04D71D5A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D77D73 8_2_04D77D73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CC9EB0 8_2_04CC9EB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04C83FD2 8_2_04C83FD2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04C83FD5 8_2_04C83FD5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CC1F92 8_2_04CC1F92
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D7FFB1 8_2_04D7FFB1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D7FF09 8_2_04D7FF09
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CC38E0 8_2_04CC38E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D2D800 8_2_04D2D800
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CC9950 8_2_04CC9950
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CDB950 8_2_04CDB950
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D55910 8_2_04D55910
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D6DAC6 8_2_04D6DAC6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D05AA0 8_2_04D05AA0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D61AA3 8_2_04D61AA3
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D5DAAC 8_2_04D5DAAC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D77A46 8_2_04D77A46
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D7FA49 8_2_04D7FA49
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D33A6C 8_2_04D33A6C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D35BF0 8_2_04D35BF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CFDBF9 8_2_04CFDBF9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CDFB80 8_2_04CDFB80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04D7FB76 8_2_04D7FB76
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04B4EF7E 8_2_04B4EF7E
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04B4E75C 8_2_04B4E75C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04B4E2A4 8_2_04B4E2A4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04B4E3C6 8_2_04B4E3C6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04B4D828 8_2_04B4D828
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: String function: 0197B970 appears 262 times
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: String function: 019FEA12 appears 86 times
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: String function: 019C5130 appears 58 times
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: String function: 01A0F290 appears 103 times
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: String function: 019D7E54 appears 99 times
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: String function: 04CF5130 appears 58 times
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: String function: 04CAB970 appears 262 times
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: String function: 04D07E54 appears 107 times
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: String function: 04D3F290 appears 103 times
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: String function: 04D2EA12 appears 86 times
Sample file is different than original file name gathered from version info
Source: 2998MOD PO.exe, 00000000.00000002.1876830848.000000000B5A0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs 2998MOD PO.exe
Source: 2998MOD PO.exe, 00000000.00000000.1704754563.0000000000762000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameSWBp.exeF vs 2998MOD PO.exe
Source: 2998MOD PO.exe, 00000000.00000002.1861503868.0000000000C8E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs 2998MOD PO.exe
Source: 2998MOD PO.exe, 00000004.00000002.2041370277.0000000001A7D000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 2998MOD PO.exe
Source: 2998MOD PO.exe, 00000004.00000002.2040956683.00000000014F7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamecolorcpl.exej% vs 2998MOD PO.exe
Source: 2998MOD PO.exe Binary or memory string: OriginalFilenameSWBp.exeF vs 2998MOD PO.exe
Uses 32bit PE files
Source: 2998MOD PO.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 2998MOD PO.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, hxQAyEPkVUnir0mqK7.cs Security API names: _0020.SetAccessControl
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, hxQAyEPkVUnir0mqK7.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, hxQAyEPkVUnir0mqK7.cs Security API names: _0020.AddAccessRule
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, GuVZeiWWGgyIsVPOZB.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, GuVZeiWWGgyIsVPOZB.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, GuVZeiWWGgyIsVPOZB.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, hxQAyEPkVUnir0mqK7.cs Security API names: _0020.SetAccessControl
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, hxQAyEPkVUnir0mqK7.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, hxQAyEPkVUnir0mqK7.cs Security API names: _0020.AddAccessRule
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, hxQAyEPkVUnir0mqK7.cs Security API names: _0020.SetAccessControl
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, hxQAyEPkVUnir0mqK7.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, hxQAyEPkVUnir0mqK7.cs Security API names: _0020.AddAccessRule
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@9/2@1/1
Source: C:\Users\user\Desktop\2998MOD PO.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2998MOD PO.exe.log Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\colorcpl.exe File created: C:\Users\user\AppData\Local\Temp\Ea64OHKq Jump to behavior
Source: 2998MOD PO.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 2998MOD PO.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\2998MOD PO.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: colorcpl.exe, 00000008.00000002.2287863958.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000008.00000003.2222639581.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000008.00000003.2222496095.0000000002FA7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 2998MOD PO.exe ReversingLabs: Detection: 68%
Source: unknown Process created: C:\Users\user\Desktop\2998MOD PO.exe "C:\Users\user\Desktop\2998MOD PO.exe"
Source: C:\Users\user\Desktop\2998MOD PO.exe Process created: C:\Users\user\Desktop\2998MOD PO.exe "C:\Users\user\Desktop\2998MOD PO.exe"
Source: C:\Users\user\Desktop\2998MOD PO.exe Process created: C:\Users\user\Desktop\2998MOD PO.exe "C:\Users\user\Desktop\2998MOD PO.exe"
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe Process created: C:\Windows\SysWOW64\colorcpl.exe "C:\Windows\SysWOW64\colorcpl.exe"
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\2998MOD PO.exe Process created: C:\Users\user\Desktop\2998MOD PO.exe "C:\Users\user\Desktop\2998MOD PO.exe" Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process created: C:\Users\user\Desktop\2998MOD PO.exe "C:\Users\user\Desktop\2998MOD PO.exe" Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe Process created: C:\Windows\SysWOW64\colorcpl.exe "C:\Windows\SysWOW64\colorcpl.exe" Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: iconcodecservice.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: colorui.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\2998MOD PO.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: 2998MOD PO.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: 2998MOD PO.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: 2998MOD PO.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: colorcpl.pdbGCTL source: 2998MOD PO.exe, 00000004.00000002.2040956683.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, sePlrCtAXqpc.exe, 00000007.00000002.3560731508.00000000014D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: colorcpl.pdb source: 2998MOD PO.exe, 00000004.00000002.2040956683.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, sePlrCtAXqpc.exe, 00000007.00000002.3560731508.00000000014D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: sePlrCtAXqpc.exe, 00000007.00000002.3560434817.0000000000DBE000.00000002.00000001.01000000.0000000C.sdmp, sePlrCtAXqpc.exe, 00000009.00000002.3562689546.0000000000DBE000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: wntdll.pdbUGP source: 2998MOD PO.exe, 00000004.00000002.2041370277.0000000001950000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000008.00000003.2043927456.0000000004AD7000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000008.00000002.2288885160.0000000004E1E000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000008.00000003.2041561877.0000000004929000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000008.00000002.2288885160.0000000004C80000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: 2998MOD PO.exe, 2998MOD PO.exe, 00000004.00000002.2041370277.0000000001950000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, colorcpl.exe, 00000008.00000003.2043927456.0000000004AD7000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000008.00000002.2288885160.0000000004E1E000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000008.00000003.2041561877.0000000004929000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000008.00000002.2288885160.0000000004C80000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: SWBp.pdb source: 2998MOD PO.exe
Source: Binary string: SWBp.pdbSHA256Y source: 2998MOD PO.exe

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, hxQAyEPkVUnir0mqK7.cs .Net Code: TnpYr8bfmj System.Reflection.Assembly.Load(byte[])
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, hxQAyEPkVUnir0mqK7.cs .Net Code: TnpYr8bfmj System.Reflection.Assembly.Load(byte[])
Source: 0.2.2998MOD PO.exe.5400000.2.raw.unpack, Uo.cs .Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, hxQAyEPkVUnir0mqK7.cs .Net Code: TnpYr8bfmj System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 0_2_05648B25 push FFFFFF8Bh; iretd 0_2_05648B27
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_00406155 push ss; retf 4_2_00406160
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_00403270 push eax; ret 4_2_00403272
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0040227F pushad ; retf 4_2_00402280
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0040BB30 push eax; ret 4_2_0040BB31
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_00404DCD push ebx; iretd 4_2_00404DD8
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_004066BD push edx; iretd 4_2_004066BF
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_00413F7E pushad ; retf 4_2_00414025
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_00413FC5 pushad ; retf 4_2_00414025
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019809AD push ecx; mov dword ptr [esp], ecx 4_2_019809B6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04C827FA pushad ; ret 8_2_04C827F9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04C8225F pushad ; ret 8_2_04C827F9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04C8283D push eax; iretd 8_2_04C82858
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04CB09AD push ecx; mov dword ptr [esp], ecx 8_2_04CB09B6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04C8106B push edi; retf 8_2_04C8108A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04C87AAB push ecx; iretd 8_2_04C87ABE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04B4C447 push cs; ret 8_2_04B4C44B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04B4019B pushfd ; iretd 8_2_04B4019C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04B55202 push eax; ret 8_2_04B55204
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04B43D46 pushad ; ret 8_2_04B43D47
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04B4CF48 push ebx; iretd 8_2_04B4CF49
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04B4BBF5 push ecx; ret 8_2_04B4BBF6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 8_2_04B44B06 push edi; iretd 8_2_04B44B07
Source: 2998MOD PO.exe Static PE information: section name: .text entropy: 7.708866164549466
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, Yx0GApFkpsOyylP5i8.cs High entropy of concatenated method names: 'sA2R4ibK34', 'tv1RdkLVgM', 'UXFZDEmtjX', 'URKZ9A06Jg', 'aTiZBUJliv', 'BrRZIM0HI6', 'ejrZb5ZtQ6', 'TWYZO2LRhh', 'EDUZENVdrs', 'l2DZl7rByE'
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, BD0tkRyW0NvFS0Kras.cs High entropy of concatenated method names: 'Ldk3TZ8LQs', 'Dkv3CBQhnb', 'DyfQG8jBBo', 'PJmQAD6PDC', 't5n3LrI8fd', 'BZx3kIeIjZ', 'g0p3gxV9LY', 'pos3JUwNWA', 'lOf3MhhA8g', 'n863cqGgXV'
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, hxQAyEPkVUnir0mqK7.cs High entropy of concatenated method names: 'vcsqj7bqfr', 'uivqv0brPO', 'EwBqH4B36e', 'mjVqZOHhgv', 'qfjqRfwDJk', 'e1Bqxm6JNa', 'nMXqssQLgD', 'nFlqPxrWg1', 'MjlqpYj8Tn', 'CHGqol9Spy'
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, f6ijMJHORTQRhNugqL.cs High entropy of concatenated method names: 'Dispose', 'g9WAKlRnb6', 'XhqVUeR2BV', 'U9vGGhuAMq', 'PPyACj87Kr', 'FScAzneM7v', 'ProcessDialogKey', 'C6GVGjX7Sv', 'jtbVAl4V0t', 'XAeVVB8YJ6'
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, WLiWCAcvwIfxDKCaWi.cs High entropy of concatenated method names: 'ToString', 'igQuLDVyDD', 'kdruUNml9f', 'xjauDtEpHq', 'EgLu93fV1P', 'GCluBUKZmZ', 'oQWuIq4dmV', 'QUhubWyBrw', 'FYWuOUYrsX', 'E4wuEOltyO'
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, kyj87KTr7ScneM7v26.cs High entropy of concatenated method names: 'plCQvxEf01', 'XGaQHXS2hu', 'hm3QZypwaZ', 'aAWQRpvqbc', 'eCoQxjdrmi', 'k7aQsJqiI1', 'a03QPSwyiq', 'bKfQpHlGwW', 'NlwQoeeV4Q', 'dkPQtIBUFL'
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, e7iHOazfdRADLFCyRX.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CbFmeSxOJx', 'wdrm18NP2O', 'WNdmuOfnFQ', 'cs1m38lhVU', 'ceUmQxMkAV', 'PQcmmfOJD5', 'g4emaKE7yJ'
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, WMgNXPg2RPSOrhK9eh.cs High entropy of concatenated method names: 'TjKeW6uuhl', 'JXaeNak938', 'DUfe79wOjP', 'JZBeUGwj6a', 'B8ue90HnLg', 'mOSeBFsg97', 'jdKeb4XNuj', 'fLjeOOlJUe', 'zD1elAbgA7', 'SlBeLQwPAF'
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, TWS96jZxAX3EN502gS.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'NCLVKjoOGe', 'J3aVC65g2J', 'nKvVzcmJkP', 'UdRqGQQncQ', 'ayMqAQjPUp', 'YyuqVjS1j2', 'lq7qqnsDgr', 'AnP8IBzLo4heWACJmJ'
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, yoC8k9AGeE8sgPPbwXA.cs High entropy of concatenated method names: 'QDlmS25Jsq', 'JYumnoZws9', 'poYmr8lGNv', 'IRUm0MaH8k', 'pvUm4ThjHS', 'IMhm2R26Kr', 'NwxmdRDWpi', 'PvWmWnCle1', 'mmhmN6vLPA', 'XtmmF9qsUT'
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, WnrTXVbngDZ3l5EyUi.cs High entropy of concatenated method names: 'C6qsvkEMuJ', 'sU8sZI8ecH', 'vk6sxtLQGc', 'a9QxCfCQsl', 'fyhxzvp9QX', 'TCPsG20i6S', 'BYFsAYwXGd', 'NgnsVYGuNv', 'qbdsqKWHQJ', 'oT5sY5xSq0'
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, GuVZeiWWGgyIsVPOZB.cs High entropy of concatenated method names: 'hF7HJBiPwH', 'j1YHMI118Y', 'ce1Hc5DkQT', 'E0WH8cGuox', 'V0eHhT1jbp', 'weGHyuOcHq', 'qAaH5aie6X', 'x1wHT8S8cr', 'tXoHKdV8qc', 'XUnHCkddwl'
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, J8YJ6nCparoCklRBhk.cs High entropy of concatenated method names: 'OdemAsdVH6', 'dekmq8MPrV', 'bsEmYZtRU9', 'TqKmvaDUWB', 'aoRmHfCoyo', 'tGZmRf2hbN', 'KhymxNdQfB', 'fsyQ55L4Yg', 'FRSQTxesBd', 'QrwQKl5Wh6'
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, e6csmyNd1AuCqsOHuU.cs High entropy of concatenated method names: 'Re7Z0N6w07', 'UClZ2UkCZs', 'tOIZW0hHJL', 'hGAZNw4gA5', 'RUQZ1vdC3o', 'lLoZuloGso', 'DllZ3mHlmy', 'nWaZQemowf', 'dPVZmZW54H', 'JywZa10SRi'
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, R92djQEdSh5jkUnu7Y.cs High entropy of concatenated method names: 'RFgsSkmWxD', 'hyYsnyxpcB', 'qassrl3ws5', 'wv0s047Uua', 'vTQs4muanQ', 'tXTs2Ngl5D', 'Q5psd8PDBQ', 'e2HsWqv4Km', 'BdQsNFIthg', 'sDXsFP8oZ4'
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, ajX7SvKstbl4V0tKAe.cs High entropy of concatenated method names: 'rLcQ7qDm4V', 'MS1QUtK6OX', 'raVQDPtmsg', 'Oc7Q9yZraa', 'pSaQJmcfJD', 'g4kQBFGvtw', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, dBKwEy8HgOOo4pITZv.cs High entropy of concatenated method names: 'Mw23oEYFvY', 'B053t70mF7', 'ToString', 'OD43vQRfgJ', 'Avv3HRtxVQ', 'p9d3ZkxhMN', 'V2s3RMS0bh', 'aef3xgUBxo', 'lYS3s06pnc', 'HXY3Pk76dN'
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, kQ6WtiAqcS5W9tw0Oxs.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'O7DaJuaw7A', 'tgIaMIOEAV', 'rt9acop79a', 'iUMa8VqfaN', 'N0nahGgG28', 'rh4ayENCgB', 'Udxa5rcUTJ'
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, tFIMTA79oCEVXEbenh.cs High entropy of concatenated method names: 'XUTxjK4Woj', 'VVQxHQvYJj', 'WgaxRYJcfy', 'FJbxs3fpwa', 'BwCxPkC0U5', 'Jy2RhO9jMZ', 'ATERypmftS', 'i2cR5upHoM', 'acqRTWjaiw', 'PwPRKJQw9W'
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, xdVRuwVnxyYCMZQs8n.cs High entropy of concatenated method names: 'O5krvD0OT', 'eQO0C377x', 'H1Y25QDcO', 'L3QdwFmTE', 'NZrNynmGt', 'YxOFxuSMM', 'jOOjjlZu3PLatRliU8', 'V58a8IE0CyRCCoJ09h', 'KOdQtuFon', 'K4gamTItu'
Source: 0.2.2998MOD PO.exe.b5a0000.3.raw.unpack, xKPA6QYeUQDw6KZEyv.cs High entropy of concatenated method names: 'YIUAsuVZei', 'DGgAPyIsVP', 'Vd1AoAuCqs', 'MHuAtUCx0G', 'NP5A1i8fFI', 'RTAAu9oCEV', 'n6gmfh5pChGwbgX4pJ', 'jNpIZ2vXCOO8H7Z3o3', 'A1XAA6Ty1v', 'euMAqjvVIi'
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, Yx0GApFkpsOyylP5i8.cs High entropy of concatenated method names: 'sA2R4ibK34', 'tv1RdkLVgM', 'UXFZDEmtjX', 'URKZ9A06Jg', 'aTiZBUJliv', 'BrRZIM0HI6', 'ejrZb5ZtQ6', 'TWYZO2LRhh', 'EDUZENVdrs', 'l2DZl7rByE'
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, BD0tkRyW0NvFS0Kras.cs High entropy of concatenated method names: 'Ldk3TZ8LQs', 'Dkv3CBQhnb', 'DyfQG8jBBo', 'PJmQAD6PDC', 't5n3LrI8fd', 'BZx3kIeIjZ', 'g0p3gxV9LY', 'pos3JUwNWA', 'lOf3MhhA8g', 'n863cqGgXV'
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, hxQAyEPkVUnir0mqK7.cs High entropy of concatenated method names: 'vcsqj7bqfr', 'uivqv0brPO', 'EwBqH4B36e', 'mjVqZOHhgv', 'qfjqRfwDJk', 'e1Bqxm6JNa', 'nMXqssQLgD', 'nFlqPxrWg1', 'MjlqpYj8Tn', 'CHGqol9Spy'
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, f6ijMJHORTQRhNugqL.cs High entropy of concatenated method names: 'Dispose', 'g9WAKlRnb6', 'XhqVUeR2BV', 'U9vGGhuAMq', 'PPyACj87Kr', 'FScAzneM7v', 'ProcessDialogKey', 'C6GVGjX7Sv', 'jtbVAl4V0t', 'XAeVVB8YJ6'
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, WLiWCAcvwIfxDKCaWi.cs High entropy of concatenated method names: 'ToString', 'igQuLDVyDD', 'kdruUNml9f', 'xjauDtEpHq', 'EgLu93fV1P', 'GCluBUKZmZ', 'oQWuIq4dmV', 'QUhubWyBrw', 'FYWuOUYrsX', 'E4wuEOltyO'
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, kyj87KTr7ScneM7v26.cs High entropy of concatenated method names: 'plCQvxEf01', 'XGaQHXS2hu', 'hm3QZypwaZ', 'aAWQRpvqbc', 'eCoQxjdrmi', 'k7aQsJqiI1', 'a03QPSwyiq', 'bKfQpHlGwW', 'NlwQoeeV4Q', 'dkPQtIBUFL'
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, e7iHOazfdRADLFCyRX.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CbFmeSxOJx', 'wdrm18NP2O', 'WNdmuOfnFQ', 'cs1m38lhVU', 'ceUmQxMkAV', 'PQcmmfOJD5', 'g4emaKE7yJ'
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, WMgNXPg2RPSOrhK9eh.cs High entropy of concatenated method names: 'TjKeW6uuhl', 'JXaeNak938', 'DUfe79wOjP', 'JZBeUGwj6a', 'B8ue90HnLg', 'mOSeBFsg97', 'jdKeb4XNuj', 'fLjeOOlJUe', 'zD1elAbgA7', 'SlBeLQwPAF'
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, TWS96jZxAX3EN502gS.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'NCLVKjoOGe', 'J3aVC65g2J', 'nKvVzcmJkP', 'UdRqGQQncQ', 'ayMqAQjPUp', 'YyuqVjS1j2', 'lq7qqnsDgr', 'AnP8IBzLo4heWACJmJ'
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, yoC8k9AGeE8sgPPbwXA.cs High entropy of concatenated method names: 'QDlmS25Jsq', 'JYumnoZws9', 'poYmr8lGNv', 'IRUm0MaH8k', 'pvUm4ThjHS', 'IMhm2R26Kr', 'NwxmdRDWpi', 'PvWmWnCle1', 'mmhmN6vLPA', 'XtmmF9qsUT'
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, WnrTXVbngDZ3l5EyUi.cs High entropy of concatenated method names: 'C6qsvkEMuJ', 'sU8sZI8ecH', 'vk6sxtLQGc', 'a9QxCfCQsl', 'fyhxzvp9QX', 'TCPsG20i6S', 'BYFsAYwXGd', 'NgnsVYGuNv', 'qbdsqKWHQJ', 'oT5sY5xSq0'
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, GuVZeiWWGgyIsVPOZB.cs High entropy of concatenated method names: 'hF7HJBiPwH', 'j1YHMI118Y', 'ce1Hc5DkQT', 'E0WH8cGuox', 'V0eHhT1jbp', 'weGHyuOcHq', 'qAaH5aie6X', 'x1wHT8S8cr', 'tXoHKdV8qc', 'XUnHCkddwl'
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, J8YJ6nCparoCklRBhk.cs High entropy of concatenated method names: 'OdemAsdVH6', 'dekmq8MPrV', 'bsEmYZtRU9', 'TqKmvaDUWB', 'aoRmHfCoyo', 'tGZmRf2hbN', 'KhymxNdQfB', 'fsyQ55L4Yg', 'FRSQTxesBd', 'QrwQKl5Wh6'
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, e6csmyNd1AuCqsOHuU.cs High entropy of concatenated method names: 'Re7Z0N6w07', 'UClZ2UkCZs', 'tOIZW0hHJL', 'hGAZNw4gA5', 'RUQZ1vdC3o', 'lLoZuloGso', 'DllZ3mHlmy', 'nWaZQemowf', 'dPVZmZW54H', 'JywZa10SRi'
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, R92djQEdSh5jkUnu7Y.cs High entropy of concatenated method names: 'RFgsSkmWxD', 'hyYsnyxpcB', 'qassrl3ws5', 'wv0s047Uua', 'vTQs4muanQ', 'tXTs2Ngl5D', 'Q5psd8PDBQ', 'e2HsWqv4Km', 'BdQsNFIthg', 'sDXsFP8oZ4'
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, ajX7SvKstbl4V0tKAe.cs High entropy of concatenated method names: 'rLcQ7qDm4V', 'MS1QUtK6OX', 'raVQDPtmsg', 'Oc7Q9yZraa', 'pSaQJmcfJD', 'g4kQBFGvtw', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, dBKwEy8HgOOo4pITZv.cs High entropy of concatenated method names: 'Mw23oEYFvY', 'B053t70mF7', 'ToString', 'OD43vQRfgJ', 'Avv3HRtxVQ', 'p9d3ZkxhMN', 'V2s3RMS0bh', 'aef3xgUBxo', 'lYS3s06pnc', 'HXY3Pk76dN'
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, kQ6WtiAqcS5W9tw0Oxs.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'O7DaJuaw7A', 'tgIaMIOEAV', 'rt9acop79a', 'iUMa8VqfaN', 'N0nahGgG28', 'rh4ayENCgB', 'Udxa5rcUTJ'
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, tFIMTA79oCEVXEbenh.cs High entropy of concatenated method names: 'XUTxjK4Woj', 'VVQxHQvYJj', 'WgaxRYJcfy', 'FJbxs3fpwa', 'BwCxPkC0U5', 'Jy2RhO9jMZ', 'ATERypmftS', 'i2cR5upHoM', 'acqRTWjaiw', 'PwPRKJQw9W'
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, xdVRuwVnxyYCMZQs8n.cs High entropy of concatenated method names: 'O5krvD0OT', 'eQO0C377x', 'H1Y25QDcO', 'L3QdwFmTE', 'NZrNynmGt', 'YxOFxuSMM', 'jOOjjlZu3PLatRliU8', 'V58a8IE0CyRCCoJ09h', 'KOdQtuFon', 'K4gamTItu'
Source: 0.2.2998MOD PO.exe.45df058.0.raw.unpack, xKPA6QYeUQDw6KZEyv.cs High entropy of concatenated method names: 'YIUAsuVZei', 'DGgAPyIsVP', 'Vd1AoAuCqs', 'MHuAtUCx0G', 'NP5A1i8fFI', 'RTAAu9oCEV', 'n6gmfh5pChGwbgX4pJ', 'jNpIZ2vXCOO8H7Z3o3', 'A1XAA6Ty1v', 'euMAqjvVIi'
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, Yx0GApFkpsOyylP5i8.cs High entropy of concatenated method names: 'sA2R4ibK34', 'tv1RdkLVgM', 'UXFZDEmtjX', 'URKZ9A06Jg', 'aTiZBUJliv', 'BrRZIM0HI6', 'ejrZb5ZtQ6', 'TWYZO2LRhh', 'EDUZENVdrs', 'l2DZl7rByE'
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, BD0tkRyW0NvFS0Kras.cs High entropy of concatenated method names: 'Ldk3TZ8LQs', 'Dkv3CBQhnb', 'DyfQG8jBBo', 'PJmQAD6PDC', 't5n3LrI8fd', 'BZx3kIeIjZ', 'g0p3gxV9LY', 'pos3JUwNWA', 'lOf3MhhA8g', 'n863cqGgXV'
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, hxQAyEPkVUnir0mqK7.cs High entropy of concatenated method names: 'vcsqj7bqfr', 'uivqv0brPO', 'EwBqH4B36e', 'mjVqZOHhgv', 'qfjqRfwDJk', 'e1Bqxm6JNa', 'nMXqssQLgD', 'nFlqPxrWg1', 'MjlqpYj8Tn', 'CHGqol9Spy'
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, f6ijMJHORTQRhNugqL.cs High entropy of concatenated method names: 'Dispose', 'g9WAKlRnb6', 'XhqVUeR2BV', 'U9vGGhuAMq', 'PPyACj87Kr', 'FScAzneM7v', 'ProcessDialogKey', 'C6GVGjX7Sv', 'jtbVAl4V0t', 'XAeVVB8YJ6'
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, WLiWCAcvwIfxDKCaWi.cs High entropy of concatenated method names: 'ToString', 'igQuLDVyDD', 'kdruUNml9f', 'xjauDtEpHq', 'EgLu93fV1P', 'GCluBUKZmZ', 'oQWuIq4dmV', 'QUhubWyBrw', 'FYWuOUYrsX', 'E4wuEOltyO'
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, kyj87KTr7ScneM7v26.cs High entropy of concatenated method names: 'plCQvxEf01', 'XGaQHXS2hu', 'hm3QZypwaZ', 'aAWQRpvqbc', 'eCoQxjdrmi', 'k7aQsJqiI1', 'a03QPSwyiq', 'bKfQpHlGwW', 'NlwQoeeV4Q', 'dkPQtIBUFL'
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, e7iHOazfdRADLFCyRX.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CbFmeSxOJx', 'wdrm18NP2O', 'WNdmuOfnFQ', 'cs1m38lhVU', 'ceUmQxMkAV', 'PQcmmfOJD5', 'g4emaKE7yJ'
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, WMgNXPg2RPSOrhK9eh.cs High entropy of concatenated method names: 'TjKeW6uuhl', 'JXaeNak938', 'DUfe79wOjP', 'JZBeUGwj6a', 'B8ue90HnLg', 'mOSeBFsg97', 'jdKeb4XNuj', 'fLjeOOlJUe', 'zD1elAbgA7', 'SlBeLQwPAF'
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, TWS96jZxAX3EN502gS.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'NCLVKjoOGe', 'J3aVC65g2J', 'nKvVzcmJkP', 'UdRqGQQncQ', 'ayMqAQjPUp', 'YyuqVjS1j2', 'lq7qqnsDgr', 'AnP8IBzLo4heWACJmJ'
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, yoC8k9AGeE8sgPPbwXA.cs High entropy of concatenated method names: 'QDlmS25Jsq', 'JYumnoZws9', 'poYmr8lGNv', 'IRUm0MaH8k', 'pvUm4ThjHS', 'IMhm2R26Kr', 'NwxmdRDWpi', 'PvWmWnCle1', 'mmhmN6vLPA', 'XtmmF9qsUT'
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, WnrTXVbngDZ3l5EyUi.cs High entropy of concatenated method names: 'C6qsvkEMuJ', 'sU8sZI8ecH', 'vk6sxtLQGc', 'a9QxCfCQsl', 'fyhxzvp9QX', 'TCPsG20i6S', 'BYFsAYwXGd', 'NgnsVYGuNv', 'qbdsqKWHQJ', 'oT5sY5xSq0'
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, GuVZeiWWGgyIsVPOZB.cs High entropy of concatenated method names: 'hF7HJBiPwH', 'j1YHMI118Y', 'ce1Hc5DkQT', 'E0WH8cGuox', 'V0eHhT1jbp', 'weGHyuOcHq', 'qAaH5aie6X', 'x1wHT8S8cr', 'tXoHKdV8qc', 'XUnHCkddwl'
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, J8YJ6nCparoCklRBhk.cs High entropy of concatenated method names: 'OdemAsdVH6', 'dekmq8MPrV', 'bsEmYZtRU9', 'TqKmvaDUWB', 'aoRmHfCoyo', 'tGZmRf2hbN', 'KhymxNdQfB', 'fsyQ55L4Yg', 'FRSQTxesBd', 'QrwQKl5Wh6'
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, e6csmyNd1AuCqsOHuU.cs High entropy of concatenated method names: 'Re7Z0N6w07', 'UClZ2UkCZs', 'tOIZW0hHJL', 'hGAZNw4gA5', 'RUQZ1vdC3o', 'lLoZuloGso', 'DllZ3mHlmy', 'nWaZQemowf', 'dPVZmZW54H', 'JywZa10SRi'
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, R92djQEdSh5jkUnu7Y.cs High entropy of concatenated method names: 'RFgsSkmWxD', 'hyYsnyxpcB', 'qassrl3ws5', 'wv0s047Uua', 'vTQs4muanQ', 'tXTs2Ngl5D', 'Q5psd8PDBQ', 'e2HsWqv4Km', 'BdQsNFIthg', 'sDXsFP8oZ4'
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, ajX7SvKstbl4V0tKAe.cs High entropy of concatenated method names: 'rLcQ7qDm4V', 'MS1QUtK6OX', 'raVQDPtmsg', 'Oc7Q9yZraa', 'pSaQJmcfJD', 'g4kQBFGvtw', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, dBKwEy8HgOOo4pITZv.cs High entropy of concatenated method names: 'Mw23oEYFvY', 'B053t70mF7', 'ToString', 'OD43vQRfgJ', 'Avv3HRtxVQ', 'p9d3ZkxhMN', 'V2s3RMS0bh', 'aef3xgUBxo', 'lYS3s06pnc', 'HXY3Pk76dN'
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, kQ6WtiAqcS5W9tw0Oxs.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'O7DaJuaw7A', 'tgIaMIOEAV', 'rt9acop79a', 'iUMa8VqfaN', 'N0nahGgG28', 'rh4ayENCgB', 'Udxa5rcUTJ'
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, tFIMTA79oCEVXEbenh.cs High entropy of concatenated method names: 'XUTxjK4Woj', 'VVQxHQvYJj', 'WgaxRYJcfy', 'FJbxs3fpwa', 'BwCxPkC0U5', 'Jy2RhO9jMZ', 'ATERypmftS', 'i2cR5upHoM', 'acqRTWjaiw', 'PwPRKJQw9W'
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, xdVRuwVnxyYCMZQs8n.cs High entropy of concatenated method names: 'O5krvD0OT', 'eQO0C377x', 'H1Y25QDcO', 'L3QdwFmTE', 'NZrNynmGt', 'YxOFxuSMM', 'jOOjjlZu3PLatRliU8', 'V58a8IE0CyRCCoJ09h', 'KOdQtuFon', 'K4gamTItu'
Source: 0.2.2998MOD PO.exe.4666e78.1.raw.unpack, xKPA6QYeUQDw6KZEyv.cs High entropy of concatenated method names: 'YIUAsuVZei', 'DGgAPyIsVP', 'Vd1AoAuCqs', 'MHuAtUCx0G', 'NP5A1i8fFI', 'RTAAu9oCEV', 'n6gmfh5pChGwbgX4pJ', 'jNpIZ2vXCOO8H7Z3o3', 'A1XAA6Ty1v', 'euMAqjvVIi'
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: 2998MOD PO.exe PID: 7332, type: MEMORYSTR
Switches to a custom stack to bypass stack traces
Source: C:\Windows\SysWOW64\colorcpl.exe API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\colorcpl.exe API/Special instruction interceptor: Address: 7FFE2220D7E4
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\2998MOD PO.exe Memory allocated: 1170000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Memory allocated: 2B10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Memory allocated: 4B10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Memory allocated: 8CC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Memory allocated: 7540000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Memory allocated: 9CC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Memory allocated: ACC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Memory allocated: B630000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Memory allocated: C630000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Memory allocated: D630000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C096E rdtsc 4_2_019C096E
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\2998MOD PO.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\2998MOD PO.exe API coverage: 0.7 %
Source: C:\Windows\SysWOW64\colorcpl.exe API coverage: 1.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\2998MOD PO.exe TID: 7352 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe TID: 7988 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: sePlrCtAXqpc.exe, 00000009.00000002.3562517847.0000000000B1F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllV
Source: colorcpl.exe, 00000008.00000002.2287863958.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllQ(y
Source: C:\Users\user\Desktop\2998MOD PO.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\2998MOD PO.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C096E rdtsc 4_2_019C096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_00417563 LdrLoadDll, 4_2_00417563
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197A197 mov eax, dword ptr fs:[00000030h] 4_2_0197A197
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197A197 mov eax, dword ptr fs:[00000030h] 4_2_0197A197
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197A197 mov eax, dword ptr fs:[00000030h] 4_2_0197A197
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C0185 mov eax, dword ptr fs:[00000030h] 4_2_019C0185
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A24180 mov eax, dword ptr fs:[00000030h] 4_2_01A24180
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A24180 mov eax, dword ptr fs:[00000030h] 4_2_01A24180
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A3C188 mov eax, dword ptr fs:[00000030h] 4_2_01A3C188
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A3C188 mov eax, dword ptr fs:[00000030h] 4_2_01A3C188
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0019F mov eax, dword ptr fs:[00000030h] 4_2_01A0019F
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0019F mov eax, dword ptr fs:[00000030h] 4_2_01A0019F
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0019F mov eax, dword ptr fs:[00000030h] 4_2_01A0019F
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0019F mov eax, dword ptr fs:[00000030h] 4_2_01A0019F
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A561E5 mov eax, dword ptr fs:[00000030h] 4_2_01A561E5
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FE1D0 mov eax, dword ptr fs:[00000030h] 4_2_019FE1D0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FE1D0 mov eax, dword ptr fs:[00000030h] 4_2_019FE1D0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FE1D0 mov ecx, dword ptr fs:[00000030h] 4_2_019FE1D0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FE1D0 mov eax, dword ptr fs:[00000030h] 4_2_019FE1D0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FE1D0 mov eax, dword ptr fs:[00000030h] 4_2_019FE1D0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B01F8 mov eax, dword ptr fs:[00000030h] 4_2_019B01F8
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A461C3 mov eax, dword ptr fs:[00000030h] 4_2_01A461C3
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A461C3 mov eax, dword ptr fs:[00000030h] 4_2_01A461C3
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2E10E mov eax, dword ptr fs:[00000030h] 4_2_01A2E10E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2E10E mov ecx, dword ptr fs:[00000030h] 4_2_01A2E10E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2E10E mov eax, dword ptr fs:[00000030h] 4_2_01A2E10E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2E10E mov eax, dword ptr fs:[00000030h] 4_2_01A2E10E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2E10E mov ecx, dword ptr fs:[00000030h] 4_2_01A2E10E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2E10E mov eax, dword ptr fs:[00000030h] 4_2_01A2E10E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2E10E mov eax, dword ptr fs:[00000030h] 4_2_01A2E10E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2E10E mov ecx, dword ptr fs:[00000030h] 4_2_01A2E10E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2E10E mov eax, dword ptr fs:[00000030h] 4_2_01A2E10E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2E10E mov ecx, dword ptr fs:[00000030h] 4_2_01A2E10E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A40115 mov eax, dword ptr fs:[00000030h] 4_2_01A40115
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2A118 mov ecx, dword ptr fs:[00000030h] 4_2_01A2A118
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2A118 mov eax, dword ptr fs:[00000030h] 4_2_01A2A118
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2A118 mov eax, dword ptr fs:[00000030h] 4_2_01A2A118
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2A118 mov eax, dword ptr fs:[00000030h] 4_2_01A2A118
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B0124 mov eax, dword ptr fs:[00000030h] 4_2_019B0124
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197C156 mov eax, dword ptr fs:[00000030h] 4_2_0197C156
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01986154 mov eax, dword ptr fs:[00000030h] 4_2_01986154
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01986154 mov eax, dword ptr fs:[00000030h] 4_2_01986154
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A14144 mov eax, dword ptr fs:[00000030h] 4_2_01A14144
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A14144 mov eax, dword ptr fs:[00000030h] 4_2_01A14144
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A14144 mov ecx, dword ptr fs:[00000030h] 4_2_01A14144
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A14144 mov eax, dword ptr fs:[00000030h] 4_2_01A14144
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A14144 mov eax, dword ptr fs:[00000030h] 4_2_01A14144
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A18158 mov eax, dword ptr fs:[00000030h] 4_2_01A18158
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A180A8 mov eax, dword ptr fs:[00000030h] 4_2_01A180A8
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198208A mov eax, dword ptr fs:[00000030h] 4_2_0198208A
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A460B8 mov eax, dword ptr fs:[00000030h] 4_2_01A460B8
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A460B8 mov ecx, dword ptr fs:[00000030h] 4_2_01A460B8
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A060E0 mov eax, dword ptr fs:[00000030h] 4_2_01A060E0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197C0F0 mov eax, dword ptr fs:[00000030h] 4_2_0197C0F0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C20F0 mov ecx, dword ptr fs:[00000030h] 4_2_019C20F0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019880E9 mov eax, dword ptr fs:[00000030h] 4_2_019880E9
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197A0E3 mov ecx, dword ptr fs:[00000030h] 4_2_0197A0E3
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A020DE mov eax, dword ptr fs:[00000030h] 4_2_01A020DE
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0199E016 mov eax, dword ptr fs:[00000030h] 4_2_0199E016
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0199E016 mov eax, dword ptr fs:[00000030h] 4_2_0199E016
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0199E016 mov eax, dword ptr fs:[00000030h] 4_2_0199E016
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0199E016 mov eax, dword ptr fs:[00000030h] 4_2_0199E016
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A16030 mov eax, dword ptr fs:[00000030h] 4_2_01A16030
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A04000 mov ecx, dword ptr fs:[00000030h] 4_2_01A04000
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A22000 mov eax, dword ptr fs:[00000030h] 4_2_01A22000
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A22000 mov eax, dword ptr fs:[00000030h] 4_2_01A22000
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A22000 mov eax, dword ptr fs:[00000030h] 4_2_01A22000
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A22000 mov eax, dword ptr fs:[00000030h] 4_2_01A22000
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A22000 mov eax, dword ptr fs:[00000030h] 4_2_01A22000
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A22000 mov eax, dword ptr fs:[00000030h] 4_2_01A22000
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A22000 mov eax, dword ptr fs:[00000030h] 4_2_01A22000
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A22000 mov eax, dword ptr fs:[00000030h] 4_2_01A22000
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197A020 mov eax, dword ptr fs:[00000030h] 4_2_0197A020
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197C020 mov eax, dword ptr fs:[00000030h] 4_2_0197C020
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01982050 mov eax, dword ptr fs:[00000030h] 4_2_01982050
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AC073 mov eax, dword ptr fs:[00000030h] 4_2_019AC073
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A06050 mov eax, dword ptr fs:[00000030h] 4_2_01A06050
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01978397 mov eax, dword ptr fs:[00000030h] 4_2_01978397
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01978397 mov eax, dword ptr fs:[00000030h] 4_2_01978397
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01978397 mov eax, dword ptr fs:[00000030h] 4_2_01978397
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A438F mov eax, dword ptr fs:[00000030h] 4_2_019A438F
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A438F mov eax, dword ptr fs:[00000030h] 4_2_019A438F
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197E388 mov eax, dword ptr fs:[00000030h] 4_2_0197E388
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197E388 mov eax, dword ptr fs:[00000030h] 4_2_0197E388
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197E388 mov eax, dword ptr fs:[00000030h] 4_2_0197E388
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198A3C0 mov eax, dword ptr fs:[00000030h] 4_2_0198A3C0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198A3C0 mov eax, dword ptr fs:[00000030h] 4_2_0198A3C0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198A3C0 mov eax, dword ptr fs:[00000030h] 4_2_0198A3C0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198A3C0 mov eax, dword ptr fs:[00000030h] 4_2_0198A3C0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198A3C0 mov eax, dword ptr fs:[00000030h] 4_2_0198A3C0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198A3C0 mov eax, dword ptr fs:[00000030h] 4_2_0198A3C0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019883C0 mov eax, dword ptr fs:[00000030h] 4_2_019883C0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019883C0 mov eax, dword ptr fs:[00000030h] 4_2_019883C0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019883C0 mov eax, dword ptr fs:[00000030h] 4_2_019883C0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019883C0 mov eax, dword ptr fs:[00000030h] 4_2_019883C0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A063C0 mov eax, dword ptr fs:[00000030h] 4_2_01A063C0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B63FF mov eax, dword ptr fs:[00000030h] 4_2_019B63FF
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0199E3F0 mov eax, dword ptr fs:[00000030h] 4_2_0199E3F0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0199E3F0 mov eax, dword ptr fs:[00000030h] 4_2_0199E3F0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0199E3F0 mov eax, dword ptr fs:[00000030h] 4_2_0199E3F0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A3C3CD mov eax, dword ptr fs:[00000030h] 4_2_01A3C3CD
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019903E9 mov eax, dword ptr fs:[00000030h] 4_2_019903E9
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019903E9 mov eax, dword ptr fs:[00000030h] 4_2_019903E9
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019903E9 mov eax, dword ptr fs:[00000030h] 4_2_019903E9
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019903E9 mov eax, dword ptr fs:[00000030h] 4_2_019903E9
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019903E9 mov eax, dword ptr fs:[00000030h] 4_2_019903E9
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019903E9 mov eax, dword ptr fs:[00000030h] 4_2_019903E9
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019903E9 mov eax, dword ptr fs:[00000030h] 4_2_019903E9
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019903E9 mov eax, dword ptr fs:[00000030h] 4_2_019903E9
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A243D4 mov eax, dword ptr fs:[00000030h] 4_2_01A243D4
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A243D4 mov eax, dword ptr fs:[00000030h] 4_2_01A243D4
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2E3DB mov eax, dword ptr fs:[00000030h] 4_2_01A2E3DB
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2E3DB mov eax, dword ptr fs:[00000030h] 4_2_01A2E3DB
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2E3DB mov ecx, dword ptr fs:[00000030h] 4_2_01A2E3DB
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2E3DB mov eax, dword ptr fs:[00000030h] 4_2_01A2E3DB
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197C310 mov ecx, dword ptr fs:[00000030h] 4_2_0197C310
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A0310 mov ecx, dword ptr fs:[00000030h] 4_2_019A0310
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BA30B mov eax, dword ptr fs:[00000030h] 4_2_019BA30B
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BA30B mov eax, dword ptr fs:[00000030h] 4_2_019BA30B
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BA30B mov eax, dword ptr fs:[00000030h] 4_2_019BA30B
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2437C mov eax, dword ptr fs:[00000030h] 4_2_01A2437C
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A02349 mov eax, dword ptr fs:[00000030h] 4_2_01A02349
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A02349 mov eax, dword ptr fs:[00000030h] 4_2_01A02349
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A02349 mov eax, dword ptr fs:[00000030h] 4_2_01A02349
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A02349 mov eax, dword ptr fs:[00000030h] 4_2_01A02349
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A02349 mov eax, dword ptr fs:[00000030h] 4_2_01A02349
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A02349 mov eax, dword ptr fs:[00000030h] 4_2_01A02349
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A02349 mov eax, dword ptr fs:[00000030h] 4_2_01A02349
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A02349 mov eax, dword ptr fs:[00000030h] 4_2_01A02349
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A02349 mov eax, dword ptr fs:[00000030h] 4_2_01A02349
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A02349 mov eax, dword ptr fs:[00000030h] 4_2_01A02349
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A02349 mov eax, dword ptr fs:[00000030h] 4_2_01A02349
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A02349 mov eax, dword ptr fs:[00000030h] 4_2_01A02349
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A02349 mov eax, dword ptr fs:[00000030h] 4_2_01A02349
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A02349 mov eax, dword ptr fs:[00000030h] 4_2_01A02349
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A02349 mov eax, dword ptr fs:[00000030h] 4_2_01A02349
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A28350 mov ecx, dword ptr fs:[00000030h] 4_2_01A28350
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A4A352 mov eax, dword ptr fs:[00000030h] 4_2_01A4A352
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0035C mov eax, dword ptr fs:[00000030h] 4_2_01A0035C
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0035C mov eax, dword ptr fs:[00000030h] 4_2_01A0035C
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0035C mov eax, dword ptr fs:[00000030h] 4_2_01A0035C
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0035C mov ecx, dword ptr fs:[00000030h] 4_2_01A0035C
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0035C mov eax, dword ptr fs:[00000030h] 4_2_01A0035C
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0035C mov eax, dword ptr fs:[00000030h] 4_2_01A0035C
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A162A0 mov eax, dword ptr fs:[00000030h] 4_2_01A162A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A162A0 mov ecx, dword ptr fs:[00000030h] 4_2_01A162A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A162A0 mov eax, dword ptr fs:[00000030h] 4_2_01A162A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A162A0 mov eax, dword ptr fs:[00000030h] 4_2_01A162A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A162A0 mov eax, dword ptr fs:[00000030h] 4_2_01A162A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A162A0 mov eax, dword ptr fs:[00000030h] 4_2_01A162A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BE284 mov eax, dword ptr fs:[00000030h] 4_2_019BE284
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BE284 mov eax, dword ptr fs:[00000030h] 4_2_019BE284
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A00283 mov eax, dword ptr fs:[00000030h] 4_2_01A00283
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A00283 mov eax, dword ptr fs:[00000030h] 4_2_01A00283
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A00283 mov eax, dword ptr fs:[00000030h] 4_2_01A00283
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019902A0 mov eax, dword ptr fs:[00000030h] 4_2_019902A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019902A0 mov eax, dword ptr fs:[00000030h] 4_2_019902A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198A2C3 mov eax, dword ptr fs:[00000030h] 4_2_0198A2C3
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198A2C3 mov eax, dword ptr fs:[00000030h] 4_2_0198A2C3
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198A2C3 mov eax, dword ptr fs:[00000030h] 4_2_0198A2C3
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198A2C3 mov eax, dword ptr fs:[00000030h] 4_2_0198A2C3
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198A2C3 mov eax, dword ptr fs:[00000030h] 4_2_0198A2C3
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019902E1 mov eax, dword ptr fs:[00000030h] 4_2_019902E1
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019902E1 mov eax, dword ptr fs:[00000030h] 4_2_019902E1
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019902E1 mov eax, dword ptr fs:[00000030h] 4_2_019902E1
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197823B mov eax, dword ptr fs:[00000030h] 4_2_0197823B
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01986259 mov eax, dword ptr fs:[00000030h] 4_2_01986259
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197A250 mov eax, dword ptr fs:[00000030h] 4_2_0197A250
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A30274 mov eax, dword ptr fs:[00000030h] 4_2_01A30274
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A30274 mov eax, dword ptr fs:[00000030h] 4_2_01A30274
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A30274 mov eax, dword ptr fs:[00000030h] 4_2_01A30274
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A30274 mov eax, dword ptr fs:[00000030h] 4_2_01A30274
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A30274 mov eax, dword ptr fs:[00000030h] 4_2_01A30274
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A30274 mov eax, dword ptr fs:[00000030h] 4_2_01A30274
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A30274 mov eax, dword ptr fs:[00000030h] 4_2_01A30274
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A30274 mov eax, dword ptr fs:[00000030h] 4_2_01A30274
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A30274 mov eax, dword ptr fs:[00000030h] 4_2_01A30274
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A30274 mov eax, dword ptr fs:[00000030h] 4_2_01A30274
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A30274 mov eax, dword ptr fs:[00000030h] 4_2_01A30274
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A30274 mov eax, dword ptr fs:[00000030h] 4_2_01A30274
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A08243 mov eax, dword ptr fs:[00000030h] 4_2_01A08243
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A08243 mov ecx, dword ptr fs:[00000030h] 4_2_01A08243
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A3A250 mov eax, dword ptr fs:[00000030h] 4_2_01A3A250
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A3A250 mov eax, dword ptr fs:[00000030h] 4_2_01A3A250
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01984260 mov eax, dword ptr fs:[00000030h] 4_2_01984260
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01984260 mov eax, dword ptr fs:[00000030h] 4_2_01984260
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01984260 mov eax, dword ptr fs:[00000030h] 4_2_01984260
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197826B mov eax, dword ptr fs:[00000030h] 4_2_0197826B
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A005A7 mov eax, dword ptr fs:[00000030h] 4_2_01A005A7
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A005A7 mov eax, dword ptr fs:[00000030h] 4_2_01A005A7
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A005A7 mov eax, dword ptr fs:[00000030h] 4_2_01A005A7
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BE59C mov eax, dword ptr fs:[00000030h] 4_2_019BE59C
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B4588 mov eax, dword ptr fs:[00000030h] 4_2_019B4588
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01982582 mov eax, dword ptr fs:[00000030h] 4_2_01982582
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01982582 mov ecx, dword ptr fs:[00000030h] 4_2_01982582
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A45B1 mov eax, dword ptr fs:[00000030h] 4_2_019A45B1
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A45B1 mov eax, dword ptr fs:[00000030h] 4_2_019A45B1
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019865D0 mov eax, dword ptr fs:[00000030h] 4_2_019865D0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BA5D0 mov eax, dword ptr fs:[00000030h] 4_2_019BA5D0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BA5D0 mov eax, dword ptr fs:[00000030h] 4_2_019BA5D0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BE5CF mov eax, dword ptr fs:[00000030h] 4_2_019BE5CF
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BE5CF mov eax, dword ptr fs:[00000030h] 4_2_019BE5CF
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BC5ED mov eax, dword ptr fs:[00000030h] 4_2_019BC5ED
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BC5ED mov eax, dword ptr fs:[00000030h] 4_2_019BC5ED
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019825E0 mov eax, dword ptr fs:[00000030h] 4_2_019825E0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AE5E7 mov eax, dword ptr fs:[00000030h] 4_2_019AE5E7
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AE5E7 mov eax, dword ptr fs:[00000030h] 4_2_019AE5E7
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AE5E7 mov eax, dword ptr fs:[00000030h] 4_2_019AE5E7
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AE5E7 mov eax, dword ptr fs:[00000030h] 4_2_019AE5E7
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AE5E7 mov eax, dword ptr fs:[00000030h] 4_2_019AE5E7
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AE5E7 mov eax, dword ptr fs:[00000030h] 4_2_019AE5E7
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AE5E7 mov eax, dword ptr fs:[00000030h] 4_2_019AE5E7
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AE5E7 mov eax, dword ptr fs:[00000030h] 4_2_019AE5E7
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A16500 mov eax, dword ptr fs:[00000030h] 4_2_01A16500
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AE53E mov eax, dword ptr fs:[00000030h] 4_2_019AE53E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AE53E mov eax, dword ptr fs:[00000030h] 4_2_019AE53E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AE53E mov eax, dword ptr fs:[00000030h] 4_2_019AE53E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AE53E mov eax, dword ptr fs:[00000030h] 4_2_019AE53E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AE53E mov eax, dword ptr fs:[00000030h] 4_2_019AE53E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A54500 mov eax, dword ptr fs:[00000030h] 4_2_01A54500
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A54500 mov eax, dword ptr fs:[00000030h] 4_2_01A54500
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A54500 mov eax, dword ptr fs:[00000030h] 4_2_01A54500
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A54500 mov eax, dword ptr fs:[00000030h] 4_2_01A54500
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A54500 mov eax, dword ptr fs:[00000030h] 4_2_01A54500
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A54500 mov eax, dword ptr fs:[00000030h] 4_2_01A54500
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A54500 mov eax, dword ptr fs:[00000030h] 4_2_01A54500
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990535 mov eax, dword ptr fs:[00000030h] 4_2_01990535
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990535 mov eax, dword ptr fs:[00000030h] 4_2_01990535
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990535 mov eax, dword ptr fs:[00000030h] 4_2_01990535
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990535 mov eax, dword ptr fs:[00000030h] 4_2_01990535
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990535 mov eax, dword ptr fs:[00000030h] 4_2_01990535
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990535 mov eax, dword ptr fs:[00000030h] 4_2_01990535
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01988550 mov eax, dword ptr fs:[00000030h] 4_2_01988550
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01988550 mov eax, dword ptr fs:[00000030h] 4_2_01988550
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B656A mov eax, dword ptr fs:[00000030h] 4_2_019B656A
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B656A mov eax, dword ptr fs:[00000030h] 4_2_019B656A
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B656A mov eax, dword ptr fs:[00000030h] 4_2_019B656A
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0A4B0 mov eax, dword ptr fs:[00000030h] 4_2_01A0A4B0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B44B0 mov ecx, dword ptr fs:[00000030h] 4_2_019B44B0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019864AB mov eax, dword ptr fs:[00000030h] 4_2_019864AB
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A3A49A mov eax, dword ptr fs:[00000030h] 4_2_01A3A49A
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019804E5 mov ecx, dword ptr fs:[00000030h] 4_2_019804E5
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A06420 mov eax, dword ptr fs:[00000030h] 4_2_01A06420
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A06420 mov eax, dword ptr fs:[00000030h] 4_2_01A06420
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A06420 mov eax, dword ptr fs:[00000030h] 4_2_01A06420
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A06420 mov eax, dword ptr fs:[00000030h] 4_2_01A06420
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A06420 mov eax, dword ptr fs:[00000030h] 4_2_01A06420
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A06420 mov eax, dword ptr fs:[00000030h] 4_2_01A06420
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A06420 mov eax, dword ptr fs:[00000030h] 4_2_01A06420
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B8402 mov eax, dword ptr fs:[00000030h] 4_2_019B8402
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B8402 mov eax, dword ptr fs:[00000030h] 4_2_019B8402
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B8402 mov eax, dword ptr fs:[00000030h] 4_2_019B8402
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197C427 mov eax, dword ptr fs:[00000030h] 4_2_0197C427
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197E420 mov eax, dword ptr fs:[00000030h] 4_2_0197E420
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197E420 mov eax, dword ptr fs:[00000030h] 4_2_0197E420
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197E420 mov eax, dword ptr fs:[00000030h] 4_2_0197E420
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A245A mov eax, dword ptr fs:[00000030h] 4_2_019A245A
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0C460 mov ecx, dword ptr fs:[00000030h] 4_2_01A0C460
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197645D mov eax, dword ptr fs:[00000030h] 4_2_0197645D
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BE443 mov eax, dword ptr fs:[00000030h] 4_2_019BE443
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BE443 mov eax, dword ptr fs:[00000030h] 4_2_019BE443
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BE443 mov eax, dword ptr fs:[00000030h] 4_2_019BE443
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BE443 mov eax, dword ptr fs:[00000030h] 4_2_019BE443
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BE443 mov eax, dword ptr fs:[00000030h] 4_2_019BE443
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BE443 mov eax, dword ptr fs:[00000030h] 4_2_019BE443
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BE443 mov eax, dword ptr fs:[00000030h] 4_2_019BE443
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BE443 mov eax, dword ptr fs:[00000030h] 4_2_019BE443
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AA470 mov eax, dword ptr fs:[00000030h] 4_2_019AA470
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AA470 mov eax, dword ptr fs:[00000030h] 4_2_019AA470
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AA470 mov eax, dword ptr fs:[00000030h] 4_2_019AA470
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A3A456 mov eax, dword ptr fs:[00000030h] 4_2_01A3A456
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A347A0 mov eax, dword ptr fs:[00000030h] 4_2_01A347A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2678E mov eax, dword ptr fs:[00000030h] 4_2_01A2678E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019807AF mov eax, dword ptr fs:[00000030h] 4_2_019807AF
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0E7E1 mov eax, dword ptr fs:[00000030h] 4_2_01A0E7E1
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198C7C0 mov eax, dword ptr fs:[00000030h] 4_2_0198C7C0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019847FB mov eax, dword ptr fs:[00000030h] 4_2_019847FB
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019847FB mov eax, dword ptr fs:[00000030h] 4_2_019847FB
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A007C3 mov eax, dword ptr fs:[00000030h] 4_2_01A007C3
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A27ED mov eax, dword ptr fs:[00000030h] 4_2_019A27ED
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A27ED mov eax, dword ptr fs:[00000030h] 4_2_019A27ED
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A27ED mov eax, dword ptr fs:[00000030h] 4_2_019A27ED
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01980710 mov eax, dword ptr fs:[00000030h] 4_2_01980710
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B0710 mov eax, dword ptr fs:[00000030h] 4_2_019B0710
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BC700 mov eax, dword ptr fs:[00000030h] 4_2_019BC700
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B273C mov eax, dword ptr fs:[00000030h] 4_2_019B273C
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B273C mov ecx, dword ptr fs:[00000030h] 4_2_019B273C
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B273C mov eax, dword ptr fs:[00000030h] 4_2_019B273C
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FC730 mov eax, dword ptr fs:[00000030h] 4_2_019FC730
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BC720 mov eax, dword ptr fs:[00000030h] 4_2_019BC720
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BC720 mov eax, dword ptr fs:[00000030h] 4_2_019BC720
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01980750 mov eax, dword ptr fs:[00000030h] 4_2_01980750
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2750 mov eax, dword ptr fs:[00000030h] 4_2_019C2750
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2750 mov eax, dword ptr fs:[00000030h] 4_2_019C2750
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B674D mov esi, dword ptr fs:[00000030h] 4_2_019B674D
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B674D mov eax, dword ptr fs:[00000030h] 4_2_019B674D
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B674D mov eax, dword ptr fs:[00000030h] 4_2_019B674D
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01988770 mov eax, dword ptr fs:[00000030h] 4_2_01988770
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990770 mov eax, dword ptr fs:[00000030h] 4_2_01990770
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990770 mov eax, dword ptr fs:[00000030h] 4_2_01990770
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990770 mov eax, dword ptr fs:[00000030h] 4_2_01990770
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990770 mov eax, dword ptr fs:[00000030h] 4_2_01990770
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990770 mov eax, dword ptr fs:[00000030h] 4_2_01990770
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990770 mov eax, dword ptr fs:[00000030h] 4_2_01990770
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990770 mov eax, dword ptr fs:[00000030h] 4_2_01990770
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990770 mov eax, dword ptr fs:[00000030h] 4_2_01990770
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990770 mov eax, dword ptr fs:[00000030h] 4_2_01990770
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990770 mov eax, dword ptr fs:[00000030h] 4_2_01990770
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990770 mov eax, dword ptr fs:[00000030h] 4_2_01990770
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990770 mov eax, dword ptr fs:[00000030h] 4_2_01990770
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A04755 mov eax, dword ptr fs:[00000030h] 4_2_01A04755
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0E75D mov eax, dword ptr fs:[00000030h] 4_2_01A0E75D
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01984690 mov eax, dword ptr fs:[00000030h] 4_2_01984690
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01984690 mov eax, dword ptr fs:[00000030h] 4_2_01984690
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B66B0 mov eax, dword ptr fs:[00000030h] 4_2_019B66B0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BC6A6 mov eax, dword ptr fs:[00000030h] 4_2_019BC6A6
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A006F1 mov eax, dword ptr fs:[00000030h] 4_2_01A006F1
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A006F1 mov eax, dword ptr fs:[00000030h] 4_2_01A006F1
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BA6C7 mov ebx, dword ptr fs:[00000030h] 4_2_019BA6C7
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BA6C7 mov eax, dword ptr fs:[00000030h] 4_2_019BA6C7
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FE6F2 mov eax, dword ptr fs:[00000030h] 4_2_019FE6F2
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FE6F2 mov eax, dword ptr fs:[00000030h] 4_2_019FE6F2
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FE6F2 mov eax, dword ptr fs:[00000030h] 4_2_019FE6F2
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FE6F2 mov eax, dword ptr fs:[00000030h] 4_2_019FE6F2
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C2619 mov eax, dword ptr fs:[00000030h] 4_2_019C2619
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0199260B mov eax, dword ptr fs:[00000030h] 4_2_0199260B
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0199260B mov eax, dword ptr fs:[00000030h] 4_2_0199260B
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0199260B mov eax, dword ptr fs:[00000030h] 4_2_0199260B
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0199260B mov eax, dword ptr fs:[00000030h] 4_2_0199260B
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0199260B mov eax, dword ptr fs:[00000030h] 4_2_0199260B
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0199260B mov eax, dword ptr fs:[00000030h] 4_2_0199260B
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0199260B mov eax, dword ptr fs:[00000030h] 4_2_0199260B
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FE609 mov eax, dword ptr fs:[00000030h] 4_2_019FE609
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198262C mov eax, dword ptr fs:[00000030h] 4_2_0198262C
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B6620 mov eax, dword ptr fs:[00000030h] 4_2_019B6620
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B8620 mov eax, dword ptr fs:[00000030h] 4_2_019B8620
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0199E627 mov eax, dword ptr fs:[00000030h] 4_2_0199E627
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A4866E mov eax, dword ptr fs:[00000030h] 4_2_01A4866E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A4866E mov eax, dword ptr fs:[00000030h] 4_2_01A4866E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0199C640 mov eax, dword ptr fs:[00000030h] 4_2_0199C640
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B2674 mov eax, dword ptr fs:[00000030h] 4_2_019B2674
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BA660 mov eax, dword ptr fs:[00000030h] 4_2_019BA660
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BA660 mov eax, dword ptr fs:[00000030h] 4_2_019BA660
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A089B3 mov esi, dword ptr fs:[00000030h] 4_2_01A089B3
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A089B3 mov eax, dword ptr fs:[00000030h] 4_2_01A089B3
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A089B3 mov eax, dword ptr fs:[00000030h] 4_2_01A089B3
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019809AD mov eax, dword ptr fs:[00000030h] 4_2_019809AD
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019809AD mov eax, dword ptr fs:[00000030h] 4_2_019809AD
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019929A0 mov eax, dword ptr fs:[00000030h] 4_2_019929A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019929A0 mov eax, dword ptr fs:[00000030h] 4_2_019929A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019929A0 mov eax, dword ptr fs:[00000030h] 4_2_019929A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019929A0 mov eax, dword ptr fs:[00000030h] 4_2_019929A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019929A0 mov eax, dword ptr fs:[00000030h] 4_2_019929A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019929A0 mov eax, dword ptr fs:[00000030h] 4_2_019929A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019929A0 mov eax, dword ptr fs:[00000030h] 4_2_019929A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019929A0 mov eax, dword ptr fs:[00000030h] 4_2_019929A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019929A0 mov eax, dword ptr fs:[00000030h] 4_2_019929A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019929A0 mov eax, dword ptr fs:[00000030h] 4_2_019929A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019929A0 mov eax, dword ptr fs:[00000030h] 4_2_019929A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019929A0 mov eax, dword ptr fs:[00000030h] 4_2_019929A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019929A0 mov eax, dword ptr fs:[00000030h] 4_2_019929A0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0E9E0 mov eax, dword ptr fs:[00000030h] 4_2_01A0E9E0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198A9D0 mov eax, dword ptr fs:[00000030h] 4_2_0198A9D0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198A9D0 mov eax, dword ptr fs:[00000030h] 4_2_0198A9D0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198A9D0 mov eax, dword ptr fs:[00000030h] 4_2_0198A9D0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198A9D0 mov eax, dword ptr fs:[00000030h] 4_2_0198A9D0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198A9D0 mov eax, dword ptr fs:[00000030h] 4_2_0198A9D0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198A9D0 mov eax, dword ptr fs:[00000030h] 4_2_0198A9D0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B49D0 mov eax, dword ptr fs:[00000030h] 4_2_019B49D0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A169C0 mov eax, dword ptr fs:[00000030h] 4_2_01A169C0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B29F9 mov eax, dword ptr fs:[00000030h] 4_2_019B29F9
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B29F9 mov eax, dword ptr fs:[00000030h] 4_2_019B29F9
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A4A9D3 mov eax, dword ptr fs:[00000030h] 4_2_01A4A9D3
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0892A mov eax, dword ptr fs:[00000030h] 4_2_01A0892A
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A1892B mov eax, dword ptr fs:[00000030h] 4_2_01A1892B
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01978918 mov eax, dword ptr fs:[00000030h] 4_2_01978918
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01978918 mov eax, dword ptr fs:[00000030h] 4_2_01978918
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FE908 mov eax, dword ptr fs:[00000030h] 4_2_019FE908
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FE908 mov eax, dword ptr fs:[00000030h] 4_2_019FE908
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0C912 mov eax, dword ptr fs:[00000030h] 4_2_01A0C912
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A24978 mov eax, dword ptr fs:[00000030h] 4_2_01A24978
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A24978 mov eax, dword ptr fs:[00000030h] 4_2_01A24978
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0C97C mov eax, dword ptr fs:[00000030h] 4_2_01A0C97C
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A00946 mov eax, dword ptr fs:[00000030h] 4_2_01A00946
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C096E mov eax, dword ptr fs:[00000030h] 4_2_019C096E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C096E mov edx, dword ptr fs:[00000030h] 4_2_019C096E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019C096E mov eax, dword ptr fs:[00000030h] 4_2_019C096E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A6962 mov eax, dword ptr fs:[00000030h] 4_2_019A6962
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A6962 mov eax, dword ptr fs:[00000030h] 4_2_019A6962
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A6962 mov eax, dword ptr fs:[00000030h] 4_2_019A6962
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01980887 mov eax, dword ptr fs:[00000030h] 4_2_01980887
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0C89D mov eax, dword ptr fs:[00000030h] 4_2_01A0C89D
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A4A8E4 mov eax, dword ptr fs:[00000030h] 4_2_01A4A8E4
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AE8C0 mov eax, dword ptr fs:[00000030h] 4_2_019AE8C0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BC8F9 mov eax, dword ptr fs:[00000030h] 4_2_019BC8F9
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BC8F9 mov eax, dword ptr fs:[00000030h] 4_2_019BC8F9
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A508C0 mov eax, dword ptr fs:[00000030h] 4_2_01A508C0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2483A mov eax, dword ptr fs:[00000030h] 4_2_01A2483A
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2483A mov eax, dword ptr fs:[00000030h] 4_2_01A2483A
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BA830 mov eax, dword ptr fs:[00000030h] 4_2_019BA830
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A2835 mov eax, dword ptr fs:[00000030h] 4_2_019A2835
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A2835 mov eax, dword ptr fs:[00000030h] 4_2_019A2835
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A2835 mov eax, dword ptr fs:[00000030h] 4_2_019A2835
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A2835 mov ecx, dword ptr fs:[00000030h] 4_2_019A2835
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A2835 mov eax, dword ptr fs:[00000030h] 4_2_019A2835
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A2835 mov eax, dword ptr fs:[00000030h] 4_2_019A2835
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0C810 mov eax, dword ptr fs:[00000030h] 4_2_01A0C810
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01984859 mov eax, dword ptr fs:[00000030h] 4_2_01984859
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01984859 mov eax, dword ptr fs:[00000030h] 4_2_01984859
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B0854 mov eax, dword ptr fs:[00000030h] 4_2_019B0854
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A16870 mov eax, dword ptr fs:[00000030h] 4_2_01A16870
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A16870 mov eax, dword ptr fs:[00000030h] 4_2_01A16870
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0E872 mov eax, dword ptr fs:[00000030h] 4_2_01A0E872
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0E872 mov eax, dword ptr fs:[00000030h] 4_2_01A0E872
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01992840 mov ecx, dword ptr fs:[00000030h] 4_2_01992840
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A34BB0 mov eax, dword ptr fs:[00000030h] 4_2_01A34BB0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A34BB0 mov eax, dword ptr fs:[00000030h] 4_2_01A34BB0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990BBE mov eax, dword ptr fs:[00000030h] 4_2_01990BBE
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990BBE mov eax, dword ptr fs:[00000030h] 4_2_01990BBE
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0CBF0 mov eax, dword ptr fs:[00000030h] 4_2_01A0CBF0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A0BCB mov eax, dword ptr fs:[00000030h] 4_2_019A0BCB
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A0BCB mov eax, dword ptr fs:[00000030h] 4_2_019A0BCB
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A0BCB mov eax, dword ptr fs:[00000030h] 4_2_019A0BCB
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01980BCD mov eax, dword ptr fs:[00000030h] 4_2_01980BCD
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01980BCD mov eax, dword ptr fs:[00000030h] 4_2_01980BCD
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01980BCD mov eax, dword ptr fs:[00000030h] 4_2_01980BCD
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AEBFC mov eax, dword ptr fs:[00000030h] 4_2_019AEBFC
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01988BF0 mov eax, dword ptr fs:[00000030h] 4_2_01988BF0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01988BF0 mov eax, dword ptr fs:[00000030h] 4_2_01988BF0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01988BF0 mov eax, dword ptr fs:[00000030h] 4_2_01988BF0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2EBD0 mov eax, dword ptr fs:[00000030h] 4_2_01A2EBD0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FEB1D mov eax, dword ptr fs:[00000030h] 4_2_019FEB1D
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FEB1D mov eax, dword ptr fs:[00000030h] 4_2_019FEB1D
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FEB1D mov eax, dword ptr fs:[00000030h] 4_2_019FEB1D
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FEB1D mov eax, dword ptr fs:[00000030h] 4_2_019FEB1D
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FEB1D mov eax, dword ptr fs:[00000030h] 4_2_019FEB1D
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FEB1D mov eax, dword ptr fs:[00000030h] 4_2_019FEB1D
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FEB1D mov eax, dword ptr fs:[00000030h] 4_2_019FEB1D
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FEB1D mov eax, dword ptr fs:[00000030h] 4_2_019FEB1D
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FEB1D mov eax, dword ptr fs:[00000030h] 4_2_019FEB1D
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A48B28 mov eax, dword ptr fs:[00000030h] 4_2_01A48B28
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A48B28 mov eax, dword ptr fs:[00000030h] 4_2_01A48B28
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AEB20 mov eax, dword ptr fs:[00000030h] 4_2_019AEB20
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AEB20 mov eax, dword ptr fs:[00000030h] 4_2_019AEB20
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A28B42 mov eax, dword ptr fs:[00000030h] 4_2_01A28B42
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A16B40 mov eax, dword ptr fs:[00000030h] 4_2_01A16B40
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A16B40 mov eax, dword ptr fs:[00000030h] 4_2_01A16B40
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A4AB40 mov eax, dword ptr fs:[00000030h] 4_2_01A4AB40
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A34B4B mov eax, dword ptr fs:[00000030h] 4_2_01A34B4B
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A34B4B mov eax, dword ptr fs:[00000030h] 4_2_01A34B4B
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0197CB7E mov eax, dword ptr fs:[00000030h] 4_2_0197CB7E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2EB50 mov eax, dword ptr fs:[00000030h] 4_2_01A2EB50
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B8A90 mov edx, dword ptr fs:[00000030h] 4_2_019B8A90
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198EA80 mov eax, dword ptr fs:[00000030h] 4_2_0198EA80
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198EA80 mov eax, dword ptr fs:[00000030h] 4_2_0198EA80
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198EA80 mov eax, dword ptr fs:[00000030h] 4_2_0198EA80
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198EA80 mov eax, dword ptr fs:[00000030h] 4_2_0198EA80
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198EA80 mov eax, dword ptr fs:[00000030h] 4_2_0198EA80
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198EA80 mov eax, dword ptr fs:[00000030h] 4_2_0198EA80
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198EA80 mov eax, dword ptr fs:[00000030h] 4_2_0198EA80
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198EA80 mov eax, dword ptr fs:[00000030h] 4_2_0198EA80
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_0198EA80 mov eax, dword ptr fs:[00000030h] 4_2_0198EA80
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A54A80 mov eax, dword ptr fs:[00000030h] 4_2_01A54A80
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01988AA0 mov eax, dword ptr fs:[00000030h] 4_2_01988AA0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01988AA0 mov eax, dword ptr fs:[00000030h] 4_2_01988AA0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019D6AA4 mov eax, dword ptr fs:[00000030h] 4_2_019D6AA4
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01980AD0 mov eax, dword ptr fs:[00000030h] 4_2_01980AD0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B4AD0 mov eax, dword ptr fs:[00000030h] 4_2_019B4AD0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019B4AD0 mov eax, dword ptr fs:[00000030h] 4_2_019B4AD0
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019D6ACC mov eax, dword ptr fs:[00000030h] 4_2_019D6ACC
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019D6ACC mov eax, dword ptr fs:[00000030h] 4_2_019D6ACC
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019D6ACC mov eax, dword ptr fs:[00000030h] 4_2_019D6ACC
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BAAEE mov eax, dword ptr fs:[00000030h] 4_2_019BAAEE
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BAAEE mov eax, dword ptr fs:[00000030h] 4_2_019BAAEE
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A4A35 mov eax, dword ptr fs:[00000030h] 4_2_019A4A35
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A4A35 mov eax, dword ptr fs:[00000030h] 4_2_019A4A35
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A0CA11 mov eax, dword ptr fs:[00000030h] 4_2_01A0CA11
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019AEA2E mov eax, dword ptr fs:[00000030h] 4_2_019AEA2E
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BCA24 mov eax, dword ptr fs:[00000030h] 4_2_019BCA24
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990A5B mov eax, dword ptr fs:[00000030h] 4_2_01990A5B
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01990A5B mov eax, dword ptr fs:[00000030h] 4_2_01990A5B
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A2EA60 mov eax, dword ptr fs:[00000030h] 4_2_01A2EA60
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01986A50 mov eax, dword ptr fs:[00000030h] 4_2_01986A50
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01986A50 mov eax, dword ptr fs:[00000030h] 4_2_01986A50
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01986A50 mov eax, dword ptr fs:[00000030h] 4_2_01986A50
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01986A50 mov eax, dword ptr fs:[00000030h] 4_2_01986A50
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01986A50 mov eax, dword ptr fs:[00000030h] 4_2_01986A50
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01986A50 mov eax, dword ptr fs:[00000030h] 4_2_01986A50
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01986A50 mov eax, dword ptr fs:[00000030h] 4_2_01986A50
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FCA72 mov eax, dword ptr fs:[00000030h] 4_2_019FCA72
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019FCA72 mov eax, dword ptr fs:[00000030h] 4_2_019FCA72
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BCA6F mov eax, dword ptr fs:[00000030h] 4_2_019BCA6F
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BCA6F mov eax, dword ptr fs:[00000030h] 4_2_019BCA6F
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BCA6F mov eax, dword ptr fs:[00000030h] 4_2_019BCA6F
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A54DAD mov eax, dword ptr fs:[00000030h] 4_2_01A54DAD
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A48DAE mov eax, dword ptr fs:[00000030h] 4_2_01A48DAE
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_01A48DAE mov eax, dword ptr fs:[00000030h] 4_2_01A48DAE
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A8DBF mov eax, dword ptr fs:[00000030h] 4_2_019A8DBF
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019A8DBF mov eax, dword ptr fs:[00000030h] 4_2_019A8DBF
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BCDB1 mov ecx, dword ptr fs:[00000030h] 4_2_019BCDB1
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BCDB1 mov eax, dword ptr fs:[00000030h] 4_2_019BCDB1
Source: C:\Users\user\Desktop\2998MOD PO.exe Code function: 4_2_019BCDB1 mov eax, dword ptr fs:[00000030h] 4_2_019BCDB1
Enables debug privileges
Source: C:\Users\user\Desktop\2998MOD PO.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtWriteVirtualMemory: Direct from: 0x76F0490C Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtAllocateVirtualMemory: Direct from: 0x76F03C9C Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtReadVirtualMemory: Direct from: 0x76F02E8C Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtCreateKey: Direct from: 0x76F02C6C Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtSetInformationThread: Direct from: 0x76F02B4C Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtQueryAttributesFile: Direct from: 0x76F02E6C Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtAllocateVirtualMemory: Direct from: 0x76F048EC Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtQuerySystemInformation: Direct from: 0x76F048CC Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtQueryVolumeInformationFile: Direct from: 0x76F02F2C Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtOpenSection: Direct from: 0x76F02E0C Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtSetInformationThread: Direct from: 0x76EF63F9 Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtDeviceIoControlFile: Direct from: 0x76F02AEC Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtAllocateVirtualMemory: Direct from: 0x76F02BEC Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtCreateFile: Direct from: 0x76F02FEC Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtOpenFile: Direct from: 0x76F02DCC Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtQueryInformationToken: Direct from: 0x76F02CAC Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtTerminateThread: Direct from: 0x76F02FCC Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtProtectVirtualMemory: Direct from: 0x76EF7B2E Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtOpenKeyEx: Direct from: 0x76F02B9C Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtProtectVirtualMemory: Direct from: 0x76F02F9C Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtSetInformationProcess: Direct from: 0x76F02C5C Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtNotifyChangeKey: Direct from: 0x76F03C2C Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtCreateMutant: Direct from: 0x76F035CC Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtWriteVirtualMemory: Direct from: 0x76F02E3C Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtMapViewOfSection: Direct from: 0x76F02D1C Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtResumeThread: Direct from: 0x76F036AC Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtAllocateVirtualMemory: Direct from: 0x76F02BFC Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtReadFile: Direct from: 0x76F02ADC Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtQuerySystemInformation: Direct from: 0x76F02DFC Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtDelayExecution: Direct from: 0x76F02DDC Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtQueryInformationProcess: Direct from: 0x76F02C26 Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtResumeThread: Direct from: 0x76F02FBC Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe NtCreateUserProcess: Direct from: 0x76F0371C Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: NULL target: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Section loaded: NULL target: C:\Windows\SysWOW64\colorcpl.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: NULL target: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: NULL target: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\colorcpl.exe Thread APC queued: target process: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\2998MOD PO.exe Process created: C:\Users\user\Desktop\2998MOD PO.exe "C:\Users\user\Desktop\2998MOD PO.exe" Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Process created: C:\Users\user\Desktop\2998MOD PO.exe "C:\Users\user\Desktop\2998MOD PO.exe" Jump to behavior
Source: C:\Program Files (x86)\uZYYnmPedNYIjWqPsWOYKeetmwkKyGZUKAuFniHMcygNfALrFzFrLvWGPJTnONRCeIDRYuvUw\sePlrCtAXqpc.exe Process created: C:\Windows\SysWOW64\colorcpl.exe "C:\Windows\SysWOW64\colorcpl.exe" Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: sePlrCtAXqpc.exe, 00000007.00000000.1954566994.0000000001960000.00000002.00000001.00040000.00000000.sdmp, sePlrCtAXqpc.exe, 00000007.00000002.3560799779.0000000001960000.00000002.00000001.00040000.00000000.sdmp, sePlrCtAXqpc.exe, 00000009.00000002.3562768183.0000000000FE0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: sePlrCtAXqpc.exe, 00000007.00000000.1954566994.0000000001960000.00000002.00000001.00040000.00000000.sdmp, sePlrCtAXqpc.exe, 00000007.00000002.3560799779.0000000001960000.00000002.00000001.00040000.00000000.sdmp, sePlrCtAXqpc.exe, 00000009.00000002.3562768183.0000000000FE0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: sePlrCtAXqpc.exe, 00000007.00000000.1954566994.0000000001960000.00000002.00000001.00040000.00000000.sdmp, sePlrCtAXqpc.exe, 00000007.00000002.3560799779.0000000001960000.00000002.00000001.00040000.00000000.sdmp, sePlrCtAXqpc.exe, 00000009.00000002.3562768183.0000000000FE0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: sePlrCtAXqpc.exe, 00000007.00000000.1954566994.0000000001960000.00000002.00000001.00040000.00000000.sdmp, sePlrCtAXqpc.exe, 00000007.00000002.3560799779.0000000001960000.00000002.00000001.00040000.00000000.sdmp, sePlrCtAXqpc.exe, 00000009.00000002.3562768183.0000000000FE0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: }Program Manager
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Users\user\Desktop\2998MOD PO.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\2998MOD PO.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 4.2.2998MOD PO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.2998MOD PO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.2288704216.0000000004A40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2041194663.00000000018F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2040454369.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2288668245.00000000049F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.3564602723.0000000004DF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.3560962985.0000000002F60000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2042765684.0000000001E20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\colorcpl.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\colorcpl.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 4.2.2998MOD PO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.2998MOD PO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.2288704216.0000000004A40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2041194663.00000000018F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2040454369.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2288668245.00000000049F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.3564602723.0000000004DF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.3560962985.0000000002F60000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2042765684.0000000001E20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1542414 Sample: 2998MOD PO.exe Startdate: 25/10/2024 Architecture: WINDOWS Score: 100 32 ladylawher.org 2->32 34 www.ladylawher.org 2->34 40 Suricata IDS alerts for network traffic 2->40 42 Multi AV Scanner detection for submitted file 2->42 44 Yara detected FormBook 2->44 46 5 other signatures 2->46 10 2998MOD PO.exe 3 2->10         started        signatures3 process4 file5 30 C:\Users\user\AppData\...\2998MOD PO.exe.log, ASCII 10->30 dropped 13 2998MOD PO.exe 10->13         started        16 2998MOD PO.exe 10->16         started        process6 signatures7 58 Maps a DLL or memory area into another process 13->58 18 sePlrCtAXqpc.exe 13->18 injected process8 signatures9 38 Found direct / indirect Syscall (likely to bypass EDR) 18->38 21 colorcpl.exe 13 18->21         started        process10 signatures11 48 Tries to steal Mail credentials (via file / registry access) 21->48 50 Tries to harvest and steal browser information (history, passwords, etc) 21->50 52 Maps a DLL or memory area into another process 21->52 54 2 other signatures 21->54 24 sePlrCtAXqpc.exe 21->24 injected 28 firefox.exe 21->28         started        process12 dnsIp13 36 ladylawher.org 3.33.130.190, 49741, 80 AMAZONEXPANSIONGB United States 24->36 56 Found direct / indirect Syscall (likely to bypass EDR) 24->56 signatures14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
3.33.130.190
 ladylawher.org United States
8987 AMAZONEXPANSIONGB true

Contacted Domains

Name IP Active
ladylawher.org 3.33.130.190 true
www.ladylawher.org unknown unknown