Windows Analysis Report
PO_203-25.exe

AI detected suspicious sample

Source: Yara match	File source: 00000003.00000002.3917775500.0000000003EB6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3938127996.000000003414F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO_203-25.exe PID: 7892, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: PO_203-25.exe

Joe Sandbox ML: detected

Source: PO_203-25.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.200.96:443 -> 192.168.2.3:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.200.96:443 -> 192.168.2.3:49715 version: TLS 1.2

Source: PO_203-25.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\PO_203-25.exe	Code function: 0_2_00406010 FindFirstFileA,FindClose,		0_2_00406010
Source: C:\Users\user\Desktop\PO_203-25.exe	Code function: 0_2_004055AE GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,		0_2_004055AE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.3:49716 -> 192.3.176.134:7062

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 192.3.176.134

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 172.67.200.96 172.67.200.96
Source: Joe Sandbox View	IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.3:49717 -> 178.237.33.50:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:49714 -> 172.67.200.96:443

Source: global traffic	HTTP traffic detected: GET /data-package/NOvf4VgB/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /storage/download/XPjnDkLRpdfJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: s24.filetransfer.ioConnection: Keep-AliveCookie: nette-samesite=1; PHPSESSID=c9h6d86qa6anr7io6fkbvm0hi9

Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.134
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.134
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.134
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.134
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.134
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.134
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.134
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.134
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.134
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.134
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.134
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.134
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.134
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.134
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.134
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.134
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.134
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /data-package/NOvf4VgB/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /storage/download/XPjnDkLRpdfJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: s24.filetransfer.ioConnection: Keep-AliveCookie: nette-samesite=1; PHPSESSID=c9h6d86qa6anr7io6fkbvm0hi9
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: filetransfer.io
Source: global traffic	DNS traffic detected: DNS query: s24.filetransfer.io
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: PO_203-25.exe, 00000003.00000002.3918024532.0000000003F40000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000002.3917775500.0000000003EB6000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000003.1969571656.0000000003F3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003EB6000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000002.3917775500.0000000003E77000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000003.1969571656.0000000003F3D000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003E77000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp1
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpad
Source: PO_203-25.exe, 00000003.00000002.3918024532.0000000003F40000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000003.1969571656.0000000003F3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gprr;
Source: PO_203-25.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: PO_203-25.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003EB6000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000002.3917775500.0000000003E77000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000002.3917723572.0000000003E00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/NOvf4VgB/download
Source: PO_203-25.exe, 00000003.00000003.1741494737.0000000003EF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/NOvf4VgB/download(
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/NOvf4VgB/download8
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003EB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/NOvf4VgB/downloadl
Source: PO_203-25.exe, 00000003.00000003.1741494737.0000000003EF0000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s24.filetransfer.io/
Source: PO_203-25.exe, 00000003.00000003.1741494737.0000000003EF0000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000003.1741412605.0000000003EEB000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000002.3917775500.0000000003ED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s24.filetransfer.io/storage/download/XPjnDkLRpdfJ
Source: PO_203-25.exe, 00000003.00000003.1910013257.0000000003EEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s24.filetransfer.io/storage/download/XPjnDkLRpdfJR
Source: PO_203-25.exe, 00000003.00000003.1910013257.0000000003EEB000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s24.filetransfer.io/storage/download/XPjnDkLRpdfJX
Source: PO_203-25.exe, 00000003.00000003.1910013257.0000000003EEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s24.filetransfer.io/storage/download/XPjnDkLRpdfJ_
Source: PO_203-25.exe, 00000003.00000003.1910013257.0000000003EEB000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000003.1741494737.0000000003EF0000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s24.filetransfer.io/storage/download/XPjnDkLRpdfJx
Source: PO_203-25.exe, 00000003.00000003.1910013257.0000000003EEB000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s24.filetransfer.io/storage/downo

Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: unknown	HTTPS traffic detected: 172.67.200.96:443 -> 192.168.2.3:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.200.96:443 -> 192.168.2.3:49715 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\Desktop\PO_203-25.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\PO_203-25.exe

E-Banking Fraud

Initial sample is a PE file and has a suspicious name

Source: Yara match	File source: 00000003.00000002.3917775500.0000000003EB6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3938127996.000000003414F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO_203-25.exe PID: 7892, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

System Summary

Source: initial sample

Static PE information: Filename: PO_203-25.exe

Source: C:\Users\user\Desktop\PO_203-25.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\PO_203-25.exe

Code function: 0_2_004030EC EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004030EC

Source: PO_203-25.exe

Static PE information: invalid certificate

Source: PO_203-25.exe, 00000000.00000002.1663345405.000000000080E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesita strengeinstruments.exeP vs PO_203-25.exe
Source: PO_203-25.exe, 00000003.00000002.3911312872.000000000080E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesita strengeinstruments.exeP vs PO_203-25.exe
Source: PO_203-25.exe	Binary or memory string: OriginalFilenamesita strengeinstruments.exeP vs PO_203-25.exe

Source: PO_203-25.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/11@3/3

Source: C:\Users\user\Desktop\PO_203-25.exe

0_2_004030EC

Source: C:\Users\user\Desktop\PO_203-25.exe

File created: C:\Users\user\eksterirerne

Source: C:\Users\user\Desktop\PO_203-25.exe

Mutant created: \Sessions\1\BaseNamedObjects\Rmc-9BZQTI

Source: C:\Users\user\Desktop\PO_203-25.exe

File created: C:\Users\user\AppData\Local\Temp\nsi62BE.tmp

Source: PO_203-25.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PO_203-25.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\PO_203-25.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: PO_203-25.exe

ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\PO_203-25.exe

File read: C:\Users\user\Desktop\PO_203-25.exe

Source: unknown	Process created: C:\Users\user\Desktop\PO_203-25.exe "C:\Users\user\Desktop\PO_203-25.exe"
Source: C:\Users\user\Desktop\PO_203-25.exe	Process created: C:\Users\user\Desktop\PO_203-25.exe "C:\Users\user\Desktop\PO_203-25.exe"
Source: C:\Users\user\Desktop\PO_203-25.exe	Process created: C:\Users\user\Desktop\PO_203-25.exe "C:\Users\user\Desktop\PO_203-25.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: omprogrammeringernes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Section loaded: winmm.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO_203-25.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Switches to a custom stack to bypass stack traces

Source: PO_203-25.exe

Static file information: File size 1135960 > 1048576

Source: PO_203-25.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.1666518967.0000000005060000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\PO_203-25.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\PO_203-25.exe

Code function: 0_2_10002D20 push eax; ret

0_2_10002D4E

Source: C:\Users\user\Desktop\PO_203-25.exe

File created: C:\Users\user\AppData\Local\Temp\nsk6706.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\PO_203-25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\PO_203-25.exe	API/Special instruction interceptor: Address: 56067A9
Source: C:\Users\user\Desktop\PO_203-25.exe	API/Special instruction interceptor: Address: 21B67A9

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\PO_203-25.exe	RDTSC instruction interceptor: First address: 55AE022 second address: 55AE022 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FC7F137CDA7h 0x00000006 inc ebp 0x00000007 cmp ch, 00000067h 0x0000000a inc ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\PO_203-25.exe	RDTSC instruction interceptor: First address: 215E022 second address: 215E022 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FC7F04F94C7h 0x00000006 inc ebp 0x00000007 cmp ch, 00000067h 0x0000000a inc ebx 0x0000000b rdtsc

Source: C:\Users\user\Desktop\PO_203-25.exe	Window / User API: threadDelayed 1259	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Window / User API: threadDelayed 8229	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe	Window / User API: foregroundWindowGot 1770	Jump to behavior

Source: C:\Users\user\Desktop\PO_203-25.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsk6706.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\PO_203-25.exe TID: 8148	Thread sleep count: 219 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe TID: 8148	Thread sleep time: -109500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe TID: 8152	Thread sleep count: 1259 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe TID: 8152	Thread sleep time: -3777000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe TID: 8152	Thread sleep count: 8229 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO_203-25.exe TID: 8152	Thread sleep time: -24687000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\PO_203-25.exe	Code function: 0_2_00406010 FindFirstFileA,FindClose,		0_2_00406010
Source: C:\Users\user\Desktop\PO_203-25.exe	Code function: 0_2_004055AE GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,		0_2_004055AE

Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003E77000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\PO_203-25.exe	API call chain: ExitProcess graph end node			graph_0-2208
Source: C:\Users\user\Desktop\PO_203-25.exe	API call chain: ExitProcess graph end node			graph_0-2420

Source: C:\Users\user\Desktop\PO_203-25.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\PO_203-25.exe

Process created: C:\Users\user\Desktop\PO_203-25.exe "C:\Users\user\Desktop\PO_203-25.exe"

Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerTI\t=
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager134:7062
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerTI\7=
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerY=
Source: PO_203-25.exe, 00000003.00000002.3918024532.0000000003F40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manageryr>
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager<=
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managernet/L=
Source: PO_203-25.exe, 00000003.00000002.3918024532.0000000003F40000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerTI\}=
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managernet/%=
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerr\|
Source: PO_203-25.exe, 00000003.00000002.3918024532.0000000003F40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager*r
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager*=
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managernet/
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerk=
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerTI\
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerb=
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: PO_203-25.exe, 00000003.00000002.3917775500.0000000003EB6000.00000004.00000020.00020000.00000000.sdmp, logs.dat.3.dr	Binary or memory string: [Program Manager]

Source: C:\Users\user\Desktop\PO_203-25.exe

0_2_004030EC

Stealing of Sensitive Information

Source: Yara match	File source: 00000003.00000002.3917775500.0000000003EB6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3938127996.000000003414F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO_203-25.exe PID: 7892, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\Desktop\PO_203-25.exe

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-9BZQTI

Source: Yara match	File source: 00000003.00000002.3917775500.0000000003EB6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3938127996.000000003414F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO_203-25.exe PID: 7892, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	11 Input Capture	21 Security Software Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	12 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Access Token Manipulation	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
PO_203-25.exe	53%	ReversingLabs	Win32.Backdoor.Remcos
PO_203-25.exe	100%	Avira	HEUR/AGEN.1331786
PO_203-25.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsk6706.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://s24.filetransfer.io/storage/downo	0%	Avira URL Cloud	safe
https://s24.filetransfer.io/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s24.filetransfer.io	172.67.200.96	true	false	high
geoplugin.net	178.237.33.50	true	false	high
filetransfer.io	172.67.200.96	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false		high
https://filetransfer.io/data-package/NOvf4VgB/download	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://filetransfer.io/	PO_203-25.exe, 00000003.00000002.3917775500.0000000003E77000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geoplugin.net/json.gprr;	PO_203-25.exe, 00000003.00000002.3918024532.0000000003F40000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000003.1969571656.0000000003F3D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_Error	PO_203-25.exe	false		high
http://geoplugin.net/	PO_203-25.exe, 00000003.00000002.3918024532.0000000003F40000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000002.3917775500.0000000003EB6000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000003.1969571656.0000000003F3D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/data-package/NOvf4VgB/downloadl	PO_203-25.exe, 00000003.00000002.3917775500.0000000003EB6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s24.filetransfer.io/	PO_203-25.exe, 00000003.00000003.1741494737.0000000003EF0000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://filetransfer.io/data-package/NOvf4VgB/download(	PO_203-25.exe, 00000003.00000003.1741494737.0000000003EF0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s24.filetransfer.io/storage/downo	PO_203-25.exe, 00000003.00000003.1910013257.0000000003EEB000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp1	PO_203-25.exe, 00000003.00000002.3917775500.0000000003E77000.00000004.00000020.00020000.00000000.sdmp, PO_203-25.exe, 00000003.00000002.3917775500.0000000003EDC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	PO_203-25.exe	false		high
http://geoplugin.net/json.gpad	PO_203-25.exe, 00000003.00000002.3917775500.0000000003E77000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/data-package/NOvf4VgB/download8	PO_203-25.exe, 00000003.00000002.3917775500.0000000003E77000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.200.96	s24.filetransfer.io	United States	13335	CLOUDFLARENETUS	false
192.3.176.134	unknown	United States	36352	AS-COLOCROSSINGUS	true
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562304
Start date and time:	2024-11-25 13:39:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO_203-25.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/11@3/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 53% Number of executed functions: 30 Number of non-executed functions: 17
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): www.bing.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target PO_203-25.exe, PID 7892 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: PO_203-25.exe

Simulations

Behavior and APIs

Time	Type	Description
07:41:47	API Interceptor	4259676x Sleep call for process: PO_203-25.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.200.96	B73X15Rsu7.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/mU5kQOzV/download
	QUOTATION_MAYQTRA031244#U00b7PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/GWyzXjYcdownload
	Purchase Order No.P7696#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/Ep4Uq1sZ/download
	QUOTATION_APRQTRA031244#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/ih7ujIri/download
	QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/ncyGKDgF/download
	DHL - OVERDUE ACCOUNT NOTICE -1301858139#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/brvisqCp/download
	ORDER_LIST_NOVQTRFA00541#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	filetransfer.io/data-package/gim4JWFQ/download
	ORDER_LIST_OCTQTRFA00541.exe	Get hash	malicious	AgentTesla	Browse	filetransfer.io/data-package/nRJn2xsI/download
	QUOTATION_OCTQTRFA00541#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	filetransfer.io/data-package/TvlWlABo/download
	Payment_Slip_(SWIFT)#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	filetransfer.io/data-package/vZQN1oGp/download
178.237.33.50	comprobante.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	segura.vbs	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	Cargo Invoice_pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	Synliggre.vbs	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	eBHn6qHPLz.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	eBHn6qHPLz.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	mCtN05kxh6.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	Bank Fund Transfer-589237.scr.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	Payment Transfer Request Form.bat.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	CargoInvoice_Outstanding_56789_2024-11-21.vbs	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
filetransfer.io	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	rBankRemittance_pdf.scr.exe	Get hash	malicious	Remcos, GuLoader	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	rPO3799039985.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.67.200.96
s24.filetransfer.io	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	QUOTATION_SEPQTRA071244#U00faPDF.scr	Get hash	malicious	FormBook	Browse	188.114.96.3
	QUOTATION_SEPQTRA071244#U00faPDF.scr	Get hash	malicious	Unknown	Browse	188.114.96.3
	QUOTATION_AUGQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
geoplugin.net	comprobante.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	segura.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	Cargo Invoice_pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Synliggre.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	RFQ Nr. 201124559-201124569-201175771.com.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	eBHn6qHPLz.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	eBHn6qHPLz.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	mCtN05kxh6.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Bank Fund Transfer-589237.scr.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Payment Transfer Request Form.bat.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://go.jrwcap.com/e/955053/230645595232154/6xyvj/710994189/h/-dwcgo8Jrn520ILsDDgocWZSKLzmmTijUb6c_giV2KA	Get hash	malicious	Phisher	Browse	104.22.72.81
	dekont 25.11.2024 PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	AWB NO - 09804480383.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.67.152
	file.exe	Get hash	malicious	Unknown	Browse	104.21.88.250
	Vendor Agreement Ready for Your Signature November 22 2024 at 084923 PM.msg	Get hash	malicious	HTMLPhisher	Browse	172.67.206.110
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.88.250
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.155.47
	ZAMOWIEN.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	172.67.145.234
	http://www.kalenderpedia.de	Get hash	malicious	Unknown	Browse	104.18.11.207
	https://protect-us.mimecast.com/s/N4SFCv2zvkHW7wOAuzlFYe	Get hash	malicious	Unknown	Browse	104.19.230.21
AS-COLOCROSSINGUS	Shipping Document.xls	Get hash	malicious	HTMLPhisher	Browse	107.172.44.175
	solicitud de cotizaci#U00f3n..09.xlam.xlsx	Get hash	malicious	Unknown	Browse	104.168.7.19
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.95.140.216
	sora.x86.elf	Get hash	malicious	Mirai	Browse	104.170.219.167
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	192.3.253.172
	kXPgmYpAPg.doc	Get hash	malicious	Unknown	Browse	192.3.101.150
	kXPgmYpAPg.doc	Get hash	malicious	Unknown	Browse	192.3.101.150
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	192.3.243.136
	seethebestthignswhichgivingbestopportunities.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	192.3.101.149
	generatethebstgoodpeoplesaroundtheworldwithgood.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	107.173.4.61
ATOM86-ASATOM86NL	comprobante.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	segura.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	Cargo Invoice_pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Synliggre.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	eBHn6qHPLz.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	eBHn6qHPLz.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	mCtN05kxh6.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Bank Fund Transfer-589237.scr.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Payment Transfer Request Form.bat.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	CargoInvoice_Outstanding_56789_2024-11-21.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	wMy37vlfvz.exe	Get hash	malicious	DarkCloud	Browse	172.67.200.96
	WNIOSEK BUD#U017bETOWY 25-11-2024#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	172.67.200.96
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.67.200.96
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.67.200.96
	412300061474#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	172.67.200.96
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.200.96
	Cargo Invoice_pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	172.67.200.96
	KAHILINGAN NG BADYET 25-11-2024#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	172.67.200.96
	URGENT!! DHL invoice SG00101637 Adobe#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	172.67.200.96
	rorderrequirementsCIF-TRC809910645210.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.200.96

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsk6706.tmp\System.dll	rBankRemittance_pdf.scr.exe	Get hash	malicious	Remcos, GuLoader	Browse
	H6s8pGsYjg.exe	Get hash	malicious	Remcos, GuLoader	Browse
	4mS4e05nQp.exe	Get hash	malicious	GuLoader	Browse
	4mS4e05nQp.exe	Get hash	malicious	GuLoader	Browse
	H6s8pGsYjg.exe	Get hash	malicious	GuLoader	Browse
	SecuriteInfo.com.FileRepMalware.835.16222.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.FileRepMalware.835.16222.exe	Get hash	malicious	Unknown	Browse
	BM-FM_NR.24040718PDF.exe	Get hash	malicious	FormBook, GuLoader	Browse
	BM-FM_NR.24040718PDF.exe	Get hash	malicious	GuLoader	Browse
	4000382404CAPMO -PI SIMONE xlsx.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\ProgramData\remcos\logs.dat

Process:	C:\Users\user\Desktop\PO_203-25.exe
File Type:	data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	3.365630494294252
Encrypted:	false
SSDEEP:	3:rhlKlf4y86i5JWRal2Jl+7R0DAlBG45klovDl6v:6lfd8x5YcIeeDAlOWAv
MD5:	7E009772293F5B2FE2D7487020C8EF82
SHA1:	409B14393B4959176DC46B98C263301E519B8166
SHA-256:	1C740EBF498D6831D3C1DA23B5383E960DB50BFC14DA52E410902B059D0FB850
SHA-512:	A8C65C07346F6081B2D17E0BD0EB7B53946E0C6DFDA8E5841380E7E3B78596739A35FBCF8BDEE819F1B8F3021854317F919A049B6FE4C0232AD65024080B64C3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Reputation:	low
Preview:	....[.2.0.2.4./.1.1./.2.5. .0.7.:.4.1.:.1.5. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2FMK3KK3\json[1].json

Process:	C:\Users\user\Desktop\PO_203-25.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.015105568788186
Encrypted:	false
SSDEEP:	12:tkluQ+nd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qluQydRNuKyGX85jvXhNlT3/7AcV9Wro
MD5:	8937B63DC0B37E949F38E7874886D999
SHA1:	62FD17BF5A029DDD3A5CFB4F5FC9FE83A346FFFC
SHA-256:	AB2F31E4512913B1E7F7ACAB4B72D6E741C960D0A482F09EA6F9D96FED842A66
SHA-512:	077176C51DC10F155EE08326270C1FE3E6CF36C7ABA75611BDB3CCDA2526D6F0360DBC2FBF4A9963051F0F01658017389FD898980ACF7BB3B29B287F188EE7B9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{. "geoplugin_request":"8.46.123.75",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Temp\nsk6706.tmp\System.dll

Process:	C:\Users\user\Desktop\PO_203-25.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.771243767149499
Encrypted:	false
SSDEEP:	192:MPtkumJX7zB22kGwfy0mtVgkCPOs91un:9702k5qpds9Qn
MD5:	375E8A08471DC6F85F3828488B1147B3
SHA1:	1941484AC710FC301A7D31D6F1345E32A21546AF
SHA-256:	4C86B238E64ECFAABE322A70FD78DB229A663CCC209920F3385596A6E3205F78
SHA-512:	5BA29DB13723DDF27B265A4548606274B850D076AE1F050C64044F8CCD020585AD766C85C3E20003A22F356875F76FB3679C89547B0962580D8E5A42B082B9A8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: rBankRemittance_pdf.scr.exe, Detection: malicious, Browse Filename: H6s8pGsYjg.exe, Detection: malicious, Browse Filename: 4mS4e05nQp.exe, Detection: malicious, Browse Filename: 4mS4e05nQp.exe, Detection: malicious, Browse Filename: H6s8pGsYjg.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.FileRepMalware.835.16222.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.FileRepMalware.835.16222.exe, Detection: malicious, Browse Filename: BM-FM_NR.24040718PDF.exe, Detection: malicious, Browse Filename: BM-FM_NR.24040718PDF.exe, Detection: malicious, Browse Filename: 4000382404CAPMO -PI SIMONE xlsx.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L....{.W...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...O........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..`....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\eksterirerne\Kommissorier30\sonderer\Unsafer\Puttyhearted109.bev

Process:	C:\Users\user\Desktop\PO_203-25.exe
File Type:	data
Category:	dropped
Size (bytes):	312412
Entropy (8bit):	1.2500659479081568
Encrypted:	false
SSDEEP:	768:QX7lOX/3JCSDtHImPOGjCMN1Qwy+yw5qphE5wMQppPxLh9/cP+Elx/dybUFv6pEq:Jj6gV4hrCAp2YbhsMgeZHkiBE3+5
MD5:	E2BFE58E79651BB45DA1E99AF3E9FA25
SHA1:	36CF563D284AE65C5EC37A1770B4E51947C8207A
SHA-256:	3A33A0F9AAD93E4055D40CEA6312D3B3D1EB129F1A3C8C321467DA89F014FDC8
SHA-512:	2408F3405F2886A757124C00F352B2292041F1295A00A0DEA7C905C17BC84B172F7DCA463C3A6A401DB3BC77843C22BAE0C823B9D0B884C4D1DAB21D8C891676
Malicious:	false
Reputation:	low
Preview:	....................;....................6..................?....................f.............&.........................P.......o............................................=.......................}..Q............a......j..................................................................................I.................................................................................(...........................6.........................................................................................................................x..........................................g......................}...................u.................................y......................Y........R........................~..............................................e..........................................1..*^.........................................,................................%............................x.....(...............f................f.............&................................q

C:\Users\user\eksterirerne\Kommissorier30\sonderer\Unsafer\Wyeth\Erobrings.Tra

Process:	C:\Users\user\Desktop\PO_203-25.exe
File Type:	data
Category:	dropped
Size (bytes):	143372
Entropy (8bit):	4.603558127145193
Encrypted:	false
SSDEEP:	3072:r0Q1U1T2LPEY4S4aSbueC0oa8h4YlQbHKlJCyS:oOVwY4BaB3lprCyS
MD5:	E7C6C6D40045245ED7379563D608EE4E
SHA1:	809729D794E55CEE01F6F4EC27A762B36D4962C8
SHA-256:	BCF3A73B7D79A360924894A7D2FEB20BEB22A05C83FA7CE0C97FCC46A91E763C
SHA-512:	474ADCC2C65D4AF4C462D5631CBF9594B48D3D858C250869182A349D0926A79A4208B835CADA5F01524103383A35785C25551C67A126BFF1DE697D91871E2877
Malicious:	false
Reputation:	low
Preview:	............%..$.....44................q...@................222...............~............................Z.O.......m.`....+++.......}}}}}}}..........Q.....g....................)................................#.....{{..]]]]............yyy...........$..''..8888................................ ...^...\|......__..........V.......{....YY....I.....jjj..........!.LL......v.C......................oo.....b......e..uuu...s.)..'''........!.ppp.........0..........?...2........................}}}}}...&........[......EE.....99.....\.......LL.{..................................................................kk.....MMMMMMM.................xxxxxx.....s...33....OOOOO.kk.......@@...........................\\\\\................W.!..PPP...3..........3333333333.....................................................---................99.......b..qqqq..................................X.........NNNNNNN.w.......a.0......55.===..L.Q...444..............m..t.#....}}.DD................YYYY.............rrrr..UU....

C:\Users\user\eksterirerne\Kommissorier30\sonderer\Unsafer\Wyeth\forskningsformaal.dis

Process:	C:\Users\user\Desktop\PO_203-25.exe
File Type:	data
Category:	dropped
Size (bytes):	454047
Entropy (8bit):	1.2505435420421065
Encrypted:	false
SSDEEP:	768:e76cXoLGuJRckoY8lCCcGyHqZB1+R8RYoKeXemBfRamFdP0D3DQqR+q67OvYbaT9:NkJkmEkn8IotDAwqXgp410PeIA7Y
MD5:	75EF339273C7DDEC322205D23C62CFFD
SHA1:	21DA7EDE40DC198A5C3533950318703CA25A1EC7
SHA-256:	3A0BE07E38397FC93AE0E699C76418EF4C63DAA6B05689B8E6D6E62A724AC052
SHA-512:	351B4E16C5A35C08FD2BAE00B6BADBCEAF91A6FE14529AD574DC350021860BAF81DED6230448E9F3E89B568071F6DDB67FCC9060F1D5557494D710DD08698897
Malicious:	false
Reputation:	low
Preview:	.....Wq............i..........................a]....F..w..................................{........................................u.........................J............................9w..........!........................................C.............................................9................R..........................N.............j......................................6......6.....................................................................................w....,...........................................................................................z.............n......................................J..z................. ..................................q............V............:..$.....................................%....^...D.+.................T........h...................................................r........................$.....(....v........W.............................................A.................................F.............m.Q.......G............

C:\Users\user\eksterirerne\Kommissorier30\sonderer\Unteethed.May

Process:	C:\Users\user\Desktop\PO_203-25.exe
File Type:	data
Category:	dropped
Size (bytes):	380892
Entropy (8bit):	7.633867639410607
Encrypted:	false
SSDEEP:	6144:16+2OrAKYssWvCmRopppeJ7CkM3jg156OTouSUdraAKKzWB/YInjJnkLFo4vuQQI:Qtr6zvChppw7SkL6gouJEWqB/rjJnCxN
MD5:	035BEDAD0927187D77836715E03BC8C0
SHA1:	CF8D1F87BCBF69455AA14E719A0E1004AD0D02B9
SHA-256:	0FD22D73EC632F2DA1991A229A92668A3D6D8C7F7D888B04BF86771F84F90F4D
SHA-512:	D8B3BFCFBA47CBDCBFAC114BCF359BF62537C6D1AF6736E3396243CCFC62EF08BA268BFD45858065220DD5732C517439E18B6ECEB866761794C75C377F6D24B4
Malicious:	false
Preview:	..WW.....OO................jjjj......E..4444......WWWW.....J.........\|\|............___.....Q.........p..............R.............#..............FF..T...^.....F.^.R........................................`....;.................................b...........o............l.Qn[...V]...4.!@......f.s.8.4/.....w....".t..L7.d4.K~)(.+.......g,..\M.).....>......8.........<hkc{2.3...SfsJ...DP.AX..6y:.\|..o.i$8.9pR.....v[.f...f..../...F....^E.....%....?`..YU....a=.......G ....c..&..5.!.1............C....;..'0..NvB....f......i..A...&.....#.J?....-....H..r........l.Qn[...V]...4.!@../......9T......<.w....".t..L7.d4.K~)(.+.......g,..\M.).....>..........<hk..f.a..s.t.+{2.3...SfsJ...DP.AX..6y:.\|..o.i$8.9pR...z........?..F....^E.....%....?`..YU....a=.......GG..5.!.1..............]........C....;..'0..NvB.......&..... ...f.i..8#.J?....-....H..r........l.Qn[...V]...4.!@../...*....q....Cw....".t..L7.d4.K~)(.+.......g,..\M.).....>..........<hkc{2.3.....U.[.....(

C:\Users\user\eksterirerne\Kommissorier30\sonderer\leonora.jag

Process:	C:\Users\user\Desktop\PO_203-25.exe
File Type:	data
Category:	dropped
Size (bytes):	329616
Entropy (8bit):	1.2556941931450516
Encrypted:	false
SSDEEP:	768:ghIGzhQz76G44OyLkPR6WAzlGcoZHCki+Hz1/10GJaZDKJsFv1WMSE6PeW7w1CwL:DWf95Lu+kC/wkTdX7UfyfNGwHNqOv1+/
MD5:	A97FE872A9DEB61152EA1C3CC5430602
SHA1:	C941CD396CE59666C46DA339F1E1A021224A3621
SHA-256:	8ECDBBE068CDC639A96DCC307C4D9FCF7EAC911B009E726693F69BCE3C95B35C
SHA-512:	ECE02E3E1C214AC01DC55AAA6406DD4815FD54159EBFDF60435D0A6A0D4FED0D359F79D980040FCCE408F54719C5DF2EA4BD8D83F19C1A21A878ADCC56A102E2
Malicious:	false
Preview:	...................~.............1......m............................_..F.....................*...........~........................................3..................#........................................................e.......................................................%....................9.\|.........Q..........................................................................................f...........k.Ed... ..N..........%.....................................................................N............................r.......................................E................\|.................................................N..........................................}.......................................................P..............n.......1.._.....=...................[.................y.0........B..................../..............>......x.........................................................0.....................................................Y......................

C:\Users\user\eksterirerne\Kommissorier30\sonderer\maabedes.smu

Process:	C:\Users\user\Desktop\PO_203-25.exe
File Type:	data
Category:	dropped
Size (bytes):	401382
Entropy (8bit):	1.2557772811513337
Encrypted:	false
SSDEEP:	1536:vbmqXCcTXKZfOtOO3ZQkkUB7PUq8nudcHcxeFxi7CL:vyX86ZGRBnj8nOy
MD5:	F21E9CC8C12DB8B0A5E6F1372407EDF6
SHA1:	23533ACADDDA630630C2D8169F2BAAF81CB13F9E
SHA-256:	F959C2FEC98B52B5C4D014B237D1092141C8F4CDB333B012C3694EAB856A6AC3
SHA-512:	E3495BC2A6534ECA8D9936D66A58348000E3877331742D09E619F2FEFBA42D84397F4351BBD5364493FFD4F3E9D67A0BF6D7E7B7D0BF593926A9AA59ED49866F
Malicious:	false
Preview:	..........o...................&...5.....7..........................h.........O............!...................................:...........)............................................C................&.......D...................{................................................................................l................h.....................!.....................E....................F..............................u...................................................................................P..j......................u............................................................#....................w...............y....................................................................................z..W..........................................................X........ZA......,.................y.................................................Y....................................^...........*....S...............'...............n.............................n.....%..........p...

C:\Users\user\eksterirerne\Kommissorier30\sonderer\phoria.udu

Process:	C:\Users\user\Desktop\PO_203-25.exe
File Type:	data
Category:	dropped
Size (bytes):	429858
Entropy (8bit):	1.2467208624993744
Encrypted:	false
SSDEEP:	1536:Y/M4mr7UiKCZ5Xr3THeV6ae9Da6LH3cucuA:Y/M4q0w5XLG6CysuY
MD5:	683F7A8CA1E6F857F84463A9F9F7F2B9
SHA1:	DD477140CFF795A1EEA082D93E721D5913102F52
SHA-256:	AD31FD468B90B03A64EBDA64A4EAEFD3D207DF0F699CC8FEFAFDAF4BF022DF7E
SHA-512:	A69E97F0D85F29EA7BCB3C425D8E6F8D33040B5E3CEC02608DD8579B41D4CEE9B0107B0FB2BE5A16BDC5EC8F59369F65EB8D4638D8C518F523EFB878A544042D
Malicious:	false
Preview:	.................................h........r..e........O......e..................>...............$..........n...........................X...........................l........+........{....Q....................................................................4..............^......................................0.....u......................................................_.......u..............?....................................................I......................G.....0...........>..............................................@.........................r...................O...............u...........................j....................................................................................................................S.P..............Y........8...................V.......................@................................................g............................................F......................................................s.......................................

C:\Users\user\eksterirerne\Kommissorier30\sonderer\uigengldt.txt