Edit tour

Windows Analysis Report
po4877383.exe

Overview

General Information

Sample name:	po4877383.exe
Analysis ID:	1566505
MD5:	a4fa8bbf123fa899ae788e1cf6b27d98
SHA1:	e0866c961ba217c7a1dc4345cbade4d5f4deade4
SHA256:	a16fd6417221b9f760ee7417a78751d6621726e8d76ab8e82954596c8e99d79c
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected RedLine Stealer

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

po4877383.exe (PID: 7036 cmdline: "C:\Users\user\Desktop\po4877383.exe" MD5: A4FA8BBF123FA899AE788E1CF6B27D98)

po4877383.exe (PID: 3368 cmdline: "C:\Users\user\Desktop\po4877383.exe" MD5: A4FA8BBF123FA899AE788E1CF6B27D98)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["87.120.120.86:1912"], "Bot Id": "LOGS", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1730761630.0000000003E34000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1730761630.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.1849698001.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1730761630.0000000003E9C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.1852537468.0000000002B25000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: po4877383.exe PID: 7036	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: po4877383.exe PID: 7036	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: po4877383.exe PID: 3368	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: po4877383.exe PID: 3368	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.po4877383.exe.3df1d60.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.po4877383.exe.3e3cf80.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.po4877383.exe.3e3cf80.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.po4877383.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.po4877383.exe.3df1d60.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.po4877383.exe.3ea9008.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 1 entries

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T10:52:05.005492+0100	2043234	1	A Network Trojan was detected	87.120.120.86	1912	192.168.2.4	49733	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T10:52:04.593767+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49733	87.120.120.86	1912	TCP
2024-12-02T10:52:10.058958+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49733	87.120.120.86	1912	TCP
2024-12-02T10:52:13.143188+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49733	87.120.120.86	1912	TCP
2024-12-02T10:52:13.575262+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49733	87.120.120.86	1912	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T10:52:10.472232+0100	2046056	1	A Network Trojan was detected	87.120.120.86	1912	192.168.2.4	49733	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T10:52:04.593767+0100	2046045	1	A Network Trojan was detected	192.168.2.4	49733	87.120.120.86	1912	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: po4877383.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.1730761630.0000000003E34000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": ["87.120.120.86:1912"], "Bot Id": "LOGS", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Multi AV Scanner detection for submitted file

Source: po4877383.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: po4877383.exe

Joe Sandbox ML: detected

Source: po4877383.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: po4877383.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: OOGB.pdbSHA256 source: po4877383.exe
Source:	Binary string: OOGB.pdb source: po4877383.exe

Source: C:\Users\user\Desktop\po4877383.exe	Code function: 4x nop then jmp 06A53EBAh	2_2_06A53A98
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 4x nop then jmp 06A5433Ah	2_2_06A53A98
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_06A51218
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 4x nop then jmp 06A5251Dh	2_2_06A524FC
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 4x nop then jmp 06A50941h	2_2_06A50929

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.4:49733 -> 87.120.120.86:1912
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.4:49733 -> 87.120.120.86:1912
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 87.120.120.86:1912 -> 192.168.2.4:49733
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 87.120.120.86:1912 -> 192.168.2.4:49733

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 87.120.120.86:1912

Source: global traffic

TCP traffic: 192.168.2.4:49733 -> 87.120.120.86:1912

Source: Joe Sandbox View

ASN Name: UNACS-AS-BG8000BurgasBG UNACS-AS-BG8000BurgasBG

Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86

Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: po4877383.exe, 00000002.00000002.1852041181.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purl.oen
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp, po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp, po4877383.exe, 00000002.00000002.1852537468.00000000029D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002D3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp, po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp, po4877383.exe, 00000002.00000002.1852537468.0000000002D3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002D3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: po4877383.exe, 00000000.00000002.1730761630.0000000003E34000.00000004.00000800.00020000.00000000.sdmp, po4877383.exe, 00000000.00000002.1730761630.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, po4877383.exe, 00000000.00000002.1730761630.0000000003E9C000.00000004.00000800.00020000.00000000.sdmp, po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp, po4877383.exe, 00000002.00000002.1849698001.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\po4877383.exe	Code function: 0_2_012DD3A4	0_2_012DD3A4
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 2_2_00E1DC74	2_2_00E1DC74
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 2_2_04E3EE58	2_2_04E3EE58
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 2_2_04E38850	2_2_04E38850
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 2_2_04E30040	2_2_04E30040
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 2_2_04E30007	2_2_04E30007
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 2_2_04E38840	2_2_04E38840
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 2_2_06A50CB0	2_2_06A50CB0
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 2_2_06A525B0	2_2_06A525B0
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 2_2_06A56DEB	2_2_06A56DEB
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 2_2_06A52D48	2_2_06A52D48
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 2_2_06A53A98	2_2_06A53A98
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 2_2_06A51218	2_2_06A51218
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 2_2_06A51841	2_2_06A51841
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 2_2_06A50040	2_2_06A50040
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 2_2_06A50CA1	2_2_06A50CA1
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 2_2_06A525A1	2_2_06A525A1
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 2_2_06A53A88	2_2_06A53A88
Source: C:\Users\user\Desktop\po4877383.exe	Code function: 2_2_06A51209	2_2_06A51209

Source: po4877383.exe, 00000000.00000002.1732451445.0000000005600000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs po4877383.exe
Source: po4877383.exe, 00000000.00000002.1734570366.0000000007720000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs po4877383.exe
Source: po4877383.exe, 00000000.00000000.1659117365.0000000000A5E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOOGB.exe6 vs po4877383.exe
Source: po4877383.exe, 00000000.00000002.1729966325.0000000002E10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs po4877383.exe
Source: po4877383.exe, 00000000.00000002.1729162373.000000000109E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs po4877383.exe
Source: po4877383.exe, 00000000.00000002.1730761630.0000000003E34000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs po4877383.exe
Source: po4877383.exe, 00000000.00000002.1730761630.0000000003E7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs po4877383.exe
Source: po4877383.exe, 00000000.00000002.1730761630.0000000003E9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs po4877383.exe
Source: po4877383.exe, 00000000.00000002.1730761630.0000000003E9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs po4877383.exe
Source: po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs po4877383.exe
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002CBD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefirefox.exe0 vs po4877383.exe
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002CBD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $fq,\\StringFileInfo\\000004B0\\OriginalFilename vs po4877383.exe
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002CBD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs po4877383.exe
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002CBD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $fq,\\StringFileInfo\\040904B0\\OriginalFilename vs po4877383.exe
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002CBD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXE.MUID vs po4877383.exe
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002CBD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXED vs po4877383.exe
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002CBD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $fq,\\StringFileInfo\\080904B0\\OriginalFilename vs po4877383.exe
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002CBD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs po4877383.exe
Source: po4877383.exe, 00000002.00000002.1849698001.0000000000446000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs po4877383.exe
Source: po4877383.exe	Binary or memory string: OriginalFilenameOOGB.exe6 vs po4877383.exe

Source: po4877383.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: po4877383.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, Gl1vdAK3BoM1XrupxB.cs	Security API names: _0020.SetAccessControl
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, Gl1vdAK3BoM1XrupxB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, Gl1vdAK3BoM1XrupxB.cs	Security API names: _0020.AddAccessRule
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, Gl1vdAK3BoM1XrupxB.cs	Security API names: _0020.SetAccessControl
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, Gl1vdAK3BoM1XrupxB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, Gl1vdAK3BoM1XrupxB.cs	Security API names: _0020.AddAccessRule
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, Gl1vdAK3BoM1XrupxB.cs	Security API names: _0020.SetAccessControl
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, Gl1vdAK3BoM1XrupxB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, Gl1vdAK3BoM1XrupxB.cs	Security API names: _0020.AddAccessRule
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, xoi2pNYYZ9aAHA8Hjt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, xoi2pNYYZ9aAHA8Hjt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, xoi2pNYYZ9aAHA8Hjt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@0/1

Source: C:\Users\user\Desktop\po4877383.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\po4877383.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\po4877383.exe

Mutant created: NULL

Source: po4877383.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: po4877383.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\po4877383.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\po4877383.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\po4877383.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\po4877383.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: po4877383.exe

ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\po4877383.exe "C:\Users\user\Desktop\po4877383.exe"
Source: C:\Users\user\Desktop\po4877383.exe	Process created: C:\Users\user\Desktop\po4877383.exe "C:\Users\user\Desktop\po4877383.exe"
Source: C:\Users\user\Desktop\po4877383.exe	Process created: C:\Users\user\Desktop\po4877383.exe "C:\Users\user\Desktop\po4877383.exe"	Jump to behavior

Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\po4877383.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\po4877383.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: po4877383.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: po4877383.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: po4877383.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: OOGB.pdbSHA256 source: po4877383.exe
Source:	Binary string: OOGB.pdb source: po4877383.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, Gl1vdAK3BoM1XrupxB.cs	.Net Code: x8mf65ltd9 System.Reflection.Assembly.Load(byte[])
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, Gl1vdAK3BoM1XrupxB.cs	.Net Code: x8mf65ltd9 System.Reflection.Assembly.Load(byte[])
Source: 0.2.po4877383.exe.5600000.4.raw.unpack, L2.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, Gl1vdAK3BoM1XrupxB.cs	.Net Code: x8mf65ltd9 System.Reflection.Assembly.Load(byte[])

Source: po4877383.exe

Static PE information: 0xAF11C509 [Sun Jan 28 02:35:53 2063 UTC]

Source: C:\Users\user\Desktop\po4877383.exe

Code function: 2_2_04E3D442 push eax; ret

2_2_04E3D451

Source: po4877383.exe

Static PE information: section name: .text entropy: 7.7861025495254665

Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, lcufcQSZwVJWOV2cak.cs	High entropy of concatenated method names: 'naNRxtnVrc', 'OZXR8hax7Y', 'kDmR6RnuFu', 'k4hRZNUkT7', 'TTmRBOgSvP', 'B9xRttf7qO', 'xyRRAWfunN', 'E7cRYRHtKg', 'vANR4v1yJQ', 'OsKRhxlE2B'
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, JysYXMw9A6a44w53Fm.cs	High entropy of concatenated method names: 'jAlkpeaxB7', 'IZ4kdPLX5H', 'ToString', 'kpBkOmYJot', 'brfkiyi25m', 'iDYkWWXcCk', 'mbHkV31Bjy', 'r36kJtoquA', 'z4jkRHlj1r', 'tsCkK72WHk'
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, rfCk5nymcKN9rCipXy.cs	High entropy of concatenated method names: 'dyD66wWvy', 'vJWZhY692', 'F94tc6ROn', 'OPtAXPXaj', 'o3Y4LQI2U', 'S0Qh5ayT4', 'l1KV1ywODMOPejx1cq', 'nM4sDd36ugEVxxCRtO', 'BPJPXDGgk', 'vIf5g2d3Z'
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, Mbu1ZKrRhLGA6VhRj8.cs	High entropy of concatenated method names: 'H4mROEiAhM', 'FRhRWJhJ00', 'WLhRJlaGrp', 'R1UJId7g8n', 'bsMJzTAFDm', 'DJKRgFcCt3', 'kIlReTV2J0', 'QRRRynYWCR', 'WIgR0x06u8', 'zI9RfxgaME'
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, vsykXwUnyjWMMtZusD.cs	High entropy of concatenated method names: 'zEcJEIb7dV', 'nRaJi9oO9s', 'SCEJVTp0co', 'MwyJRMFWrd', 'hTSJKqAqs6', 'U0tVCll2Pa', 'LUCVj3mBu5', 'fvOVNItB8R', 'LQvVlwCZln', 'dmZVcx2rNP'
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, YrW1I8f7Aa7r8ynTgr.cs	High entropy of concatenated method names: 'OfqeRoi2pN', 'DZ9eKaAHA8', 'opsepr5Gqc', 'Lw0edsxtKs', 'ks3eXcLHsy', 'qXweunyjWM', 'efsHKkqKG8mQm4Vof6', 'h00a6NpmXjZA6JqUcK', 'YRueenkA4E', 'nmHe0vgit4'
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, BH869VNoZpH5BrPQLv.cs	High entropy of concatenated method names: 'YipQXQxd53', 'XxMQktYted', 'Dl6QQ3O7E1', 'PSYQs6NSnF', 'UVHQHvWhlk', 'GooQqYj9V8', 'Dispose', 'IhjPOqAE8x', 'DZUPiytYeX', 'kGZPWbywdH'
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, ug0cLfeg7pP1BuXDYdH.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'gIq5vE18x6', 'K3Y57vFLSZ', 'kpo5DeimAe', 'k5R5GrQpuh', 'Y4253FhsEH', 'thR5nmG6EU', 'wZ25wVACb9'
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, NgXlekzv3xdYrGRkuW.cs	High entropy of concatenated method names: 'Wx85tqR2hG', 'Hc65YovdxB', 'yFC54FLMWO', 'jBE5Uhrihl', 'DZ25oyDNqU', 'pFF59KmvjO', 'RLW5Mb439t', 'Nfi5qyR3lu', 'kg25xrJ8n0', 'SBg58DJ5md'
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, FcvUVceeD0b5FHJvoMb.cs	High entropy of concatenated method names: 'uI55IbHMmq', 'Xrn5z92yXX', 'gXusgqHZVj', 'OlnseZE3q6', 'C6KsyGUoXe', 'OECs0xJySi', 'EWpsfEnpfa', 'O87sEmI9Lf', 'KissOFhb1R', 'Htksiy3tPZ'
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, KPdNFAigiIuPOmUDy0.cs	High entropy of concatenated method names: 'Dispose', 'mH5ecBrPQL', 'EdPyoFJp2r', 'ui4pjII99y', 'OkkeIR8FFb', 'qm7ez6tAmQ', 'ProcessDialogKey', 'wFbygXBruy', 'zkpyeB404P', 'frDyyY9Ixv'
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, ytKsDyhL4jMUvFs3cL.cs	High entropy of concatenated method names: 'JF3VB9lmGJ', 'VSDVA3tVYc', 'TMKW1N0Zi6', 'XB0W9IZggb', 'yQoWMHduXp', 'wcCW27nMNd', 'DKkWrQkboJ', 'L44WTHteIL', 'yXcWSFgoVu', 'DBYWaMpF58'
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, DykSXdDYkS44vMyRoV.cs	High entropy of concatenated method names: 'hWgbYA3Ano', 'tOKb45KiD2', 'JNWbUM4Agl', 'Nnqbo9JSYi', 'lg2b94ZsTv', 'zwybMAu0ns', 'txFbrigM8l', 'NS9bTViqXS', 'Torbaajdgp', 'TlRbvta5DV'
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, m3Xhf7nRILFOousH06.cs	High entropy of concatenated method names: 'ToString', 'UKYuvSsDow', 'sFOuofNuI1', 'oMru1TYXo5', 'n4Pu9SboAP', 'mPnuMI79VP', 'lO5u2Hq3s1', 'Itrurp0J8B', 'R1luTSfR4f', 'kQyuSSpXYw'
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, G7dNjXGB0R1dSyVCZK.cs	High entropy of concatenated method names: 'zWIXaDbyqB', 'FTVX7wYkne', 'zItXGruUVQ', 'L8WX3bVCi4', 'WN3XoEu77Q', 'hXZX1AqJZ6', 'sDBX9DGcBa', 'TAcXMbWllw', 's1eX2crcAB', 'SEYXrQnIbM'
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, XfYGhX4psr5Gqcrw0s.cs	High entropy of concatenated method names: 'W4rWZbvODW', 'egCWtOGOTH', 'XAwWYGmqoZ', 'RSnW4D04ZL', 'P13WXOOKCa', 'c6EWu3JHZ8', 'IywWkf9HuX', 'yphWPYDlOl', 'v8lWQN83PP', 'vafW5FtEVt'
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, D9IxvrIC1AyfGsCHrO.cs	High entropy of concatenated method names: 'm775WBGG5A', 'uGH5Ver0vH', 'N9n5JA0ukJ', 'ay95RP99CQ', 'vSH5QaPTpq', 'ycL5KiCwef', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, Gl1vdAK3BoM1XrupxB.cs	High entropy of concatenated method names: 'XgX0EtHoCi', 'Gq20OexpUf', 'WJL0iofjVO', 'Cup0WrUThT', 's650VdypMy', 'YTl0JL0DTt', 'EJF0Rlt6cA', 'uSf0KW5ZQt', 'Uo00F92iyy', 'hWB0pk8avx'
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, xoi2pNYYZ9aAHA8Hjt.cs	High entropy of concatenated method names: 'GVViGDqSpy', 'pI7i3DNFHw', 'pupinndBtl', 'j5aiwoh5Zi', 'M5eiCPrV1A', 'wJtij0AHqO', 'C8TiNe53gF', 'Liqil4ct80', 'Oc0icQ4Eub', 'cJyiIbIj6C'
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, qp3MbxjDL8Qp7T4up0.cs	High entropy of concatenated method names: 'iA1kl0FoSf', 'pNwkIWrXgS', 'v1xPgh62PV', 'BJ1PeOaQGu', 'BuKkvQ1wMA', 'MLVk7eNCGn', 'V7IkDnTLEK', 'IE2kGHhOh2', 'plRk3VstTC', 'n1rknAaGlI'
Source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, nXBruyc6kpB404POrD.cs	High entropy of concatenated method names: 'RbIQU7HSHS', 'kj4QotmhkO', 'rqKQ1YidTO', 'eJSQ9LRLsx', 'At3QMAuIgF', 'CsnQ2kxm5s', 'T6PQr81N48', 'fKIQThFGhO', 'CBEQSGWphW', 'gaJQa0HhY3'
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, lcufcQSZwVJWOV2cak.cs	High entropy of concatenated method names: 'naNRxtnVrc', 'OZXR8hax7Y', 'kDmR6RnuFu', 'k4hRZNUkT7', 'TTmRBOgSvP', 'B9xRttf7qO', 'xyRRAWfunN', 'E7cRYRHtKg', 'vANR4v1yJQ', 'OsKRhxlE2B'
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, JysYXMw9A6a44w53Fm.cs	High entropy of concatenated method names: 'jAlkpeaxB7', 'IZ4kdPLX5H', 'ToString', 'kpBkOmYJot', 'brfkiyi25m', 'iDYkWWXcCk', 'mbHkV31Bjy', 'r36kJtoquA', 'z4jkRHlj1r', 'tsCkK72WHk'
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, rfCk5nymcKN9rCipXy.cs	High entropy of concatenated method names: 'dyD66wWvy', 'vJWZhY692', 'F94tc6ROn', 'OPtAXPXaj', 'o3Y4LQI2U', 'S0Qh5ayT4', 'l1KV1ywODMOPejx1cq', 'nM4sDd36ugEVxxCRtO', 'BPJPXDGgk', 'vIf5g2d3Z'
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, Mbu1ZKrRhLGA6VhRj8.cs	High entropy of concatenated method names: 'H4mROEiAhM', 'FRhRWJhJ00', 'WLhRJlaGrp', 'R1UJId7g8n', 'bsMJzTAFDm', 'DJKRgFcCt3', 'kIlReTV2J0', 'QRRRynYWCR', 'WIgR0x06u8', 'zI9RfxgaME'
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, vsykXwUnyjWMMtZusD.cs	High entropy of concatenated method names: 'zEcJEIb7dV', 'nRaJi9oO9s', 'SCEJVTp0co', 'MwyJRMFWrd', 'hTSJKqAqs6', 'U0tVCll2Pa', 'LUCVj3mBu5', 'fvOVNItB8R', 'LQvVlwCZln', 'dmZVcx2rNP'
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, YrW1I8f7Aa7r8ynTgr.cs	High entropy of concatenated method names: 'OfqeRoi2pN', 'DZ9eKaAHA8', 'opsepr5Gqc', 'Lw0edsxtKs', 'ks3eXcLHsy', 'qXweunyjWM', 'efsHKkqKG8mQm4Vof6', 'h00a6NpmXjZA6JqUcK', 'YRueenkA4E', 'nmHe0vgit4'
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, BH869VNoZpH5BrPQLv.cs	High entropy of concatenated method names: 'YipQXQxd53', 'XxMQktYted', 'Dl6QQ3O7E1', 'PSYQs6NSnF', 'UVHQHvWhlk', 'GooQqYj9V8', 'Dispose', 'IhjPOqAE8x', 'DZUPiytYeX', 'kGZPWbywdH'
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, ug0cLfeg7pP1BuXDYdH.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'gIq5vE18x6', 'K3Y57vFLSZ', 'kpo5DeimAe', 'k5R5GrQpuh', 'Y4253FhsEH', 'thR5nmG6EU', 'wZ25wVACb9'
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, NgXlekzv3xdYrGRkuW.cs	High entropy of concatenated method names: 'Wx85tqR2hG', 'Hc65YovdxB', 'yFC54FLMWO', 'jBE5Uhrihl', 'DZ25oyDNqU', 'pFF59KmvjO', 'RLW5Mb439t', 'Nfi5qyR3lu', 'kg25xrJ8n0', 'SBg58DJ5md'
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, FcvUVceeD0b5FHJvoMb.cs	High entropy of concatenated method names: 'uI55IbHMmq', 'Xrn5z92yXX', 'gXusgqHZVj', 'OlnseZE3q6', 'C6KsyGUoXe', 'OECs0xJySi', 'EWpsfEnpfa', 'O87sEmI9Lf', 'KissOFhb1R', 'Htksiy3tPZ'
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, KPdNFAigiIuPOmUDy0.cs	High entropy of concatenated method names: 'Dispose', 'mH5ecBrPQL', 'EdPyoFJp2r', 'ui4pjII99y', 'OkkeIR8FFb', 'qm7ez6tAmQ', 'ProcessDialogKey', 'wFbygXBruy', 'zkpyeB404P', 'frDyyY9Ixv'
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, ytKsDyhL4jMUvFs3cL.cs	High entropy of concatenated method names: 'JF3VB9lmGJ', 'VSDVA3tVYc', 'TMKW1N0Zi6', 'XB0W9IZggb', 'yQoWMHduXp', 'wcCW27nMNd', 'DKkWrQkboJ', 'L44WTHteIL', 'yXcWSFgoVu', 'DBYWaMpF58'
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, DykSXdDYkS44vMyRoV.cs	High entropy of concatenated method names: 'hWgbYA3Ano', 'tOKb45KiD2', 'JNWbUM4Agl', 'Nnqbo9JSYi', 'lg2b94ZsTv', 'zwybMAu0ns', 'txFbrigM8l', 'NS9bTViqXS', 'Torbaajdgp', 'TlRbvta5DV'
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, m3Xhf7nRILFOousH06.cs	High entropy of concatenated method names: 'ToString', 'UKYuvSsDow', 'sFOuofNuI1', 'oMru1TYXo5', 'n4Pu9SboAP', 'mPnuMI79VP', 'lO5u2Hq3s1', 'Itrurp0J8B', 'R1luTSfR4f', 'kQyuSSpXYw'
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, G7dNjXGB0R1dSyVCZK.cs	High entropy of concatenated method names: 'zWIXaDbyqB', 'FTVX7wYkne', 'zItXGruUVQ', 'L8WX3bVCi4', 'WN3XoEu77Q', 'hXZX1AqJZ6', 'sDBX9DGcBa', 'TAcXMbWllw', 's1eX2crcAB', 'SEYXrQnIbM'
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, XfYGhX4psr5Gqcrw0s.cs	High entropy of concatenated method names: 'W4rWZbvODW', 'egCWtOGOTH', 'XAwWYGmqoZ', 'RSnW4D04ZL', 'P13WXOOKCa', 'c6EWu3JHZ8', 'IywWkf9HuX', 'yphWPYDlOl', 'v8lWQN83PP', 'vafW5FtEVt'
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, D9IxvrIC1AyfGsCHrO.cs	High entropy of concatenated method names: 'm775WBGG5A', 'uGH5Ver0vH', 'N9n5JA0ukJ', 'ay95RP99CQ', 'vSH5QaPTpq', 'ycL5KiCwef', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, Gl1vdAK3BoM1XrupxB.cs	High entropy of concatenated method names: 'XgX0EtHoCi', 'Gq20OexpUf', 'WJL0iofjVO', 'Cup0WrUThT', 's650VdypMy', 'YTl0JL0DTt', 'EJF0Rlt6cA', 'uSf0KW5ZQt', 'Uo00F92iyy', 'hWB0pk8avx'
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, xoi2pNYYZ9aAHA8Hjt.cs	High entropy of concatenated method names: 'GVViGDqSpy', 'pI7i3DNFHw', 'pupinndBtl', 'j5aiwoh5Zi', 'M5eiCPrV1A', 'wJtij0AHqO', 'C8TiNe53gF', 'Liqil4ct80', 'Oc0icQ4Eub', 'cJyiIbIj6C'
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, qp3MbxjDL8Qp7T4up0.cs	High entropy of concatenated method names: 'iA1kl0FoSf', 'pNwkIWrXgS', 'v1xPgh62PV', 'BJ1PeOaQGu', 'BuKkvQ1wMA', 'MLVk7eNCGn', 'V7IkDnTLEK', 'IE2kGHhOh2', 'plRk3VstTC', 'n1rknAaGlI'
Source: 0.2.po4877383.exe.7720000.5.raw.unpack, nXBruyc6kpB404POrD.cs	High entropy of concatenated method names: 'RbIQU7HSHS', 'kj4QotmhkO', 'rqKQ1YidTO', 'eJSQ9LRLsx', 'At3QMAuIgF', 'CsnQ2kxm5s', 'T6PQr81N48', 'fKIQThFGhO', 'CBEQSGWphW', 'gaJQa0HhY3'
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, lcufcQSZwVJWOV2cak.cs	High entropy of concatenated method names: 'naNRxtnVrc', 'OZXR8hax7Y', 'kDmR6RnuFu', 'k4hRZNUkT7', 'TTmRBOgSvP', 'B9xRttf7qO', 'xyRRAWfunN', 'E7cRYRHtKg', 'vANR4v1yJQ', 'OsKRhxlE2B'
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, JysYXMw9A6a44w53Fm.cs	High entropy of concatenated method names: 'jAlkpeaxB7', 'IZ4kdPLX5H', 'ToString', 'kpBkOmYJot', 'brfkiyi25m', 'iDYkWWXcCk', 'mbHkV31Bjy', 'r36kJtoquA', 'z4jkRHlj1r', 'tsCkK72WHk'
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, rfCk5nymcKN9rCipXy.cs	High entropy of concatenated method names: 'dyD66wWvy', 'vJWZhY692', 'F94tc6ROn', 'OPtAXPXaj', 'o3Y4LQI2U', 'S0Qh5ayT4', 'l1KV1ywODMOPejx1cq', 'nM4sDd36ugEVxxCRtO', 'BPJPXDGgk', 'vIf5g2d3Z'
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, Mbu1ZKrRhLGA6VhRj8.cs	High entropy of concatenated method names: 'H4mROEiAhM', 'FRhRWJhJ00', 'WLhRJlaGrp', 'R1UJId7g8n', 'bsMJzTAFDm', 'DJKRgFcCt3', 'kIlReTV2J0', 'QRRRynYWCR', 'WIgR0x06u8', 'zI9RfxgaME'
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, vsykXwUnyjWMMtZusD.cs	High entropy of concatenated method names: 'zEcJEIb7dV', 'nRaJi9oO9s', 'SCEJVTp0co', 'MwyJRMFWrd', 'hTSJKqAqs6', 'U0tVCll2Pa', 'LUCVj3mBu5', 'fvOVNItB8R', 'LQvVlwCZln', 'dmZVcx2rNP'
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, YrW1I8f7Aa7r8ynTgr.cs	High entropy of concatenated method names: 'OfqeRoi2pN', 'DZ9eKaAHA8', 'opsepr5Gqc', 'Lw0edsxtKs', 'ks3eXcLHsy', 'qXweunyjWM', 'efsHKkqKG8mQm4Vof6', 'h00a6NpmXjZA6JqUcK', 'YRueenkA4E', 'nmHe0vgit4'
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, BH869VNoZpH5BrPQLv.cs	High entropy of concatenated method names: 'YipQXQxd53', 'XxMQktYted', 'Dl6QQ3O7E1', 'PSYQs6NSnF', 'UVHQHvWhlk', 'GooQqYj9V8', 'Dispose', 'IhjPOqAE8x', 'DZUPiytYeX', 'kGZPWbywdH'
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, ug0cLfeg7pP1BuXDYdH.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'gIq5vE18x6', 'K3Y57vFLSZ', 'kpo5DeimAe', 'k5R5GrQpuh', 'Y4253FhsEH', 'thR5nmG6EU', 'wZ25wVACb9'
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, NgXlekzv3xdYrGRkuW.cs	High entropy of concatenated method names: 'Wx85tqR2hG', 'Hc65YovdxB', 'yFC54FLMWO', 'jBE5Uhrihl', 'DZ25oyDNqU', 'pFF59KmvjO', 'RLW5Mb439t', 'Nfi5qyR3lu', 'kg25xrJ8n0', 'SBg58DJ5md'
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, FcvUVceeD0b5FHJvoMb.cs	High entropy of concatenated method names: 'uI55IbHMmq', 'Xrn5z92yXX', 'gXusgqHZVj', 'OlnseZE3q6', 'C6KsyGUoXe', 'OECs0xJySi', 'EWpsfEnpfa', 'O87sEmI9Lf', 'KissOFhb1R', 'Htksiy3tPZ'
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, KPdNFAigiIuPOmUDy0.cs	High entropy of concatenated method names: 'Dispose', 'mH5ecBrPQL', 'EdPyoFJp2r', 'ui4pjII99y', 'OkkeIR8FFb', 'qm7ez6tAmQ', 'ProcessDialogKey', 'wFbygXBruy', 'zkpyeB404P', 'frDyyY9Ixv'
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, ytKsDyhL4jMUvFs3cL.cs	High entropy of concatenated method names: 'JF3VB9lmGJ', 'VSDVA3tVYc', 'TMKW1N0Zi6', 'XB0W9IZggb', 'yQoWMHduXp', 'wcCW27nMNd', 'DKkWrQkboJ', 'L44WTHteIL', 'yXcWSFgoVu', 'DBYWaMpF58'
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, DykSXdDYkS44vMyRoV.cs	High entropy of concatenated method names: 'hWgbYA3Ano', 'tOKb45KiD2', 'JNWbUM4Agl', 'Nnqbo9JSYi', 'lg2b94ZsTv', 'zwybMAu0ns', 'txFbrigM8l', 'NS9bTViqXS', 'Torbaajdgp', 'TlRbvta5DV'
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, m3Xhf7nRILFOousH06.cs	High entropy of concatenated method names: 'ToString', 'UKYuvSsDow', 'sFOuofNuI1', 'oMru1TYXo5', 'n4Pu9SboAP', 'mPnuMI79VP', 'lO5u2Hq3s1', 'Itrurp0J8B', 'R1luTSfR4f', 'kQyuSSpXYw'
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, G7dNjXGB0R1dSyVCZK.cs	High entropy of concatenated method names: 'zWIXaDbyqB', 'FTVX7wYkne', 'zItXGruUVQ', 'L8WX3bVCi4', 'WN3XoEu77Q', 'hXZX1AqJZ6', 'sDBX9DGcBa', 'TAcXMbWllw', 's1eX2crcAB', 'SEYXrQnIbM'
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, XfYGhX4psr5Gqcrw0s.cs	High entropy of concatenated method names: 'W4rWZbvODW', 'egCWtOGOTH', 'XAwWYGmqoZ', 'RSnW4D04ZL', 'P13WXOOKCa', 'c6EWu3JHZ8', 'IywWkf9HuX', 'yphWPYDlOl', 'v8lWQN83PP', 'vafW5FtEVt'
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, D9IxvrIC1AyfGsCHrO.cs	High entropy of concatenated method names: 'm775WBGG5A', 'uGH5Ver0vH', 'N9n5JA0ukJ', 'ay95RP99CQ', 'vSH5QaPTpq', 'ycL5KiCwef', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, Gl1vdAK3BoM1XrupxB.cs	High entropy of concatenated method names: 'XgX0EtHoCi', 'Gq20OexpUf', 'WJL0iofjVO', 'Cup0WrUThT', 's650VdypMy', 'YTl0JL0DTt', 'EJF0Rlt6cA', 'uSf0KW5ZQt', 'Uo00F92iyy', 'hWB0pk8avx'
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, xoi2pNYYZ9aAHA8Hjt.cs	High entropy of concatenated method names: 'GVViGDqSpy', 'pI7i3DNFHw', 'pupinndBtl', 'j5aiwoh5Zi', 'M5eiCPrV1A', 'wJtij0AHqO', 'C8TiNe53gF', 'Liqil4ct80', 'Oc0icQ4Eub', 'cJyiIbIj6C'
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, qp3MbxjDL8Qp7T4up0.cs	High entropy of concatenated method names: 'iA1kl0FoSf', 'pNwkIWrXgS', 'v1xPgh62PV', 'BJ1PeOaQGu', 'BuKkvQ1wMA', 'MLVk7eNCGn', 'V7IkDnTLEK', 'IE2kGHhOh2', 'plRk3VstTC', 'n1rknAaGlI'
Source: 0.2.po4877383.exe.40608d0.1.raw.unpack, nXBruyc6kpB404POrD.cs	High entropy of concatenated method names: 'RbIQU7HSHS', 'kj4QotmhkO', 'rqKQ1YidTO', 'eJSQ9LRLsx', 'At3QMAuIgF', 'CsnQ2kxm5s', 'T6PQr81N48', 'fKIQThFGhO', 'CBEQSGWphW', 'gaJQa0HhY3'

Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: po4877383.exe PID: 7036, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\po4877383.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\po4877383.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\po4877383.exe	Memory allocated: 12D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Memory allocated: 2DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Memory allocated: 4DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Memory allocated: 7D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Memory allocated: 78F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Memory allocated: 8D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Memory allocated: 9D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Memory allocated: E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Memory allocated: 2940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Memory allocated: 4940000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\po4877383.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\po4877383.exe	Window / User API: threadDelayed 1424			Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Window / User API: threadDelayed 2849			Jump to behavior

Source: C:\Users\user\Desktop\po4877383.exe TID: 7108	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe TID: 2120	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe TID: 3220	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\po4877383.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\po4877383.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: po4877383.exe, 00000002.00000002.1850656259.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllC

Source: C:\Users\user\Desktop\po4877383.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\po4877383.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\po4877383.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\po4877383.exe

Process created: C:\Users\user\Desktop\po4877383.exe "C:\Users\user\Desktop\po4877383.exe"

Jump to behavior

Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Users\user\Desktop\po4877383.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Users\user\Desktop\po4877383.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\po4877383.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: po4877383.exe, 00000002.00000002.1863058913.0000000005EBC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\po4877383.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\po4877383.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\po4877383.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\po4877383.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\po4877383.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\po4877383.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.po4877383.exe.3df1d60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.po4877383.exe.3e3cf80.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.po4877383.exe.3e3cf80.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.po4877383.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.po4877383.exe.3df1d60.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1730761630.0000000003E34000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1730761630.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1849698001.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1730761630.0000000003E9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: po4877383.exe PID: 7036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: po4877383.exe PID: 3368, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: po4877383.exe, 00000002.00000002.1852537468.0000000002B25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\walletsLRfq
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002B25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $fq1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002B25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $fq-cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002B25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLRfq`
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002B25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLRfq(w
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002B25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLRfq`
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002B25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $fq%appdata%`,fqdC:\Users\user\AppData\Roaming`,fqdC:\Users\user\AppData\Roaming\Binance
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002B25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLRfq(w
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002B25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $fq&%localappdata%\Coinomi\Coinomi\walletsLRfq
Source: po4877383.exe, 00000002.00000002.1852537468.0000000002B25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $fq5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\po4877383.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\po4877383.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\po4877383.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1852537468.0000000002B25000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: po4877383.exe PID: 3368, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.po4877383.exe.3df1d60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.po4877383.exe.3e3cf80.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.po4877383.exe.3e3cf80.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.po4877383.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.po4877383.exe.3df1d60.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.po4877383.exe.3ea9008.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1730761630.0000000003E34000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1730761630.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1849698001.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1730761630.0000000003E9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: po4877383.exe PID: 7036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: po4877383.exe PID: 3368, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
po4877383.exe	34%	ReversingLabs	Win32.Infostealer.Genie8DN
po4877383.exe	100%	Avira	HEUR/AGEN.1309499
po4877383.exe	100%	Joe Sandbox ML

Name	Source	Malicious	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	po4877383.exe, 00000002.00000002.1852537468.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23ResponseD	po4877383.exe, 00000002.00000002.1852537468.0000000002D3F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12Response	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id2Response	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp, po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers	po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21Response	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id4	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id7	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://purl.oen	po4877383.exe, 00000002.00000002.1852041181.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sajatypeworks.com	po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19Response	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/cThe	po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/DPlease	po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15Response	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.urwpp.deDPlease	po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.zhongyicts.com.cn	po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6Response	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ip.sb/ip	po4877383.exe, 00000000.00000002.1730761630.0000000003E34000.00000004.00000800.00020000.00000000.sdmp, po4877383.exe, 00000000.00000002.1730761630.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, po4877383.exe, 00000000.00000002.1730761630.0000000003E9C000.00000004.00000800.00020000.00000000.sdmp, po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp, po4877383.exe, 00000002.00000002.1849698001.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/sc	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1ResponseD	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9Response	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	po4877383.exe, 00000002.00000002.1852537468.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id20	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id22	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24Response	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	po4877383.exe, 00000002.00000002.1852537468.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1Response	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.carterandcone.coml	po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/frere-user.html	po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id11	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16Response	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id13	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id14	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id17	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id18	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5Response	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10Response	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designersG	po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8Response	po4877383.exe, 00000002.00000002.1852537468.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/?	po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/bThe	po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers?	po4877383.exe, 00000000.00000002.1733620135.0000000007242000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	po4877383.exe, 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
87.120.120.86	unknown	Bulgaria		25206	UNACS-AS-BG8000BurgasBG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1566505
Start date and time:	2024-12-02 10:51:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	po4877383.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 36 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: po4877383.exe

Simulations

Behavior and APIs

Time	Type	Description
04:52:00	API Interceptor	24x Sleep call for process: po4877383.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNACS-AS-BG8000BurgasBG	e824975.html	Get hash	malicious	Unknown	Browse	87.120.114.172
	qqig1mHX8U.exe	Get hash	malicious	AveMaria, DBatLoader, UACMe	Browse	87.120.125.217
	RFQ LIST 767655776478637584637865763478634365634444444444444444453.exe	Get hash	malicious	GuLoader	Browse	87.120.114.159
	New listed items 7648767856387547354734567465647568487.exe	Get hash	malicious	Discord Token Stealer, GuLoader	Browse	87.120.114.159
	file.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	87.120.113.179
	https://www.google.co.kr/url?url=https://hrtyuytitwagtxswxzqxpcm&jtdm=hjstxxb&qhwocq=elw&vrszx=mrursi&rtz=qksmlok&sdyxm=kxlpun&hnkj=iujyvng&vochgqf=ylsd&pkhfd=vyifcj&nymdhak=ffn&ylzv=xpddvxaj&zoadnebgoj=rccejsmuqd&q=amp/hmf1bnz.s%C2%ADlf%C2%ADpg%C2%ADq%C2%ADq%C2%ADwzu%C2%ADx%C2%ADppns%C2%ADc%C2%ADs%C2%AD.com%E2%80%8B/n7brnx1iy&lbgq=ihcrvpx&isffrcc=xjcvvbbd&hokv=buitobfj&nfzezydbgm=lhtjhglyxx&pjwu=tdsgcse&cesnzrb=ekoykarj&ifpv=yabmwecd&acyeqkflup=bacwibnnwl&dovx=vqvcdxk&rwbvdtj=khlezois&efgx=ktfpexjt&iqggbgjmwh=cvqmvfdelx&gqsh=ghsdgye&hipceti=hpqeesqk&hkvbucxuvo=drwoirzwsq&dril=qbpemxo&xziwtam=tdvywqlj&nndiwyldry=kjqbehmdbj&kqef=faiqetj&peigggc=vbyfdxky&fstmbbtmkx=rjxugltfmc&rpws=borxqez&rijvxqj=ntedqhtd&wohxxxgtmq=jpiozpkrbp&cxah=gcmtksp&tzidqah=syxnwioo&szzishkfke=xmnmodwwoc&xmif=xdxtrqz&ajzcojq=fmtqkshw&gkmh=vmwdknp&xvlhpuf=zkhqqziq&rvfh=igbqint&gdnzlky=hyzlhjke&dqkq=ophpttl&yoamsuz=cuykisoc&frzr=lajcnwi&chdmjpw=hymhkhbw&wnxy=zwkomqb&duxkrfq=asjrwcgu&fzya=hrpcnke&hxrusxm=foudbois&yqgm=uhfvxoo&uynyplq=iryzkatx&qfzs=stmleud&vkbxzkf=hxgbjzit&dnro=vjxntck&kfrldgj=vpyfihbn&nsko=sdzidzb&unudtuz=mnvrwokv&lisf=zxdfari&tdyzrah=otrtzuun&rfza=trokalr&vkfduyc=wpwvnxpe&jjsq=pgkbofh&uatnbjp=gtwiypfq&zilu=kagobvs&jqfufkw=bckrzetp&tjng=jgmmmod&fvdtpsk=vlyzfjep&mgoi=fklhysh&llyljdv=jxpogtdn&gcjv=vjlzkuf&erlhvti=peuprtov&kbxk=jviffkg&lklbxhl=uhzpnzfw&upaw=gfmiehp&ismxijp=hmwbsmgj&zdkc=kodikna&njllvzf=oodglyrw&urdk=cktezyn&vmqhwgh=kqcbhffu&riqy=tlnbqzr&nmlgrkn=inyeynzg&vebu=pwpghzr&ckpmyoc=tmeufjen&otic=svrqsdo&tbwzub	Get hash	malicious	Unknown	Browse	87.120.114.172
	file.exe	Get hash	malicious	Unknown	Browse	87.120.125.16
	file.exe	Get hash	malicious	Unknown	Browse	87.120.125.16
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	87.120.113.179

Process:	C:\Users\user\Desktop\po4877383.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.6224380698541685
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	po4877383.exe
File size:	835'584 bytes
MD5:	a4fa8bbf123fa899ae788e1cf6b27d98
SHA1:	e0866c961ba217c7a1dc4345cbade4d5f4deade4
SHA256:	a16fd6417221b9f760ee7417a78751d6621726e8d76ab8e82954596c8e99d79c
SHA512:	3eab239a9792b32b975271f28f8dd66e10c9f42ab38dbbc610e0e68de647cbf44d1e36ced85a5f976dbb702e61e7f227d61eb138d0c6d8f5e4ccf541ee3b4c1e
SSDEEP:	12288:0+YNQKbM0NWWUV8v4oX3ZcPc9crEee9jc8zeb8BXw/ORnNyAd1n2l5usx+Xt7:0+QfWagwp9cbe28zeY4ORgrx
TLSH:	B005F1A4B256CC0AD8A553B00E36F17013B92EDEA511D30F6FCA7EEBB873B121951647
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	4b66a4ecc5ce527b

Static PE Info

General

Entrypoint:	0x4bca8a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xAF11C509 [Sun Jan 28 02:35:53 2063 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbca36	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xbe000	0x10e6c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xbadd4	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xbaa90	0xbac00	7dc032a52cacac2f00e74a48a802b5e9	False	0.9194081011546185	data	7.7861025495254665	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xbe000	0x10e6c	0x11000	933631efc4e373b649b81884c9cd82dd	False	0.22002814797794118	data	4.387834898303855	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd0000	0xc	0x200	b010118018df05c60d00365ee0fa3986	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xbe130	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2834 x 2834 px/m	0.21470188098899798
RT_GROUP_ICON	0xce958	0x14	data	1.0
RT_VERSION	0xce96c	0x314	data	0.434010152284264
RT_MANIFEST	0xcec80	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-02T10:52:04.593767+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	87.120.120.86	1912	TCP
2024-12-02T10:52:04.593767+0100	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.4	49733	87.120.120.86	1912	TCP
2024-12-02T10:52:05.005492+0100	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	87.120.120.86	1912	192.168.2.4	49733	TCP
2024-12-02T10:52:10.058958+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	87.120.120.86	1912	TCP
2024-12-02T10:52:10.472232+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	87.120.120.86	1912	192.168.2.4	49733	TCP
2024-12-02T10:52:13.143188+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	87.120.120.86	1912	TCP
2024-12-02T10:52:13.575262+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	87.120.120.86	1912	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2024 10:52:03.147655010 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:03.267669916 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:03.267771959 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:03.277944088 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:03.398247957 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:04.561110973 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:04.593766928 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:04.713871956 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:05.005491972 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:05.054863930 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:10.058958054 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:10.178908110 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:10.472137928 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:10.472163916 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:10.472220898 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:10.472232103 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:10.472244024 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:10.472255945 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:10.472282887 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:10.523601055 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.531141996 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.651196003 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.651225090 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.651269913 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.651299000 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.651401043 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.651415110 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.651456118 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.651485920 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.651496887 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.651523113 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.651573896 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.651598930 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.651653051 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.651742935 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.651777029 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.651804924 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.651822090 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.652318001 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.771395922 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.771408081 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.771446943 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.771466017 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.771527052 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.771575928 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.771585941 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.771631002 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.771750927 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.771764994 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.771806002 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.771881104 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.771924019 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.771951914 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.772001982 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.772032022 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.772078991 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.772111893 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.772166967 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.772239923 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.772274017 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.772288084 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.772322893 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.772334099 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.772382021 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.891464949 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.891520023 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.891525984 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.891577005 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.891581059 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.891638994 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.891670942 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.891719103 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.891755104 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.891804934 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.891892910 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.891958952 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.891977072 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.892007113 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.892054081 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.892105103 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.892133951 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.892177105 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.892191887 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.892242908 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.892369032 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.892412901 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.892441034 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.892451048 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.892513037 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.892522097 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.892530918 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.892589092 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.892623901 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.892632961 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.892685890 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.892733097 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.892741919 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.892759085 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.892776012 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.892798901 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.892801046 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.892842054 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.892898083 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.892906904 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.892951012 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.892972946 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.892982960 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.893030882 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.893069983 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.893079042 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.893119097 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:11.893135071 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:11.893176079 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.011600018 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.011612892 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.011674881 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.011684895 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.011737108 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.011742115 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.011787891 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.011794090 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.011852980 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.011926889 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.011940956 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.011981010 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.012003899 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.012013912 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.012053013 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.012085915 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.012104034 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.012137890 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.012193918 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.012212992 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.012274981 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.012341022 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.012449980 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.012463093 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.012521029 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.012537956 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.012661934 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.012671947 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.012775898 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.012795925 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.012897968 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.012907982 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013027906 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013036013 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013137102 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013145924 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013197899 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013211966 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013324976 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013334990 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013387918 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013406038 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013509989 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013520956 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013536930 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013612032 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013622999 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013783932 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.013799906 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013811111 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013829947 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013839006 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013851881 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.013855934 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013865948 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013933897 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.013957977 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.014048100 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.014081001 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.014199972 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.014209986 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.014265060 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.014273882 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.014379025 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.014426947 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.014444113 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.014452934 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.014549017 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.014589071 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.014616966 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.014664888 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.014787912 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.014888048 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.014897108 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.014906883 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.014965057 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.015016079 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.015111923 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.015120983 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.015163898 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.131850004 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.131897926 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.131968975 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.131978035 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.132111073 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.132153034 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.132227898 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.132236958 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.132273912 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.132293940 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.132428885 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.132450104 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.132515907 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.132635117 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.132652998 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.132765055 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.132785082 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.132857084 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.132867098 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.132929087 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.133240938 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.133321047 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.133733988 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.133822918 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.133858919 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.133979082 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.134016037 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.134079933 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.134104013 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.134201050 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.134210110 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.134315014 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.134339094 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.134349108 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.134380102 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.134504080 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.134512901 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.134598970 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.134660006 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.134728909 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.134768963 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.134807110 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.134826899 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.134931087 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.134951115 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.135071039 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.135123014 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.135217905 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.135303974 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.135318995 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.135329962 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.135375023 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.135394096 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.135451078 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.135490894 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.135550976 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.135570049 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.135668993 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.135710001 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.135842085 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.135859966 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.135960102 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.135968924 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.136027098 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.136079073 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.136224031 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.136241913 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.136317015 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.136356115 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.136420965 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.136468887 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.136523008 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.136598110 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.136712074 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.136730909 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.156764030 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.156985998 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.157052040 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.253365040 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.253379107 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.253495932 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.253551006 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.253637075 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.253669977 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.253910065 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.253921032 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.254009008 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.254019022 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.254159927 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.254215002 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.254347086 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.254390955 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.254461050 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.254534960 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.254663944 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.254741907 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.254834890 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.254884005 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.254961967 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.255027056 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.255134106 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.255192995 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.255328894 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.255373955 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.255476952 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.255518913 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.255634069 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.255687952 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.255775928 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.255800962 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.255916119 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.255924940 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.256017923 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.256027937 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.256201029 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.256242990 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.256359100 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.256416082 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.256493092 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.256619930 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.256637096 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.256745100 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.256753922 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.256808043 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.256886005 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.256983995 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.256998062 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.257069111 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.257078886 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.257144928 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.257153988 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.257224083 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.257497072 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.257564068 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.276962996 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.277142048 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.277151108 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.277266026 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.277275085 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.277358055 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.277420044 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.277457952 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.277522087 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.277607918 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.277673960 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.277745008 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.277754068 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.277841091 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.277849913 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.277945042 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.277997971 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.278073072 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.278129101 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.278213978 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.278239965 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.278301954 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.278350115 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.278439999 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.278489113 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.278579950 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.278589010 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.278650999 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.278774977 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.278784037 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.278795004 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.278851986 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.278878927 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.278959990 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.279001951 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.279061079 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.279110909 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.279181957 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.279231071 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.279275894 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.279331923 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.279387951 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.279436111 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.279515982 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.279536009 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.279633045 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.279650927 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.279750109 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.279758930 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.279841900 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.279851913 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.279926062 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.279944897 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.280054092 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.280323029 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.280397892 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.377671003 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.377682924 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.377784967 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.377794981 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.377955914 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.377975941 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.378106117 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.378164053 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.378308058 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.378317118 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.378364086 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.378446102 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.378454924 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.378489017 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.378608942 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.378621101 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.378740072 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.378751040 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.378854036 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.378868103 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.378947020 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.378956079 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.379081964 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.379096985 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.379179001 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.379189014 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.379285097 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.379297018 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.379388094 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.379502058 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.379512072 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.379519939 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.379586935 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.379605055 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.379714966 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.379761934 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.379812002 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.379825115 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.379920006 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.379936934 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.380034924 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.380053043 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.380152941 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.380166054 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.380250931 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.380270958 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.380392075 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.380403996 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.380439997 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.380449057 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.380556107 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.380568027 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.380635977 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.380691051 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.380919933 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.380980968 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.400557995 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.400604010 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.400686979 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.400736094 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.400837898 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.400887966 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.401009083 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.401017904 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.401097059 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.401170969 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.401180029 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.401190042 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.401305914 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.401351929 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.401431084 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.401479006 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.401556969 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.401601076 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.401674986 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.401706934 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.401787996 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.401798964 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.401937008 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.401947975 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.402041912 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.402053118 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.402127981 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.402211905 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.402221918 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.402337074 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.402345896 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.402354002 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.402445078 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.402455091 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.402472019 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.402512074 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.402615070 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.402628899 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.402703047 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.402781963 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.402872086 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.402889967 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.403033018 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.403043032 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.403083086 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.403120041 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.403175116 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.403234959 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.403326988 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.403345108 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.403424025 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.403511047 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.403520107 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.403531075 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.403740883 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.403805971 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.501058102 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.501080990 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.501230955 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.501277924 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.501322031 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.501365900 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.501467943 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.501487970 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.501612902 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.501630068 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.501774073 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.501856089 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.501962900 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.502042055 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.502121925 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.502131939 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.502172947 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.502237082 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.502247095 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.502336979 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.502356052 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.502450943 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.502460003 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.502574921 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.502584934 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.502645969 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.502655029 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.502790928 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.502800941 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.502851963 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.502933025 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.502979040 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.502990007 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.503074884 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.503086090 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.503184080 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.503195047 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.503268957 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.503298998 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.503410101 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.503418922 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.503465891 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.503519058 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.503575087 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.503624916 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.503720045 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.503729105 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.503834009 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.503853083 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.503969908 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.504112005 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.504122019 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.504131079 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.504139900 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.504359961 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.504441977 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.523874044 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.523931980 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.524092913 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.524151087 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.524271965 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.524353981 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.524490118 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.524560928 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.524642944 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.524701118 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.524804115 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.524849892 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.524960041 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.524992943 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.525149107 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.525206089 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.525291920 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.525353909 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.525440931 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.525513887 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.525619030 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.525654078 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.525794983 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.525928020 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.526040077 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.526179075 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.526273012 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.526417017 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.526515007 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.526680946 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.526784897 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.526793957 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.526829004 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.526918888 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.526995897 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.527062893 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.527144909 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.527196884 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.527302980 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:12.624480963 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.624535084 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.624665976 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.624736071 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.624838114 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.624931097 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.624980927 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.625071049 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.625184059 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.625207901 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.625325918 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.625492096 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.625622988 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.625642061 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.625677109 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.625750065 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.625799894 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.625886917 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.625977039 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.626158953 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.626240969 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.626487970 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.626588106 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.626647949 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.626751900 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.626893044 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.626971960 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.647325039 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:12.647336006 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:13.142337084 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:13.143188000 CET	49733	1912	192.168.2.4	87.120.120.86
Dec 2, 2024 10:52:13.263119936 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:13.547478914 CET	1912	49733	87.120.120.86	192.168.2.4
Dec 2, 2024 10:52:13.575262070 CET	49733	1912	192.168.2.4	87.120.120.86

Target ID:	0
Start time:	04:51:54
Start date:	02/12/2024
Path:	C:\Users\user\Desktop\po4877383.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\po4877383.exe"
Imagebase:	0x9a0000
File size:	835'584 bytes
MD5 hash:	A4FA8BBF123FA899AE788E1CF6B27D98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1730761630.0000000003E34000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1730761630.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1730761630.0000000003E9C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:52:00
Start date:	02/12/2024
Path:	C:\Users\user\Desktop\po4877383.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\po4877383.exe"
Imagebase:	0x4c0000
File size:	835'584 bytes
MD5 hash:	A4FA8BBF123FA899AE788E1CF6B27D98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.1852537468.00000000029DA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.1849698001.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1852537468.0000000002B25000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	7

Executed Functions

Function 012DD468 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 012DD4F6
GetCurrentThread.KERNEL32 ref: 012DD533
GetCurrentProcess.KERNEL32 ref: 012DD570
GetCurrentThreadId.KERNEL32 ref: 012DD5C9

Memory Dump Source

Source File: 00000000.00000002.1729448435.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12d0000_po4877383.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 8495059e51caf13ce3e817640c9968604f8c81c116259653a0a2becff21f0f91
Instruction ID: d2768124e10daac1a8d0bb5fd08db9bc1505d54cd7f3df425b180d4dd23a7c50
Opcode Fuzzy Hash: 8495059e51caf13ce3e817640c9968604f8c81c116259653a0a2becff21f0f91
Instruction Fuzzy Hash: 685157B0900649CFDB58CFA9E588B9EBBF1FF88314F24845EE509AB3A0D7345944CB61

Function 012DD478 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 012DD4F6
GetCurrentThread.KERNEL32 ref: 012DD533
GetCurrentProcess.KERNEL32 ref: 012DD570
GetCurrentThreadId.KERNEL32 ref: 012DD5C9

Memory Dump Source

Source File: 00000000.00000002.1729448435.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12d0000_po4877383.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4138310695686cf5ce3b19e7dd7d30878d885f95d50c063c5f90dcca3e4c8dc7
Instruction ID: 89002aa90d50440b0d89ff0310af529fdae27f552b9df46032bb11660ddfa700
Opcode Fuzzy Hash: 4138310695686cf5ce3b19e7dd7d30878d885f95d50c063c5f90dcca3e4c8dc7
Instruction Fuzzy Hash: 0D5157B090064ACFDB54CFAAD588B9EBBF5FF88314F24841EE509A73A0D7345944CB65

Function 012DADE8 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 012DB03E

Memory Dump Source

Source File: 00000000.00000002.1729448435.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12d0000_po4877383.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 71aea5aa19bdec0bb2e3b64f24ffc3e9e0ede21a7a0fdade664221fbd993c753
Instruction ID: 0e4f09cec7972e5f884365a69e482f88fc56e67588ca3ddb814e95f04a213ecb
Opcode Fuzzy Hash: 71aea5aa19bdec0bb2e3b64f24ffc3e9e0ede21a7a0fdade664221fbd993c753
Instruction Fuzzy Hash: 4D7126B0A10B068FDB24DF69D494B5ABBF1FF88300F00892DD58ADBA50D775E845CB90

Function 012D44B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012D59C9

Memory Dump Source

Source File: 00000000.00000002.1729448435.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12d0000_po4877383.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5f8a5bdb094e43b116427bb5bdf2737ea88ae3193e58d47d1b825f4fcc9e720e
Instruction ID: d1e0fbe7ff20885a108b110458c17a0342ae93b183b17556c1a83244d55ad2ee
Opcode Fuzzy Hash: 5f8a5bdb094e43b116427bb5bdf2737ea88ae3193e58d47d1b825f4fcc9e720e
Instruction Fuzzy Hash: 4C41B0B0C10719CADB24CFA9C984B9EBBF5BF49304F20806AD508AB251DBB56945CF90

Function 012D590C Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012D59C9

Memory Dump Source

Source File: 00000000.00000002.1729448435.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12d0000_po4877383.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 6b575feb20262c50da3ac0855de1a9972b55fdbb2537337815c809c3d926c6f9
Instruction ID: d8ec7027b414fe89df35d1e260ad4bfa51b7e4fa6cd077e74255573a402f82c3
Opcode Fuzzy Hash: 6b575feb20262c50da3ac0855de1a9972b55fdbb2537337815c809c3d926c6f9
Instruction Fuzzy Hash: 7C41E2B0C10719CBDB24CFA9C984BDEBBF5BF49304F24805AD508AB261DBB56946CF90

Function 012DD6B9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012DD747

Memory Dump Source

Source File: 00000000.00000002.1729448435.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12d0000_po4877383.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 93ddf41f81b92c01898ff49efe0829e69fe70e10136c8792abbfa679f1b56255
Instruction ID: 75c562a1a045ba933e2acc5b3e840db3b74cf7f6ac978bb6bc3e083a8f66d2ab
Opcode Fuzzy Hash: 93ddf41f81b92c01898ff49efe0829e69fe70e10136c8792abbfa679f1b56255
Instruction Fuzzy Hash: 9621E3B5D10249DFDB10CFAAD984AEEBBF5EB48320F14801AE918A3350C378A940CF60

Function 012DD6C0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012DD747

Memory Dump Source

Source File: 00000000.00000002.1729448435.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12d0000_po4877383.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a28a4b027b4ff55f25ae25f508db51e0371dad1716bf221994d67d2487062049
Instruction ID: e660e98e993ebd213e18d266c2cfd800bd2e65b5ba145b12ce9591087e6cbe72
Opcode Fuzzy Hash: a28a4b027b4ff55f25ae25f508db51e0371dad1716bf221994d67d2487062049
Instruction Fuzzy Hash: E621C4B5D002499FDB10CFAAD984ADEFFF9EB48320F14845AE914A7350D374A944CF65

Function 012DAFD8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 012DB03E

Memory Dump Source

Source File: 00000000.00000002.1729448435.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12d0000_po4877383.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 26e0c941ef021c3f2d4efe824444a45284d9c00e4465faad16413a7c8a07753c
Instruction ID: 8f21d6d95c3d6c82976c2b083e4b85ed47fb779afccbdc8a569254e458b34ed2
Opcode Fuzzy Hash: 26e0c941ef021c3f2d4efe824444a45284d9c00e4465faad16413a7c8a07753c
Instruction Fuzzy Hash: 7C110FB6C002498FDB20CF9AD444BDEFBF4AB88324F11841AD528A7600D379A545CFA1

Function 0104D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728987513.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_104d000_po4877383.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5ae7fd6422c64cbb0c570cccfa3897040f966ce20e9e66052442ad55f7043c
Instruction ID: 6f86c66560c014922c0ca50d2a29e5c80c6e7ad8c1baccb6cd070c2292bc880e
Opcode Fuzzy Hash: 6e5ae7fd6422c64cbb0c570cccfa3897040f966ce20e9e66052442ad55f7043c
Instruction Fuzzy Hash: 8C2107F1604200EFDB05DF98D6C0B26BBA5FBA4324F24C6BDE9894B252C336D446CB61

Function 0104D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728987513.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_104d000_po4877383.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4afed0508b9e93a9383486e84051938db8c7fccd22898b7858fd19c78d69d5a
Instruction ID: fb9f9aa30ddf3b6b4ac907c7dafa9c0acb4842ce434730ed144bd40a7eb3e3d5
Opcode Fuzzy Hash: f4afed0508b9e93a9383486e84051938db8c7fccd22898b7858fd19c78d69d5a
Instruction Fuzzy Hash: FE2122B1604200DFCB15DF98D9C0B26BBA5FB94354F20C9BDE98A4B246C33AD407CB61

Function 0104D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728987513.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_104d000_po4877383.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80a9c06835c9bc8a3cd7a95227e9d701827f076a94ba7b38ae53c04f81df4e9d
Instruction ID: 47194c0101d1e015ea3957a8e10c8e4d5db7ca22c58b910d62bef64ad4a9ab6b
Opcode Fuzzy Hash: 80a9c06835c9bc8a3cd7a95227e9d701827f076a94ba7b38ae53c04f81df4e9d
Instruction Fuzzy Hash: 952183B55083809FCB13CF54D9D4711BFB1EB56214F24C5EAD8898B2A7C33AD846CB62

Function 0104D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728987513.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_104d000_po4877383.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction ID: 26e8fc8a99396f23e72227087db2f7dda779d748dc2697ef7cd8a12fa54b10e7
Opcode Fuzzy Hash: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction Fuzzy Hash: 3711BBB5504280DFDB12DF54C6C4B15BBA2FB94224F24C6AAD8894B696C33AD44ACB61

Non-executed Functions

Function 012DD3A4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729448435.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12d0000_po4877383.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc389f0c8e49c396fef5e36bb4af937ae666f8bfc81b2c706b6b6c68651f8d15
Instruction ID: 681fca1aab2011b4971e5ff58a66b5d18c6b909e5843debe63be6dd3cdab5d5e
Opcode Fuzzy Hash: bc389f0c8e49c396fef5e36bb4af937ae666f8bfc81b2c706b6b6c68651f8d15
Instruction Fuzzy Hash: 8DA19432E10216CFCF19DFB4C5845EEBBB2FF85301B15856AE912AB265DB71D906CB80

Analysis Process: po4877383.exePID: 3368, Parent PID: 7036COMMON

Execution Graph

Execution Coverage:	13.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	125
Total number of Limit Nodes:	11

Executed Functions

Function 06A53A98 Relevance: 5.5, Strings: 4, Instructions: 496
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$fq, xrefs: 06A53DBD
$fq, xrefs: 06A53E81
$fq, xrefs: 06A542FE
$fq, xrefs: 06A54231

Memory Dump Source

Source File: 00000002.00000002.1866118780.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a50000_po4877383.jbxd

Similarity

API ID:
String ID: $fq$$fq$$fq$$fq
API String ID: 0-2113499236
Opcode ID: cb9b4e45f18cbd51b081ba28b3a56226703e198e2aaa7730975f00c9f63af3de
Instruction ID: 9a3e9922a472e788a6df964a32cce0e8edce4803c6e042190808f4b84ce7147e
Opcode Fuzzy Hash: cb9b4e45f18cbd51b081ba28b3a56226703e198e2aaa7730975f00c9f63af3de
Instruction Fuzzy Hash: 77329074E05228CFDB68DF64C990BDEB7B2BB89300F5085E9D409AB254DB359E85CF90

Function 06A51218 Relevance: 5.3, Strings: 4, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$fq, xrefs: 06A513C9
$fq, xrefs: 06A51463
$fq, xrefs: 06A513B3
$fq, xrefs: 06A51479

Memory Dump Source

Source File: 00000002.00000002.1866118780.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a50000_po4877383.jbxd

Similarity

API ID:
String ID: $fq$$fq$$fq$$fq
API String ID: 0-2113499236
Opcode ID: d3f0b44b8dfac2748f7b01a57bccc78e5db9f36cda53f2636770433d8a545889
Instruction ID: b8a142f455ce74237cbdf191d6a8b65ed11e30a4d2aa92d32f0d55404d793d57
Opcode Fuzzy Hash: d3f0b44b8dfac2748f7b01a57bccc78e5db9f36cda53f2636770433d8a545889
Instruction Fuzzy Hash: 1DC1C774E01218CFDB58EFA5C990BAEFBB2BF49300F5081A9D409AB255DB349E85CF51

Function 00E1D0A8 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00E1D136
GetCurrentThread.KERNEL32 ref: 00E1D173
GetCurrentProcess.KERNEL32 ref: 00E1D1B0
GetCurrentThreadId.KERNEL32 ref: 00E1D209

Memory Dump Source

Source File: 00000002.00000002.1851803956.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e10000_po4877383.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 43fec27dcab2b6a5321b0528cb4f7683996aa64ddcfad3ce0e82267b0b884f3f
Instruction ID: dc45423fec672338a0c2c9063763f744dbc430dac30b022d115ba53d135c5969
Opcode Fuzzy Hash: 43fec27dcab2b6a5321b0528cb4f7683996aa64ddcfad3ce0e82267b0b884f3f
Instruction Fuzzy Hash: D15187B49012499FDB14CFA9D948BDEBBF1EF88314F20845DE019B73A0D774A984CB65

Function 00E1D0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00E1D136
GetCurrentThread.KERNEL32 ref: 00E1D173
GetCurrentProcess.KERNEL32 ref: 00E1D1B0
GetCurrentThreadId.KERNEL32 ref: 00E1D209

Memory Dump Source

Source File: 00000002.00000002.1851803956.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e10000_po4877383.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4832447f7142a38c8d3ea0160703d529a7ad990242802589569897000969f6b2
Instruction ID: 919741d6951f9c736329b5ed1a9b15ebc749dfb1332b1653337bdfd5547ecdaf
Opcode Fuzzy Hash: 4832447f7142a38c8d3ea0160703d529a7ad990242802589569897000969f6b2
Instruction Fuzzy Hash: BE5177B4900209DFDB14CFAAD948BDEBBF1EF88314F208459E119B73A0D774A984CB65

Function 00E1AE30 Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00E1B086

Memory Dump Source

Source File: 00000002.00000002.1851803956.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e10000_po4877383.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d7b7a1c07a1b47aa781c27bc6dc18a060e1a3b16822932873682839436eecb16
Instruction ID: 9e51f815757f1bab0e44ec192a5a9df3f5b19d0cff58a6a2f97b9b6f171ac95c
Opcode Fuzzy Hash: d7b7a1c07a1b47aa781c27bc6dc18a060e1a3b16822932873682839436eecb16
Instruction Fuzzy Hash: E3817DB0A01B058FD724DF69D0417AABBF1FF48304F04892DE09AE7A51D775E986CB91

Function 04E31CE4 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04E31E02

Memory Dump Source

Source File: 00000002.00000002.1859073928.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4e30000_po4877383.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9414882a5149e654e9024511eb6550bd8c0ef58ca6b67d42d528f8c110438b71
Instruction ID: 00a581e0cbda113bfff293bebfc9310a5cf646217f1b8cc9a6cc234846ed6e1e
Opcode Fuzzy Hash: 9414882a5149e654e9024511eb6550bd8c0ef58ca6b67d42d528f8c110438b71
Instruction Fuzzy Hash: B251B3B1D103499FDB15CF9AC984ADEFBB6BF48314F64912AE418AB210D771A845CF90

Function 04E31CF0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04E31E02

Memory Dump Source

Source File: 00000002.00000002.1859073928.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4e30000_po4877383.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 85225ba8e044e8820c8f46f130da0c18275f0e051664c535bee240f0d0954d2b
Instruction ID: 1c9d5e2925e5a5c74e218d45f6fb8e26f009ba8abfa31f1bb9b6aef1eb83b26d
Opcode Fuzzy Hash: 85225ba8e044e8820c8f46f130da0c18275f0e051664c535bee240f0d0954d2b
Instruction Fuzzy Hash: F541C1B1D103499FDB15CF9AC984ADEFBB6BF48314F64912EE818AB210D771A845CF90

Function 04E30BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04E34381

Memory Dump Source

Source File: 00000002.00000002.1859073928.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4e30000_po4877383.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 6f378563059aef757a4a4ddd063d93072cf62942e68141e084dbec760cd33bc3
Instruction ID: c8b321b5333f5535816a44d6c9716c12745127aa0c7252001f20ea84f2215ee3
Opcode Fuzzy Hash: 6f378563059aef757a4a4ddd063d93072cf62942e68141e084dbec760cd33bc3
Instruction Fuzzy Hash: 914127B8A00309CFDB15CF99C488AAABBF5FF88314F24C559D519AB361D374A841CBA0

Function 00E15935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00E159F1

Memory Dump Source

Source File: 00000002.00000002.1851803956.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e10000_po4877383.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 78c78c9d839170af332803a2c60372c1438a5fa80e515de8437397f243fef1ea
Instruction ID: bc314a153495642dfa3d78923c8d9966ae7f8aad1b3a9bfb7599b03b02531a2b
Opcode Fuzzy Hash: 78c78c9d839170af332803a2c60372c1438a5fa80e515de8437397f243fef1ea
Instruction Fuzzy Hash: 7F41CEB5D00719CEDB24CFA9C984ACEBBB5FF88304F20816AD418BB251DB756985CF90

Function 00E14248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00E159F1

Memory Dump Source

Source File: 00000002.00000002.1851803956.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e10000_po4877383.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: bce8c81c319871da8f420884dcae4d8f9afc2d5ac8188d9e1239a14a32007061
Instruction ID: 497735bcb6cc18809fac590f2d98c2e183662bf6620849b402ff8a48c1083f25
Opcode Fuzzy Hash: bce8c81c319871da8f420884dcae4d8f9afc2d5ac8188d9e1239a14a32007061
Instruction Fuzzy Hash: 4641D4B5D00719CADB24CFA9C984BDEBBB5FF84304F20816AD408BB251DB756945CF90

Function 04E37219 Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1859073928.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4e30000_po4877383.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8ea879d2a4128159b916b1579d15fe65525f647dd061b8176a09775947a415
Instruction ID: 5cc5a2007ab47956d329c85d7eaaeb56a12aaa23bf29df27eb26d0eb0cdfec61
Opcode Fuzzy Hash: 2b8ea879d2a4128159b916b1579d15fe65525f647dd061b8176a09775947a415
Instruction Fuzzy Hash: 5621E7B4E05218DFCB09CFA8E9886ECBBB1BF49315F14916AE405B3361D7305941DB54

Function 00E1D2F9 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00E1D387

Memory Dump Source

Source File: 00000002.00000002.1851803956.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e10000_po4877383.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6fc3503f67aaa42e2eb2fb33048922ed9fcecac698de87e9a8c0c2f7d685e821
Instruction ID: 9c10cc38528db4c361dd5ea3ea66f36c8c65a2c03fbb8217759ffa53c170276e
Opcode Fuzzy Hash: 6fc3503f67aaa42e2eb2fb33048922ed9fcecac698de87e9a8c0c2f7d685e821
Instruction Fuzzy Hash: AB21E3B5901249AFDB10CF9AD985ADEFBF9FB48324F14841AE918B7310D374A950CFA1

Function 00E1D300 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00E1D387

Memory Dump Source

Source File: 00000002.00000002.1851803956.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e10000_po4877383.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c7fa0a6aa51d48a053567bf92e11d6ae28f6ceefc400ecfedd0d42abd7684370
Instruction ID: 16c64cfe144a32b50c6e9b0ed049d625fc9c9ba806042b7466baf6ae734ec5dc
Opcode Fuzzy Hash: c7fa0a6aa51d48a053567bf92e11d6ae28f6ceefc400ecfedd0d42abd7684370
Instruction Fuzzy Hash: FD21E4B59002489FDB10CF9AD984ADEFBF9EB48320F14801AE918B3310C374A950CFA1

Function 06A56080 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06A560E5

Memory Dump Source

Source File: 00000002.00000002.1866118780.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a50000_po4877383.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: d086a748e9047e4bfb4883f1edf01cd82c42bfd253f404869ce7ed3366408f1c
Instruction ID: 3ca8f9cba276471c81390e3fa1847366627d47396470074ab8c611896401203d
Opcode Fuzzy Hash: d086a748e9047e4bfb4883f1edf01cd82c42bfd253f404869ce7ed3366408f1c
Instruction Fuzzy Hash: 2911F5B58003499FDB10DF9AD845BDEFFF8EB48324F20841AE954A7610C375A944CFA1

Function 06A54F40 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06A560E5

Memory Dump Source

Source File: 00000002.00000002.1866118780.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a50000_po4877383.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1a033bacb94656c09dc60ad5e4e1683a7ac85f31010927e56b9b21cacfa31289
Instruction ID: a1299fb6d58b6d7a3057dcc2b921bf46bf28e8aa4d16a1a586cae2ab153f34dc
Opcode Fuzzy Hash: 1a033bacb94656c09dc60ad5e4e1683a7ac85f31010927e56b9b21cacfa31289
Instruction Fuzzy Hash: 2711F5B58003499FDB60DF99C885BDEFBF8EB48324F24841AE954A7610C375A944CFA1

Function 00E1B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00E1B086

Memory Dump Source

Source File: 00000002.00000002.1851803956.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e10000_po4877383.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 303ce21559225b7427fc6fe01d4fb5e72d7d997ef6b666353e52991a60f81d86
Instruction ID: 73568689f7ebee58a90510aa4c7521805ed2d2d4125bcd37721b0cf7fba0afa6
Opcode Fuzzy Hash: 303ce21559225b7427fc6fe01d4fb5e72d7d997ef6b666353e52991a60f81d86
Instruction Fuzzy Hash: B611DFB5C00349CFDB20CF9AD444ADEFBF9AB88324F14841AD469B7610C379A645CFA1

Function 00D7D654 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1851532580.0000000000D7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d7d000_po4877383.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffe36b5b592492ae7ee5bddf7b8b1c970fb5d18a3b0d712722a9f5decfbaf7e3
Instruction ID: 06a1b8486a6597aadd1905fe00e13a64770fe2d6385ae153255f9729b5750613
Opcode Fuzzy Hash: ffe36b5b592492ae7ee5bddf7b8b1c970fb5d18a3b0d712722a9f5decfbaf7e3
Instruction Fuzzy Hash: 9021F4B6504244EFCB099F14D9C0B2ABFB6FF88314F24C669E94D0A256D336D816DBB1

Function 00D7D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1851532580.0000000000D7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d7d000_po4877383.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96a6c1a7247bc04f3500da123a9d2797117e5d90c965d6611b2513c0151691b2
Instruction ID: 1b86b6a5ff84b0ad688db4f15eb4096cb272a0f71621a23af6a391ba6dccfd99
Opcode Fuzzy Hash: 96a6c1a7247bc04f3500da123a9d2797117e5d90c965d6611b2513c0151691b2
Instruction Fuzzy Hash: B32121B1504200DFCB05DF14C9C0B26BF76FF88328F24C569E9490A256D336D806CAB1

Function 00D8D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1851579427.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d8d000_po4877383.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae9dfdd514f4dbb07703a6cc5746dca9c3e20d7b1a5f3709f9b480f73ef61be
Instruction ID: b0e6d7758d964e1761e98627b0c7810d01117eddb35b312f7eb6b1904bbb63b9
Opcode Fuzzy Hash: aae9dfdd514f4dbb07703a6cc5746dca9c3e20d7b1a5f3709f9b480f73ef61be
Instruction Fuzzy Hash: 8221D0B5604204EFDB14EF14D9C0B26BB66EB84314F24C969E94A4B2D6C73AD847CB71

Function 00D8D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1851579427.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d8d000_po4877383.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d794909375e8c16b3dd0bdfefb35b2a4231777a5d08dcf0891ddbc0ec6fff375
Instruction ID: 6b2ff8b8acbf15829ad8a03fd0fa4ea9afc628ef4246d613b6c484ffa1eb4bd7
Opcode Fuzzy Hash: d794909375e8c16b3dd0bdfefb35b2a4231777a5d08dcf0891ddbc0ec6fff375
Instruction Fuzzy Hash: C42180755093808FDB12DF24D990715BF72EB46314F28C5EAD8498B6E7C33A984ACB62

Function 00D7D64F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1851532580.0000000000D7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d7d000_po4877383.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2dec59e3151889acede25dbdc09f1e0996748c90a37620c8196c664727292b
Instruction ID: 2abbc854497bc42eb4df3fca1697f04836fc824dd97a34bc1644799e3cd9462b
Opcode Fuzzy Hash: ad2dec59e3151889acede25dbdc09f1e0996748c90a37620c8196c664727292b
Instruction Fuzzy Hash: 7721AF76504280DFCB1ACF10D9C4B16BF72FF88314F28C6A9D9494B656C33AD866CBA1

Function 00D7D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1851532580.0000000000D7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d7d000_po4877383.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction ID: d19224a8eb9f94daf9527bdbd23d6824d6f99183e4aaa4905ba34652f25f9d79
Opcode Fuzzy Hash: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction Fuzzy Hash: 5511E676504280CFCB16CF14D5C4B16BF72FF94328F28C6A9D8494B656C33AD85ACBA1

Function 00D7D989 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1851532580.0000000000D7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d7d000_po4877383.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7845dc9577fd14723585dd35937f9756b4747445dcfa0bbf1c05a0368603ba4
Instruction ID: 62913ca0d60f07cbd1bb058c4eb783c203951d4201c564d5acaf4446dc790145
Opcode Fuzzy Hash: c7845dc9577fd14723585dd35937f9756b4747445dcfa0bbf1c05a0368603ba4
Instruction Fuzzy Hash: F501F772005340AAE7104A29C8C0726FFB9DF51324F1CC41AEE4D5A182D738D840DA71

Function 00D7D988 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1851532580.0000000000D7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d7d000_po4877383.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca915e411f0917a2fc706ba2052f84340f286d141d99badff6fda62bf386a136
Instruction ID: 3859ace61801d4a990f57db7751b4a9ec5b889428810eb5409c881fa7b8b079b
Opcode Fuzzy Hash: ca915e411f0917a2fc706ba2052f84340f286d141d99badff6fda62bf386a136
Instruction Fuzzy Hash: 09F0C272404340AEEB208A0AD8C4B66FFE9EF50324F18C05AEE4C5A282C3799840CA71

Non-executed Functions

Function 06A524FC Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1866118780.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a50000_po4877383.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb758a4830d9264f1f1f7c71f6748c07045f3726551b6a2894dad58eb5292c99
Instruction ID: 12bf7a1364cb28130fc4c36631f49eae763d33ef82855f4d4dcb2e32bbb94384
Opcode Fuzzy Hash: fb758a4830d9264f1f1f7c71f6748c07045f3726551b6a2894dad58eb5292c99
Instruction Fuzzy Hash: 8CF0C970C44219CFEB64EF50D8A87BDBB70BB06305F115055C816B7290C7784A84CFD4

Function 06A50929 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1866118780.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a50000_po4877383.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0808d09c95269485abacca31cf88e7a7b05e423ce0d430f62d4565919d6fbf41
Instruction ID: a71d28b50f80f3382a94464e39d4de4d7fc8a0314119dd15735f28a8a30259d3
Opcode Fuzzy Hash: 0808d09c95269485abacca31cf88e7a7b05e423ce0d430f62d4565919d6fbf41
Instruction Fuzzy Hash: C2E06D30C5A10EDEFB50EF51C5107FFF6707B02314F215445CC0577244CB704A448A91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report po4877383.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\po4877383.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

Windows Analysis Report
po4877383.exe

Function 012DD468 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Function 012DD478 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 012DADE8 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Function 012D44B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 012D590C Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Function 012DD6B9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Function 012DD6C0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 012DAFD8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 06A53A98 Relevance: 5.5, Strings: 4, Instructions: 496
COMMON

Function 06A51218 Relevance: 5.3, Strings: 4, Instructions: 271
COMMON

Function 00E1D0A8 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Function 00E1D0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 00E1AE30 Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Function 04E31CE4 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Function 04E31CF0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 04E30BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 00E15935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 00E14248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON