Edit tour

Windows Analysis Report
PO-1BdyzarvrjUANe0.exe

Overview

General Information

Sample name:	PO-1BdyzarvrjUANe0.exe
Analysis ID:	1539389
MD5:	fac116ca092033649c6a8ae32e000508
SHA1:	5139cdc83309a71256413e6e9948098deeb4f144
SHA256:	dd7864aca2acdf7738015e6568b6d6fe2f425137c81dcfb19ba491852678b4a7
Tags:	exeredlineRedLineStealeruser-malwarelabnet
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected RedLine Stealer

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

PO-1BdyzarvrjUANe0.exe (PID: 4364 cmdline: "C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe" MD5: FAC116CA092033649C6A8AE32E000508)

PO-1BdyzarvrjUANe0.exe (PID: 1732 cmdline: "C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe" MD5: FAC116CA092033649C6A8AE32E000508)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["188.190.10.19:1912"], "Bot Id": "FROSHLOG", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.1988809355.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1762571849.00000000040C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1762571849.00000000041E6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1762571849.000000000419B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.1990328338.00000000030A3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PO-1BdyzarvrjUANe0.exe PID: 4364	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PO-1BdyzarvrjUANe0.exe PID: 4364	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: PO-1BdyzarvrjUANe0.exe PID: 1732	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PO-1BdyzarvrjUANe0.exe PID: 1732	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.PO-1BdyzarvrjUANe0.exe.41a3f78.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.PO-1BdyzarvrjUANe0.exe.4158d58.5.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.PO-1BdyzarvrjUANe0.exe.41a3f78.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.PO-1BdyzarvrjUANe0.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.PO-1BdyzarvrjUANe0.exe.4158d58.5.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-22T16:11:14.379136+0200	2043234	1	A Network Trojan was detected	188.190.10.19	1912	192.168.2.4	49733	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-22T16:11:14.127926+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:19.480034+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:20.682993+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:20.981360+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:21.563029+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:21.838802+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:22.271687+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:22.686846+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:22.692481+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:23.634154+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:23.890863+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:24.194379+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:24.239630+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:24.538120+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:28.068897+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:28.381917+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:33.171919+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:33.752102+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:33.998709+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:34.246772+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:34.648432+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-22T16:11:20.689742+0200	2046056	1	A Network Trojan was detected	188.190.10.19	1912	192.168.2.4	49733	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-22T16:11:14.127926+0200	2046045	1	A Network Trojan was detected	192.168.2.4	49733	188.190.10.19	1912	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: PO-1BdyzarvrjUANe0.exe

Avira: detected

Found malware configuration

Source: 2.2.PO-1BdyzarvrjUANe0.exe.400000.0.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["188.190.10.19:1912"], "Bot Id": "FROSHLOG", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Multi AV Scanner detection for submitted file

Source: PO-1BdyzarvrjUANe0.exe

ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: PO-1BdyzarvrjUANe0.exe

Joe Sandbox ML: detected

Source: PO-1BdyzarvrjUANe0.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PO-1BdyzarvrjUANe0.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 4x nop then jmp 06C459FCh	2_2_06C45738
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 4x nop then jmp 06C49160h	2_2_06C48C68
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 4x nop then jmp 06C461FFh	2_2_06C45AA0
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 4x nop then jmp 06C43976h	2_2_06C43955
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 4x nop then jmp 07215BE2h	2_2_072157C0
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 4x nop then jmp 07216062h	2_2_072157C0
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 4x nop then jmp 07214DB1h	2_2_07214D99

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.4:49733 -> 188.190.10.19:1912
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.4:49733 -> 188.190.10.19:1912
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 188.190.10.19:1912 -> 192.168.2.4:49733
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 188.190.10.19:1912 -> 192.168.2.4:49733

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 188.190.10.19:1912

Source: global traffic

TCP traffic: 192.168.2.4:49733 -> 188.190.10.19:1912

Source: Joe Sandbox View

ASN Name: ASINTTELUA ASINTTELUA

Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.000000000304C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000003212000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.00000000030A3000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000003223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000003227000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000003227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000003223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765357290.0000000005A29000.00000004.00000020.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765499513.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003EF6000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042A1000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042B7000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003F12000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003E85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1762571849.00000000040C9000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1762571849.00000000041E6000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1762571849.000000000419B000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1988809355.0000000000402000.00000040.00000400.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003EF6000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042A1000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042B7000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003F12000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003E85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003EF6000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042A1000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042B7000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003F12000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003E85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003EF6000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042A1000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042B7000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003F12000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003E85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003EF6000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042A1000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042B7000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003F12000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003E85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042A1000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042B7000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003EF6000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003E85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003EF6000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042A1000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042B7000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003F12000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003E85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003EF6000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042A1000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042B7000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003F12000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003E85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003EF6000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042A1000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042B7000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003F12000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003E85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_078611E0	0_2_078611E0
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_07854D3B	0_2_07854D3B
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_02EB3E6C	0_2_02EB3E6C
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_02EBE06C	0_2_02EBE06C
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_02EBCA70	0_2_02EBCA70
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_02EB70E8	0_2_02EB70E8
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_0563A8E8	0_2_0563A8E8
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_0563A8D8	0_2_0563A8D8
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_09038D98	0_2_09038D98
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_0903B148	0_2_0903B148
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_09034A88	0_2_09034A88
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_09034AB0	0_2_09034AB0
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_09038D89	0_2_09038D89
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_09034ED9	0_2_09034ED9
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_09034EE8	0_2_09034EE8
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_09037000	0_2_09037000
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_09035311	0_2_09035311
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_09035320	0_2_09035320
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_09036718	0_2_09036718
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_09036728	0_2_09036728
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_014BDC74	2_2_014BDC74
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_06C423A0	2_2_06C423A0
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_06C41E30	2_2_06C41E30
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_06C47FB8	2_2_06C47FB8
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_06C42C9A	2_2_06C42C9A
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_06C48C68	2_2_06C48C68
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_06C45AA0	2_2_06C45AA0
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_06C4BA48	2_2_06C4BA48
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_06C46A00	2_2_06C46A00
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_06C43A08	2_2_06C43A08
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_06C4A8F0	2_2_06C4A8F0
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_06C44928	2_2_06C44928
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_06C4020F	2_2_06C4020F
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_06C40220	2_2_06C40220
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_06C42393	2_2_06C42393
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_06C47FA8	2_2_06C47FA8
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_06C439F8	2_2_06C439F8
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_072157C0	2_2_072157C0
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_07213E70	2_2_07213E70
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_07212598	2_2_07212598
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_072144B0	2_2_072144B0
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_07217C88	2_2_07217C88
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_07212CE2	2_2_07212CE2
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_07215120	2_2_07215120
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_072157AF	2_2_072157AF
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_07213E60	2_2_07213E60
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_0721143F	2_2_0721143F
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_07211488	2_2_07211488
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_07211B80	2_2_07211B80
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_07211B90	2_2_07211B90
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_0721510F	2_2_0721510F
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_072109B0	2_2_072109B0
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_072101D8	2_2_072101D8
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 2_2_07211008	2_2_07211008

Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1767570025.0000000007AF0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs PO-1BdyzarvrjUANe0.exe
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000000.1731733536.0000000000CB2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameegW.exe6 vs PO-1BdyzarvrjUANe0.exe
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1762571849.00000000041E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs PO-1BdyzarvrjUANe0.exe
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1762571849.0000000004231000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs PO-1BdyzarvrjUANe0.exe
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1762571849.0000000004231000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs PO-1BdyzarvrjUANe0.exe
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1762571849.000000000419B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs PO-1BdyzarvrjUANe0.exe
Source: PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1761067913.000000000136E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PO-1BdyzarvrjUANe0.exe
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs PO-1BdyzarvrjUANe0.exe
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1988809355.0000000000446000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs PO-1BdyzarvrjUANe0.exe
Source: PO-1BdyzarvrjUANe0.exe	Binary or memory string: OriginalFilenameegW.exe6 vs PO-1BdyzarvrjUANe0.exe

Source: PO-1BdyzarvrjUANe0.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PO-1BdyzarvrjUANe0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, rZkRXysfeXVYoA0RyF.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, rZkRXysfeXVYoA0RyF.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, rZkRXysfeXVYoA0RyF.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, GmKRKQHfmJtcXPTxir.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, rZkRXysfeXVYoA0RyF.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, rZkRXysfeXVYoA0RyF.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, rZkRXysfeXVYoA0RyF.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, GmKRKQHfmJtcXPTxir.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, rZkRXysfeXVYoA0RyF.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, rZkRXysfeXVYoA0RyF.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, rZkRXysfeXVYoA0RyF.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, GmKRKQHfmJtcXPTxir.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@0/1

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO-1BdyzarvrjUANe0.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe

Mutant created: NULL

Source: PO-1BdyzarvrjUANe0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PO-1BdyzarvrjUANe0.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.000000000335A000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000003371000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000003402000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.00000000033EB000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.000000000337F000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: PO-1BdyzarvrjUANe0.exe

ReversingLabs: Detection: 63%

Source: unknown	Process created: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe "C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe"
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process created: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe "C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe"
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process created: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe "C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: PO-1BdyzarvrjUANe0.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO-1BdyzarvrjUANe0.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, rZkRXysfeXVYoA0RyF.cs	.Net Code: cO9dfS0OgE System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, rZkRXysfeXVYoA0RyF.cs	.Net Code: cO9dfS0OgE System.Reflection.Assembly.Load(byte[])
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, rZkRXysfeXVYoA0RyF.cs	.Net Code: cO9dfS0OgE System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_0563C45F push cs; iretd	0_2_0563C463
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_0563264A push esp; retf	0_2_05632651
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_05632648 pushad ; retf	0_2_05632649
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_05632A5D push eax; iretd	0_2_05632A5E
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_09030526 push ss; ret	0_2_09030527
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Code function: 0_2_090304E7 push ebp; ret	0_2_090304E8

Source: PO-1BdyzarvrjUANe0.exe

Static PE information: section name: .text entropy: 7.838098776126378

Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, rZkRXysfeXVYoA0RyF.cs	High entropy of concatenated method names: 'OdAya5Xty1', 'hTdyLF1FPF', 'jbGyPKBMOM', 'hACyCIKyPw', 'AIHyrmRrFN', 'EmhyQQvrg9', 'A4DylgevBB', 'JIUyJK2FUg', 'F5TyMe6Tho', 'CsAy4dCL9r'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, seuy09AN5b7faHphXp.cs	High entropy of concatenated method names: 'fbpf9MBjV', 'l1qhVBe8K', 'uE5FIErJw', 'zpiNwPTkN', 'xvX9QPP1X', 'BDyGGYYrR', 'k2w7ALSAgd8Mmaqpss', 'nn9HuA3TE0U4RLyxqp', 'LreHt2RXC', 'aATWvc8lm'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, GjQ6XwkJjat9GxPDcu.cs	High entropy of concatenated method names: 'RB4es3gYYM', 'NwtetTOFgU', 'AyRHOM8gQg', 'mWeHIf1OUn', 'IpbeB1mis4', 'y19e7r8JMl', 'kn3ejKDaeQ', 'X0qegRsuK9', 'e0KeEEh1W5', 'oIGeY0Rsh2'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, JJKg8ebTUChCQXE5oX.cs	High entropy of concatenated method names: 'vhnr06OJvK', 'j6yrNHEyb3', 'UEMCiTeVTL', 'TclCk6H9SX', 'nQACRl7dKg', 'FcVCKTScn1', 'DHoC3SBukB', 'othC1G59ik', 'PPyCU1qTQi', 'xB7CSbhWw2'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, GmKRKQHfmJtcXPTxir.cs	High entropy of concatenated method names: 'qcMPgxnB26', 'aBXPETBsgh', 'XByPYmKH74', 'OpNP8Nq3RN', 'Y0IPVQKHdM', 'l4gPwgOfpG', 'bNbPpWkktb', 'tP8PskdE3q', 'drkPAuKSmE', 'UvuPt11LC1'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, OcxLs3zlQmvuaKcpmq.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'hM9Z6bCfqD', 'W7PZv2yJYU', 'GXSZo8WPe4', 'LMZZeILXc9', 'md1ZHAnS8i', 'H5QZZ8VGfF', 'PdiZWl2jDU'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, p6xnyVPjFleaBgG9Ju.cs	High entropy of concatenated method names: 'euVHLXVKR1', 'lXrHPKpjLa', 'swkHC1Klyx', 'QTqHrVuW7Z', 'ykeHQCFxwM', 'BkcHlPbPJq', 'u6hHJD7nhE', 'pZOHMZPond', 'FWeH4HJJq4', 'yYKHc8HPFH'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, MWgFDSRB8wfb0WKC1k.cs	High entropy of concatenated method names: 'Dispose', 'O5PIAyxZjx', 'V5x2uunWEL', 'sTpxxZ2YCy', 'bXeItT9vij', 'IuVIzPG4Ft', 'ProcessDialogKey', 'tdA2OU7vtE', 'jnu2IsODYL', 'Rta227t265'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, amgQhAT7fPN3ud71RvY.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'JlUWgHAAtT', 'Mj7WErHjuB', 'mFbWYoWvQm', 'jXJW8prIes', 'TtHWVtSQZv', 't2KWw4TQH2', 'j1dWp5QyTn'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, bw2npPvQrAROUjGtgC.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'AKN2AJqwlw', 'Yx82tfvSsf', 'JlX2zB1C9O', 'Bf4yOFTVVZ', 'WvByIgF7FP', 'sNTy2GpvRW', 'n5byyhddYF', 'qRgJOhjVJOFCbRmU8pb'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, FQ4Pw8O5w1fgK4LJ1T.cs	High entropy of concatenated method names: 'N1sChtn6Gp', 'jgyCFqQgTa', 'HicC59yIkc', 'ufKC9RKXAd', 'BYuCvbm0rx', 'L1NCoolabg', 'wJyCe9n3vJ', 'ySrCHfltSj', 'h6PCZPuFAB', 'PHOCWVjgJ7'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, x8EQAbobrC1c1P7M6y.cs	High entropy of concatenated method names: 'IHYHDIsMHw', 'FUtHu1cI4M', 'VQvHi9SKh1', 'xAdHk1eZQp', 'S6aHglQNl6', 'L5ZHRw6SE6', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, t7UJ2KQ1IBo4N52oUu.cs	High entropy of concatenated method names: 'nojIldKFaK', 'QsqIJhJQOn', 'JtVI4sE4Xw', 'JaMIcCOVY7', 'ihOIvJxkBO', 'nF6IoiecPS', 'OhkBVqx6qR4Lkfjvoo', 'Ex8QZkDIV3MfpbJh2X', 'qh0IINUTRW', 'iAgIyTbiIx'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, d4egtNJefeVgDQmw9Y.cs	High entropy of concatenated method names: 'vInQaGxjvb', 'y4dQPLQjyb', 'sIUQrV5pIT', 'BHyQlV3oMb', 'gt2QJKrNYX', 'W98rVKYyPf', 'I4JrwI967W', 'KUErpeqcnn', 'uaPrsrvhPI', 'XH3rAxeUc2'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, j9HJJUeI9tO23YHRcJ.cs	High entropy of concatenated method names: 'ToString', 'rWYoBQc5sV', 'S07ouIgNoW', 'BehoiH2cMg', 'VjrokF7dUT', 'r30oRUpFG3', 'LnMoKijCeF', 'OHKo3iNYfq', 'Fxmo10x1QA', 'm5xoUDWdrp'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, YPFVHDdxNPJPKBZRSO.cs	High entropy of concatenated method names: 'afRlqtAohS', 'eaWlXUjKvC', 'oKulfv9svr', 'psLlhBfMCQ', 'auSl0CeH0F', 'qAslFxY1wk', 'RwhlN8J9ch', 'wgCl5Dutwl', 'HKOl9VDWLs', 'DjqlGDmhVs'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, woU1cATS60TfWJL5KwE.cs	High entropy of concatenated method names: 'LPMZqlVoYe', 'mVgZXi6XHl', 'PYvZfC4r2a', 'E97Zh4gQaV', 'PXeZ0Fsy6L', 'rFjZFXRYWi', 'GGOZNR0Ofw', 'p6RZ5xtAPr', 'i8KZ9icNep', 'WieZGM5NSb'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, hBgXbn67oTOR8K1VGC.cs	High entropy of concatenated method names: 'y83652ApkE', 'VZx69rpyuc', 'GDt6D5apva', 'AUw6u3D5wD', 'fb66klOAtO', 'xcX6RdJkw0', 'IcY63eou9R', 'PNo61jX9uM', 'iYS6SEOROs', 'q7D6Bha5rM'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, lwSFEgGO8fQVunmcX5.cs	High entropy of concatenated method names: 'RE7ZI39oy3', 'iVDZymCg1J', 'aWKZdNNhP7', 'ndVZLnZnrN', 'c43ZPcrvx9', 'WZpZrSvqnp', 'uYFZQI7jMC', 'TmkHpSeHna', 'AYSHs8YAPu', 'fOWHA5A4RP'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.7af0000.7.raw.unpack, aQsUnflvEEP8Xc3DWo.cs	High entropy of concatenated method names: 'UY8vSFCh0x', 'VpZv762IZK', 'TBSvgxtxtI', 'dNEvE4njyP', 'tsovuig9qS', 'TrZviFtcak', 't7hvk70fRC', 'ljTvR4JK69', 'G3tvKGaOIg', 'x8Bv3A0jml'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, rZkRXysfeXVYoA0RyF.cs	High entropy of concatenated method names: 'OdAya5Xty1', 'hTdyLF1FPF', 'jbGyPKBMOM', 'hACyCIKyPw', 'AIHyrmRrFN', 'EmhyQQvrg9', 'A4DylgevBB', 'JIUyJK2FUg', 'F5TyMe6Tho', 'CsAy4dCL9r'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, seuy09AN5b7faHphXp.cs	High entropy of concatenated method names: 'fbpf9MBjV', 'l1qhVBe8K', 'uE5FIErJw', 'zpiNwPTkN', 'xvX9QPP1X', 'BDyGGYYrR', 'k2w7ALSAgd8Mmaqpss', 'nn9HuA3TE0U4RLyxqp', 'LreHt2RXC', 'aATWvc8lm'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, GjQ6XwkJjat9GxPDcu.cs	High entropy of concatenated method names: 'RB4es3gYYM', 'NwtetTOFgU', 'AyRHOM8gQg', 'mWeHIf1OUn', 'IpbeB1mis4', 'y19e7r8JMl', 'kn3ejKDaeQ', 'X0qegRsuK9', 'e0KeEEh1W5', 'oIGeY0Rsh2'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, JJKg8ebTUChCQXE5oX.cs	High entropy of concatenated method names: 'vhnr06OJvK', 'j6yrNHEyb3', 'UEMCiTeVTL', 'TclCk6H9SX', 'nQACRl7dKg', 'FcVCKTScn1', 'DHoC3SBukB', 'othC1G59ik', 'PPyCU1qTQi', 'xB7CSbhWw2'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, GmKRKQHfmJtcXPTxir.cs	High entropy of concatenated method names: 'qcMPgxnB26', 'aBXPETBsgh', 'XByPYmKH74', 'OpNP8Nq3RN', 'Y0IPVQKHdM', 'l4gPwgOfpG', 'bNbPpWkktb', 'tP8PskdE3q', 'drkPAuKSmE', 'UvuPt11LC1'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, OcxLs3zlQmvuaKcpmq.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'hM9Z6bCfqD', 'W7PZv2yJYU', 'GXSZo8WPe4', 'LMZZeILXc9', 'md1ZHAnS8i', 'H5QZZ8VGfF', 'PdiZWl2jDU'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, p6xnyVPjFleaBgG9Ju.cs	High entropy of concatenated method names: 'euVHLXVKR1', 'lXrHPKpjLa', 'swkHC1Klyx', 'QTqHrVuW7Z', 'ykeHQCFxwM', 'BkcHlPbPJq', 'u6hHJD7nhE', 'pZOHMZPond', 'FWeH4HJJq4', 'yYKHc8HPFH'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, MWgFDSRB8wfb0WKC1k.cs	High entropy of concatenated method names: 'Dispose', 'O5PIAyxZjx', 'V5x2uunWEL', 'sTpxxZ2YCy', 'bXeItT9vij', 'IuVIzPG4Ft', 'ProcessDialogKey', 'tdA2OU7vtE', 'jnu2IsODYL', 'Rta227t265'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, amgQhAT7fPN3ud71RvY.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'JlUWgHAAtT', 'Mj7WErHjuB', 'mFbWYoWvQm', 'jXJW8prIes', 'TtHWVtSQZv', 't2KWw4TQH2', 'j1dWp5QyTn'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, bw2npPvQrAROUjGtgC.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'AKN2AJqwlw', 'Yx82tfvSsf', 'JlX2zB1C9O', 'Bf4yOFTVVZ', 'WvByIgF7FP', 'sNTy2GpvRW', 'n5byyhddYF', 'qRgJOhjVJOFCbRmU8pb'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, FQ4Pw8O5w1fgK4LJ1T.cs	High entropy of concatenated method names: 'N1sChtn6Gp', 'jgyCFqQgTa', 'HicC59yIkc', 'ufKC9RKXAd', 'BYuCvbm0rx', 'L1NCoolabg', 'wJyCe9n3vJ', 'ySrCHfltSj', 'h6PCZPuFAB', 'PHOCWVjgJ7'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, x8EQAbobrC1c1P7M6y.cs	High entropy of concatenated method names: 'IHYHDIsMHw', 'FUtHu1cI4M', 'VQvHi9SKh1', 'xAdHk1eZQp', 'S6aHglQNl6', 'L5ZHRw6SE6', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, t7UJ2KQ1IBo4N52oUu.cs	High entropy of concatenated method names: 'nojIldKFaK', 'QsqIJhJQOn', 'JtVI4sE4Xw', 'JaMIcCOVY7', 'ihOIvJxkBO', 'nF6IoiecPS', 'OhkBVqx6qR4Lkfjvoo', 'Ex8QZkDIV3MfpbJh2X', 'qh0IINUTRW', 'iAgIyTbiIx'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, d4egtNJefeVgDQmw9Y.cs	High entropy of concatenated method names: 'vInQaGxjvb', 'y4dQPLQjyb', 'sIUQrV5pIT', 'BHyQlV3oMb', 'gt2QJKrNYX', 'W98rVKYyPf', 'I4JrwI967W', 'KUErpeqcnn', 'uaPrsrvhPI', 'XH3rAxeUc2'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, j9HJJUeI9tO23YHRcJ.cs	High entropy of concatenated method names: 'ToString', 'rWYoBQc5sV', 'S07ouIgNoW', 'BehoiH2cMg', 'VjrokF7dUT', 'r30oRUpFG3', 'LnMoKijCeF', 'OHKo3iNYfq', 'Fxmo10x1QA', 'm5xoUDWdrp'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, YPFVHDdxNPJPKBZRSO.cs	High entropy of concatenated method names: 'afRlqtAohS', 'eaWlXUjKvC', 'oKulfv9svr', 'psLlhBfMCQ', 'auSl0CeH0F', 'qAslFxY1wk', 'RwhlN8J9ch', 'wgCl5Dutwl', 'HKOl9VDWLs', 'DjqlGDmhVs'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, woU1cATS60TfWJL5KwE.cs	High entropy of concatenated method names: 'LPMZqlVoYe', 'mVgZXi6XHl', 'PYvZfC4r2a', 'E97Zh4gQaV', 'PXeZ0Fsy6L', 'rFjZFXRYWi', 'GGOZNR0Ofw', 'p6RZ5xtAPr', 'i8KZ9icNep', 'WieZGM5NSb'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, hBgXbn67oTOR8K1VGC.cs	High entropy of concatenated method names: 'y83652ApkE', 'VZx69rpyuc', 'GDt6D5apva', 'AUw6u3D5wD', 'fb66klOAtO', 'xcX6RdJkw0', 'IcY63eou9R', 'PNo61jX9uM', 'iYS6SEOROs', 'q7D6Bha5rM'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, lwSFEgGO8fQVunmcX5.cs	High entropy of concatenated method names: 'RE7ZI39oy3', 'iVDZymCg1J', 'aWKZdNNhP7', 'ndVZLnZnrN', 'c43ZPcrvx9', 'WZpZrSvqnp', 'uYFZQI7jMC', 'TmkHpSeHna', 'AYSHs8YAPu', 'fOWHA5A4RP'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.438f9c0.2.raw.unpack, aQsUnflvEEP8Xc3DWo.cs	High entropy of concatenated method names: 'UY8vSFCh0x', 'VpZv762IZK', 'TBSvgxtxtI', 'dNEvE4njyP', 'tsovuig9qS', 'TrZviFtcak', 't7hvk70fRC', 'ljTvR4JK69', 'G3tvKGaOIg', 'x8Bv3A0jml'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, rZkRXysfeXVYoA0RyF.cs	High entropy of concatenated method names: 'OdAya5Xty1', 'hTdyLF1FPF', 'jbGyPKBMOM', 'hACyCIKyPw', 'AIHyrmRrFN', 'EmhyQQvrg9', 'A4DylgevBB', 'JIUyJK2FUg', 'F5TyMe6Tho', 'CsAy4dCL9r'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, seuy09AN5b7faHphXp.cs	High entropy of concatenated method names: 'fbpf9MBjV', 'l1qhVBe8K', 'uE5FIErJw', 'zpiNwPTkN', 'xvX9QPP1X', 'BDyGGYYrR', 'k2w7ALSAgd8Mmaqpss', 'nn9HuA3TE0U4RLyxqp', 'LreHt2RXC', 'aATWvc8lm'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, GjQ6XwkJjat9GxPDcu.cs	High entropy of concatenated method names: 'RB4es3gYYM', 'NwtetTOFgU', 'AyRHOM8gQg', 'mWeHIf1OUn', 'IpbeB1mis4', 'y19e7r8JMl', 'kn3ejKDaeQ', 'X0qegRsuK9', 'e0KeEEh1W5', 'oIGeY0Rsh2'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, JJKg8ebTUChCQXE5oX.cs	High entropy of concatenated method names: 'vhnr06OJvK', 'j6yrNHEyb3', 'UEMCiTeVTL', 'TclCk6H9SX', 'nQACRl7dKg', 'FcVCKTScn1', 'DHoC3SBukB', 'othC1G59ik', 'PPyCU1qTQi', 'xB7CSbhWw2'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, GmKRKQHfmJtcXPTxir.cs	High entropy of concatenated method names: 'qcMPgxnB26', 'aBXPETBsgh', 'XByPYmKH74', 'OpNP8Nq3RN', 'Y0IPVQKHdM', 'l4gPwgOfpG', 'bNbPpWkktb', 'tP8PskdE3q', 'drkPAuKSmE', 'UvuPt11LC1'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, OcxLs3zlQmvuaKcpmq.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'hM9Z6bCfqD', 'W7PZv2yJYU', 'GXSZo8WPe4', 'LMZZeILXc9', 'md1ZHAnS8i', 'H5QZZ8VGfF', 'PdiZWl2jDU'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, p6xnyVPjFleaBgG9Ju.cs	High entropy of concatenated method names: 'euVHLXVKR1', 'lXrHPKpjLa', 'swkHC1Klyx', 'QTqHrVuW7Z', 'ykeHQCFxwM', 'BkcHlPbPJq', 'u6hHJD7nhE', 'pZOHMZPond', 'FWeH4HJJq4', 'yYKHc8HPFH'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, MWgFDSRB8wfb0WKC1k.cs	High entropy of concatenated method names: 'Dispose', 'O5PIAyxZjx', 'V5x2uunWEL', 'sTpxxZ2YCy', 'bXeItT9vij', 'IuVIzPG4Ft', 'ProcessDialogKey', 'tdA2OU7vtE', 'jnu2IsODYL', 'Rta227t265'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, amgQhAT7fPN3ud71RvY.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'JlUWgHAAtT', 'Mj7WErHjuB', 'mFbWYoWvQm', 'jXJW8prIes', 'TtHWVtSQZv', 't2KWw4TQH2', 'j1dWp5QyTn'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, bw2npPvQrAROUjGtgC.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'AKN2AJqwlw', 'Yx82tfvSsf', 'JlX2zB1C9O', 'Bf4yOFTVVZ', 'WvByIgF7FP', 'sNTy2GpvRW', 'n5byyhddYF', 'qRgJOhjVJOFCbRmU8pb'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, FQ4Pw8O5w1fgK4LJ1T.cs	High entropy of concatenated method names: 'N1sChtn6Gp', 'jgyCFqQgTa', 'HicC59yIkc', 'ufKC9RKXAd', 'BYuCvbm0rx', 'L1NCoolabg', 'wJyCe9n3vJ', 'ySrCHfltSj', 'h6PCZPuFAB', 'PHOCWVjgJ7'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, x8EQAbobrC1c1P7M6y.cs	High entropy of concatenated method names: 'IHYHDIsMHw', 'FUtHu1cI4M', 'VQvHi9SKh1', 'xAdHk1eZQp', 'S6aHglQNl6', 'L5ZHRw6SE6', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, t7UJ2KQ1IBo4N52oUu.cs	High entropy of concatenated method names: 'nojIldKFaK', 'QsqIJhJQOn', 'JtVI4sE4Xw', 'JaMIcCOVY7', 'ihOIvJxkBO', 'nF6IoiecPS', 'OhkBVqx6qR4Lkfjvoo', 'Ex8QZkDIV3MfpbJh2X', 'qh0IINUTRW', 'iAgIyTbiIx'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, d4egtNJefeVgDQmw9Y.cs	High entropy of concatenated method names: 'vInQaGxjvb', 'y4dQPLQjyb', 'sIUQrV5pIT', 'BHyQlV3oMb', 'gt2QJKrNYX', 'W98rVKYyPf', 'I4JrwI967W', 'KUErpeqcnn', 'uaPrsrvhPI', 'XH3rAxeUc2'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, j9HJJUeI9tO23YHRcJ.cs	High entropy of concatenated method names: 'ToString', 'rWYoBQc5sV', 'S07ouIgNoW', 'BehoiH2cMg', 'VjrokF7dUT', 'r30oRUpFG3', 'LnMoKijCeF', 'OHKo3iNYfq', 'Fxmo10x1QA', 'm5xoUDWdrp'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, YPFVHDdxNPJPKBZRSO.cs	High entropy of concatenated method names: 'afRlqtAohS', 'eaWlXUjKvC', 'oKulfv9svr', 'psLlhBfMCQ', 'auSl0CeH0F', 'qAslFxY1wk', 'RwhlN8J9ch', 'wgCl5Dutwl', 'HKOl9VDWLs', 'DjqlGDmhVs'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, woU1cATS60TfWJL5KwE.cs	High entropy of concatenated method names: 'LPMZqlVoYe', 'mVgZXi6XHl', 'PYvZfC4r2a', 'E97Zh4gQaV', 'PXeZ0Fsy6L', 'rFjZFXRYWi', 'GGOZNR0Ofw', 'p6RZ5xtAPr', 'i8KZ9icNep', 'WieZGM5NSb'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, hBgXbn67oTOR8K1VGC.cs	High entropy of concatenated method names: 'y83652ApkE', 'VZx69rpyuc', 'GDt6D5apva', 'AUw6u3D5wD', 'fb66klOAtO', 'xcX6RdJkw0', 'IcY63eou9R', 'PNo61jX9uM', 'iYS6SEOROs', 'q7D6Bha5rM'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, lwSFEgGO8fQVunmcX5.cs	High entropy of concatenated method names: 'RE7ZI39oy3', 'iVDZymCg1J', 'aWKZdNNhP7', 'ndVZLnZnrN', 'c43ZPcrvx9', 'WZpZrSvqnp', 'uYFZQI7jMC', 'TmkHpSeHna', 'AYSHs8YAPu', 'fOWHA5A4RP'
Source: 0.2.PO-1BdyzarvrjUANe0.exe.4302ba0.4.raw.unpack, aQsUnflvEEP8Xc3DWo.cs	High entropy of concatenated method names: 'UY8vSFCh0x', 'VpZv762IZK', 'TBSvgxtxtI', 'dNEvE4njyP', 'tsovuig9qS', 'TrZviFtcak', 't7hvk70fRC', 'ljTvR4JK69', 'G3tvKGaOIg', 'x8Bv3A0jml'

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: icon3162.png

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: PO-1BdyzarvrjUANe0.exe PID: 4364, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Memory allocated: 14C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Memory allocated: 30C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Memory allocated: 50C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Memory allocated: 9140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Memory allocated: A140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Memory allocated: A340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Memory allocated: B340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Memory allocated: 1470000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Memory allocated: 2E30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Memory allocated: 14E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Window / User API: threadDelayed 8590			Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Window / User API: threadDelayed 1259			Jump to behavior

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe TID: 6208	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe TID: 4364	Thread sleep time: -26747778906878833s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1989254791.00000000011C7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllE

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe

Code function: 2_2_06C46A00 LdrInitializeThunk,

2_2_06C46A00

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe

Memory written: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe

Process created: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe "C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe"

Jump to behavior

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.2011875810.0000000006EF6000.00000004.00000020.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.2009786488.00000000062A1000.00000004.00000020.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1989254791.00000000011C7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.PO-1BdyzarvrjUANe0.exe.41a3f78.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO-1BdyzarvrjUANe0.exe.4158d58.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO-1BdyzarvrjUANe0.exe.41a3f78.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PO-1BdyzarvrjUANe0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO-1BdyzarvrjUANe0.exe.4158d58.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1988809355.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1762571849.00000000040C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1762571849.00000000041E6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1762571849.000000000419B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO-1BdyzarvrjUANe0.exe PID: 4364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO-1BdyzarvrjUANe0.exe PID: 1732, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.00000000030A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\walletsLRdq
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.00000000030A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $dq1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.000000000304C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.00000000030A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLRdq
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.00000000030A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLRdq
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.00000000030A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLRdq
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.00000000030A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $dq%appdata%`,dqdC:\Users\user\AppData\Roaming`,dqdC:\Users\user\AppData\Roaming\Binance
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.00000000030A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLRdq
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.00000000030A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $dq&%localappdata%\Coinomi\Coinomi\walletsLRdqD
Source: PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.00000000030A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $dq5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1990328338.00000000030A3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO-1BdyzarvrjUANe0.exe PID: 1732, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.PO-1BdyzarvrjUANe0.exe.41a3f78.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO-1BdyzarvrjUANe0.exe.4158d58.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO-1BdyzarvrjUANe0.exe.41a3f78.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PO-1BdyzarvrjUANe0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO-1BdyzarvrjUANe0.exe.4158d58.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1988809355.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1762571849.00000000040C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1762571849.00000000041E6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1762571849.000000000419B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO-1BdyzarvrjUANe0.exe PID: 4364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO-1BdyzarvrjUANe0.exe PID: 1732, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	11 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
PO-1BdyzarvrjUANe0.exe	63%	ReversingLabs	Win32.Spyware.Redline
PO-1BdyzarvrjUANe0.exe	100%	Avira	TR/AD.RedLineSteal.arwid
PO-1BdyzarvrjUANe0.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/06/addressingex	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2002/12/policy	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/spnego	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/actor/next	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042A1000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042B7000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003F12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003EF6000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042A1000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042B7000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003F12000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003E85000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000003227000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id12Response	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id2Response	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers	PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21Response	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000003223000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13ResponseD	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15Response	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.zhongyicts.com.cn	PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1762571849.00000000040C9000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1762571849.00000000041E6000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1762571849.000000000419B000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1988809355.0000000000402000.00000040.00000400.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003EF6000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042A1000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042B7000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003F12000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003E85000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24Response	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003EF6000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042A1000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042B7000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003F12000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003E85000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5Response	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15ResponseD	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000003212000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id10Response	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8Response	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.founder.com.cn/cn/bThe	PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/D	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/06/addressingex	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13Response	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id7ResponseD	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003EF6000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042A1000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.00000000042B7000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003F12000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1993772018.0000000003E85000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id4ResponseD	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2002/12/policy	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22Response	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp, PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id22ResponseD	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000003223000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id16ResponseD	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/spnego	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	PO-1BdyzarvrjUANe0.exe, 00000000.00000002.1765760032.00000000072C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id18Response	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id3Response	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/actor/next	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14ResponseD	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id8	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5	PO-1BdyzarvrjUANe0.exe, 00000002.00000002.1990328338.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.190.10.19	unknown	Ukraine		56370	ASINTTELUA	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1539389
Start date and time:	2024-10-22 16:10:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO-1BdyzarvrjUANe0.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 64 Number of non-executed functions: 17
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: PO-1BdyzarvrjUANe0.exe

Simulations

Behavior and APIs

Time	Type	Description
10:11:08	API Interceptor	74x Sleep call for process: PO-1BdyzarvrjUANe0.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.190.10.19	vhFZk5qPZd.exe	Get hash	malicious	RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASINTTELUA	vhFZk5qPZd.exe	Get hash	malicious	RedLine	Browse	188.190.10.19
	PO24252509JASIC.scr.exe	Get hash	malicious	RedLine	Browse	188.190.10.12
	Qpp5L1vHC0.elf	Get hash	malicious	Unknown	Browse	188.190.4.165
	6pZPnJdO23.elf	Get hash	malicious	Mirai	Browse	188.190.4.141
	9EUxitC1xZ.elf	Get hash	malicious	Mirai	Browse	188.190.4.159
	xd.x86.elf	Get hash	malicious	Mirai	Browse	188.190.12.10
	nPkth7pJDB.elf	Get hash	malicious	Mirai	Browse	188.190.4.142
	duAaSiWM5K.elf	Get hash	malicious	Unknown	Browse	188.190.4.132
	3dO4zEiA96	Get hash	malicious	Mirai	Browse	188.190.4.116
	xd.arm	Get hash	malicious	Mirai	Browse	188.190.4.143

Process:	C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.792064506385091
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	PO-1BdyzarvrjUANe0.exe
File size:	744'448 bytes
MD5:	fac116ca092033649c6a8ae32e000508
SHA1:	5139cdc83309a71256413e6e9948098deeb4f144
SHA256:	dd7864aca2acdf7738015e6568b6d6fe2f425137c81dcfb19ba491852678b4a7
SHA512:	650580c60ee171eb2e2b12dcdabe2f652828ea95f55abeb5c961858c4e5377b608096eba2d4ac21752766e0eb80f9a50903ba7f6444db7e438d97bae3797c31b
SSDEEP:	12288:TX/gr9VWWwj6+VN4ei/fgrblL9nXhv6NSz/NYTlxcVpvY3WqpyzWuuspV:TvS9VWWi6+DsorHRv1VYTlaTJ0y
TLSH:	14F40188B515B5BEC85387740974ED3155207EBEA207D30794EB7CABB93E6C39E042E2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g..............0......d......~.... ... ....@.. ....................................`................................

File Icon


Icon Hash:	276ea3a6a6b7bfbf

Static PE Info

General

Entrypoint:	0x4b157e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6708AAEA [Fri Oct 11 04:34:50 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb1524	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb2000	0x6180	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xba000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xaf584	0xaf600	2f1bfcac257d08057ed53ca5977c92f1	False	0.9120871013007841	data	7.838098776126378	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb2000	0x6180	0x6200	ade738b423cb2d17158360a42746198e	False	0.45471938775510207	data	5.642492898112896	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xba000	0xc	0x200	f090270ec25d8453af2ee2c19a2e1472	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xb2268	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	0.3077956989247312
RT_ICON	0xb2550	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	0.543918918918919
RT_ICON	0xb2678	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.5610341151385928
RT_ICON	0xb3520	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.6796028880866426
RT_ICON	0xb3dc8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.546242774566474
RT_ICON	0xb4330	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.4191908713692946
RT_ICON	0xb68d8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.4800656660412758
RT_ICON	0xb7980	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.6099290780141844
RT_GROUP_ICON	0xb7de8	0x76	data	0.6271186440677966
RT_GROUP_ICON	0xb7e60	0x14	data	1.05
RT_VERSION	0xb7e74	0x30c	data	0.42948717948717946

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-22T16:11:14.127926+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:14.127926+0200	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:14.379136+0200	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	188.190.10.19	1912	192.168.2.4	49733	TCP
2024-10-22T16:11:19.480034+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:20.682993+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:20.689742+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	188.190.10.19	1912	192.168.2.4	49733	TCP
2024-10-22T16:11:20.981360+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:21.563029+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:21.838802+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:22.271687+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:22.686846+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:22.692481+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:23.634154+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:23.890863+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:24.194379+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:24.239630+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:24.538120+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:28.068897+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:28.381917+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:33.171919+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:33.752102+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:33.998709+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:34.246772+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	188.190.10.19	1912	TCP
2024-10-22T16:11:34.648432+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	188.190.10.19	1912	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 22, 2024 16:11:13.059772015 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:13.065116882 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:13.065217972 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:13.076234102 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:13.081548929 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:13.921087980 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:13.975613117 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:14.127926111 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:14.133380890 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:14.379136086 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:14.428762913 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:19.480034113 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:19.485554934 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:19.727965117 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:19.727982044 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:19.727993011 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:19.728004932 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:19.728018045 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:19.728086948 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:19.728135109 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:20.682992935 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:20.689742088 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:20.930181980 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:20.975624084 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:20.981359959 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:20.986912012 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:21.227560043 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:21.272521973 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:21.563029051 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:21.569360018 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:21.810201883 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:21.838802099 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:21.844261885 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.084964037 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.131875038 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.271687031 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.277167082 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.518496037 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.568805933 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.686846018 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.692378998 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.692389965 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.692435026 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.692436934 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.692446947 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.692481041 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.692507029 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.692516088 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.692528009 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.692547083 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.692560911 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.692594051 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.692604065 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.692621946 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.692631006 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.692639112 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.692653894 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.692679882 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.692699909 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.692709923 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.692750931 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.697757006 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.697767019 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.697812080 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.697905064 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.697915077 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.697947025 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.698057890 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.698116064 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.698191881 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.698259115 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.698683977 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.698745966 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.706782103 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.706886053 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.707007885 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.712306976 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712316036 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712332964 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712342978 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712351084 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.712372065 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712374926 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.712382078 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712412119 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.712431908 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.712438107 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712447882 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712471962 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.712482929 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712485075 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.712492943 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712528944 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.712573051 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712582111 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712605953 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.712620020 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.712656021 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712687016 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.712694883 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712826967 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712836027 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712845087 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712869883 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712878942 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712889910 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712915897 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712925911 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712964058 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712974072 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.712985039 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713006020 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713116884 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.713135004 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713145971 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713171959 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.713184118 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.713206053 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713216066 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713239908 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713257074 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.713273048 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.713305950 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713340044 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.713351965 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713361979 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713382959 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713396072 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.713421106 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.713434935 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713444948 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713449001 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713473082 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713481903 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713483095 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.713520050 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.713551044 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713560104 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713568926 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713578939 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713612080 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713620901 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713630915 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713641882 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713773012 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713830948 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713839054 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713849068 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.713860989 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.717864037 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.717904091 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.717984915 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.718086004 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.718178988 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.718188047 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.718305111 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.718372107 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.718478918 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.718530893 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.718641043 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.718667984 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.718910933 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.719407082 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.719574928 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.719593048 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.719728947 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.719737053 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.719799042 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.719830036 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.719846964 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.719896078 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.719944000 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.719995022 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720103025 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720110893 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720146894 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720155954 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720223904 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720240116 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720300913 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720309973 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720382929 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720391989 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720424891 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720424891 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.720433950 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720484018 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.720515013 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720525026 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720580101 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720588923 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720597982 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720628977 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720670938 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720679998 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720753908 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720762968 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720832109 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720860004 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720887899 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720932961 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.720973969 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721061945 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721071005 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721080065 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721129894 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721204042 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721251011 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721260071 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721328020 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721338034 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721399069 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721477985 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721487045 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721496105 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721504927 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721514940 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721535921 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721570969 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721611023 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721621037 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721801996 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721812010 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721820116 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721837997 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721847057 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721856117 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721911907 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721920967 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.721954107 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.722136974 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.722189903 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.725733042 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.725876093 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.725884914 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.725899935 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.725908995 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.725970030 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.725980043 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726011992 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726021051 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726072073 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726123095 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726131916 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726140976 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726162910 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726203918 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726248026 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726257086 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726272106 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726296902 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726342916 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726351976 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726438999 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726448059 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726481915 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726491928 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726510048 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726578951 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726589918 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726598978 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726608992 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726624966 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726634026 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726644039 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726701975 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726711035 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726727009 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726736069 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726769924 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726778984 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726852894 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726861954 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726871014 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726880074 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726895094 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726903915 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726918936 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726927996 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726963043 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726970911 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726982117 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.726990938 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.727060080 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.727067947 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.727581978 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.727591038 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.727600098 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.727610111 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.727641106 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.727715015 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.727809906 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.727813959 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.727840900 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.727869987 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.727933884 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.727943897 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.727978945 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.727988958 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728065968 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728075027 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728096962 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728106976 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728214979 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728230953 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728271961 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728280067 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728369951 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728379011 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728446007 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728454113 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728462934 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728472948 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728487968 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728497982 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728523016 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728532076 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728631973 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728641033 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728672981 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728682041 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728697062 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728705883 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728718042 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728765965 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728775024 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728782892 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728794098 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728842974 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728854895 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728873014 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728883028 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728899956 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728982925 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.728991985 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.729048014 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.729058027 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.729114056 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.729123116 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.729186058 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.733171940 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.733207941 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.733293056 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.733304024 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.733374119 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.733386993 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.733400106 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.733428001 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.733462095 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.733472109 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.733568907 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.733577967 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.733606100 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.733669996 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.733680010 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.733690023 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.733845949 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.733855009 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.733896017 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.733906031 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.733973980 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.733983040 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.733998060 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734006882 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734244108 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734253883 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734263897 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734272957 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734293938 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734304905 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734313965 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734323978 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734339952 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734352112 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734379053 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734390020 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734407902 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734416962 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734460115 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734469891 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734500885 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734576941 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734586954 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734597921 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734659910 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734671116 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734699011 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734710932 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734739065 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734749079 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734777927 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734787941 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734806061 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734814882 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.734826088 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.738751888 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.738816977 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.738842010 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.738878012 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.738914967 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.738929033 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.738945961 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.738985062 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.738996029 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739010096 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739017010 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.739027023 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739037037 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739063025 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739073992 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739145994 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739156008 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739188910 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739197969 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739252090 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739269018 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739320993 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739331007 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739370108 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739378929 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739470005 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739481926 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739499092 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739511013 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739521027 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739531994 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.739542007 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.786186934 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:22.786431074 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.786520958 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.786520958 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.786561966 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:22.834075928 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:23.586663008 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:23.631874084 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:23.634154081 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:23.639477968 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:23.880294085 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:23.890862942 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:23.896332026 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:23.896383047 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:23.896398067 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:23.896467924 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:23.896480083 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:23.896493912 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:24.138832092 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:24.194379091 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:24.239629984 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:24.247298002 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:24.247320890 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:24.247330904 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:24.247340918 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:24.247350931 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:24.247360945 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:24.247369051 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:24.247378111 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:24.247395992 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:24.247406960 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:24.247416019 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:24.247556925 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:24.247566938 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:24.488022089 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:24.538120031 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:28.068897009 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:28.074837923 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:28.074881077 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:28.074913025 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:28.338327885 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:28.381917000 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:33.171919107 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:33.177797079 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:33.419230938 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:33.460036993 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:33.752101898 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:33.757800102 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:33.998281956 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:33.998708963 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:34.004184008 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:34.245906115 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:34.246772051 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:34.252326012 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:34.493110895 CEST	1912	49733	188.190.10.19	192.168.2.4
Oct 22, 2024 16:11:34.538247108 CEST	49733	1912	192.168.2.4	188.190.10.19
Oct 22, 2024 16:11:34.648432016 CEST	49733	1912	192.168.2.4	188.190.10.19

Target ID:	0
Start time:	10:11:07
Start date:	22/10/2024
Path:	C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe"
Imagebase:	0xcb0000
File size:	744'448 bytes
MD5 hash:	FAC116CA092033649C6A8AE32E000508
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1762571849.00000000040C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1762571849.00000000041E6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1762571849.000000000419B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:11:10
Start date:	22/10/2024
Path:	C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO-1BdyzarvrjUANe0.exe"
Imagebase:	0xa50000
File size:	744'448 bytes
MD5 hash:	FAC116CA092033649C6A8AE32E000508
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.1988809355.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.1990328338.0000000002EC6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1990328338.00000000030A3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.2%
Total number of Nodes:	194
Total number of Limit Nodes:	16

Executed Functions

Function 078611E0 Relevance: 6.9, Strings: 5, Instructions: 618
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hhq, xrefs: 078656E9
Hhq, xrefs: 0786588D
Hhq, xrefs: 0786594B
Hhq, xrefs: 0786577C
Hhq, xrefs: 07865803

Memory Dump Source

Source File: 00000000.00000002.1766941378.0000000007860000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: true

Associated: 00000000.00000002.1766812398.0000000007850000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID: Hhq$Hhq$Hhq$Hhq$Hhq
API String ID: 0-1427472961
Opcode ID: c094e103276c973634fb15f58e8b3edf964469c8cafc229646e4b530aa13b0d9
Instruction ID: 2f2d2a3d422cc72f5da0aed6eda2041286de0a22ffbec3904aa7fc56612d7c3f
Opcode Fuzzy Hash: c094e103276c973634fb15f58e8b3edf964469c8cafc229646e4b530aa13b0d9
Instruction Fuzzy Hash: A43260B0E002189FDB54DFA8C8947AEBBF2AF95300F1485A9D509EB389DB349D91CF51

Function 0903B148 Relevance: .6, Instructions: 612COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aaad3ae8dc259271d6fefc4574a29d3a4624913b5392491d7a8cf0cb5102a20
Instruction ID: 65d3dd85cc8deaf708ba5ab0f670347686a0ed68642229e3d94a45e7b7290a05
Opcode Fuzzy Hash: 0aaad3ae8dc259271d6fefc4574a29d3a4624913b5392491d7a8cf0cb5102a20
Instruction Fuzzy Hash: 3B329970B012049FDB59DF69D594BAEBBFAAF88304F948869E505DB790CB34ED01CB90

Function 09038D98 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70a762bd7f55d6139b3f69c872544975500644d9369c6beef597c86d28d22a76
Instruction ID: 84be130ed495182b29b5721f81c65ef606eff1468188bd5492ca3e611bc12cd1
Opcode Fuzzy Hash: 70a762bd7f55d6139b3f69c872544975500644d9369c6beef597c86d28d22a76
Instruction Fuzzy Hash: 0D610671D05619CBDB24CF66C8407EDBBBABF99300F50D5EAE809A6250EB705A85CF40

Function 02EB70E8 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761560734.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94023a34f05177f8a13449fa7f5b93fdfb2d776cc864d67ea10b1c690fd1c7ef
Instruction ID: 126bd794e857b54eed05c4952613dd978b4f78b1a7a97a8d3afff5593d15c992
Opcode Fuzzy Hash: 94023a34f05177f8a13449fa7f5b93fdfb2d776cc864d67ea10b1c690fd1c7ef
Instruction Fuzzy Hash: 99412D74E05209DFCB49DFA5C5916EEFBF2EF89300F24D4A9D409A7264DB349A41CB60

Function 02EB3E6C Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761560734.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a80362bf154126613be86b280826b48ca98802c302bb2eb41c7b66610c519332
Instruction ID: 3ca6e9569d9c797ec1794c8c1f9297bd0a232a45716bc4b406fd0a4134414c10
Opcode Fuzzy Hash: a80362bf154126613be86b280826b48ca98802c302bb2eb41c7b66610c519332
Instruction Fuzzy Hash: B3411D74E45209DFCB48DFA5C5806EEFBF2EFC9300F24E4A99409A7664DB349A41CB60

Function 02EBD4A8 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02EBD536
GetCurrentThread.KERNEL32 ref: 02EBD573
GetCurrentProcess.KERNEL32 ref: 02EBD5B0
GetCurrentThreadId.KERNEL32 ref: 02EBD609

Memory Dump Source

Source File: 00000000.00000002.1761560734.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: afdac8c7b3303b76a9e6c49f04a1fe27be686bc36aff81d92bdb030270f27d68
Instruction ID: d263ef62cb25ff1ebd9c30d26e2ea1e18352ddf4f2d835a3c2ab179cbb212822
Opcode Fuzzy Hash: afdac8c7b3303b76a9e6c49f04a1fe27be686bc36aff81d92bdb030270f27d68
Instruction Fuzzy Hash: A55135B0901349CFDB15CFA9DA48BDEBBF1EF48318F24849AE509A7260D7345984CB65

Function 02EBD4B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02EBD536
GetCurrentThread.KERNEL32 ref: 02EBD573
GetCurrentProcess.KERNEL32 ref: 02EBD5B0
GetCurrentThreadId.KERNEL32 ref: 02EBD609

Memory Dump Source

Source File: 00000000.00000002.1761560734.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7f3c48fd0e6be4195673de8672b605bfe6e5a7c07cad393b2b979d55f4893c45
Instruction ID: 7e94e8815c419fd130d02d43ad98938e3749feace6887407e44357a5f6c7d6cb
Opcode Fuzzy Hash: 7f3c48fd0e6be4195673de8672b605bfe6e5a7c07cad393b2b979d55f4893c45
Instruction Fuzzy Hash: 2B5115B0901309CFDB14CFAADA48B9EBBF1EF48318F24C459E519A7260D7745984CF65

Function 09037C58 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 09037E8E

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 39ddd3955a6a320cfa811031d6a02c114a1bc485bbe8394ffae1d08a97aeb04a
Instruction ID: e5ff290c88b81fe271c1105b16e3502ff9c55b0d30e13023f3c6ba941fced8d1
Opcode Fuzzy Hash: 39ddd3955a6a320cfa811031d6a02c114a1bc485bbe8394ffae1d08a97aeb04a
Instruction Fuzzy Hash: AA915AB1D00219CFDB25CFA9C841BEEBBF6BF48310F5485A9E809A7250DB749985CF91

Function 02EBB230 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02EBB486

Memory Dump Source

Source File: 00000000.00000002.1761560734.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1f7a2bb698c024ac2a0c4ea0d1a794c2f38f3cb71a8a3b519c91570983a8b386
Instruction ID: 57189aa33773f117bfe46b45832844d9c17be322eb3af4fc310c9831165a9620
Opcode Fuzzy Hash: 1f7a2bb698c024ac2a0c4ea0d1a794c2f38f3cb71a8a3b519c91570983a8b386
Instruction Fuzzy Hash: 04813370A00B458FDB65DF6AD44079BBBF1BF88308F008A6DD48AD7A50DB74E845CB90

Function 02EB4610 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02EB5EE1

Memory Dump Source

Source File: 00000000.00000002.1761560734.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 50a0137212509ce451ebb162f33179a71f5268394a71fd84c17969fe1c94234b
Instruction ID: 8424fabdf209a0f937ca6b341e412715f97519702037e7378fb499345b651e77
Opcode Fuzzy Hash: 50a0137212509ce451ebb162f33179a71f5268394a71fd84c17969fe1c94234b
Instruction Fuzzy Hash: 4641CEB0C0061DCADB25CFAAC984BDEBBB5FF48304F60846AD509AB251DBB56945CF90

Function 02EB5E24 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02EB5EE1

Memory Dump Source

Source File: 00000000.00000002.1761560734.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 84f58ffe46be2fd3e057a9b9897b31847722158f14267233da1d87f9e89effd3
Instruction ID: 9220dae84371bcebe53212124dbfc454a9ba3b678686d13210faeba31cb947c1
Opcode Fuzzy Hash: 84f58ffe46be2fd3e057a9b9897b31847722158f14267233da1d87f9e89effd3
Instruction Fuzzy Hash: C841FFB0C00619CEDB25CFAAC984BCEBBB5BF48304F6080AAD409AB251DBB56945CF50

Function 056345B2 Relevance: 1.6, APIs: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 0563468F

Memory Dump Source

Source File: 00000000.00000002.1764346896.0000000005630000.00000040.00000800.00020000.00000000.sdmp, Offset: 05630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5630000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 21d38faa391f6576c668e2417bf628979a3dc151ddb2c13a8ae94ee27cb62bfa
Instruction ID: bffc260948f39e061e7ae8ea9f71eb7a5433d1aab8a9bde87cb1f001e50329e2
Opcode Fuzzy Hash: 21d38faa391f6576c668e2417bf628979a3dc151ddb2c13a8ae94ee27cb62bfa
Instruction Fuzzy Hash: FD3106B6900209AFDF00CF99D884ADEBBF5EF58320F24841AE915A7310C775A550DBA0

Function 090375C8 Relevance: 1.6, APIs: 1, Instructions: 72injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 09037660

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 21659f1f3715777bc7121cf0be85e4b38feffff5c564f3a4a75136fc671a67e5
Instruction ID: 1ed9cc26b351d813fd85e219122ee3b794da08cae0808a592ef0abfddfe69b60
Opcode Fuzzy Hash: 21659f1f3715777bc7121cf0be85e4b38feffff5c564f3a4a75136fc671a67e5
Instruction Fuzzy Hash: 782148B59003499FCB10CFAAC985BEEBBF5FF48310F54882AE959A7240C7789545DBA0

Function 056345F2 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 0563468F

Memory Dump Source

Source File: 00000000.00000002.1764346896.0000000005630000.00000040.00000800.00020000.00000000.sdmp, Offset: 05630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5630000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 4d5d246c72c5df312502f419d8ca1cd03279f8609f2a560187fe30053d78d648
Instruction ID: 9538e444ea620cad3aac7d6ef67e685e86011815010fbca77b34cf4dfb7ec11d
Opcode Fuzzy Hash: 4d5d246c72c5df312502f419d8ca1cd03279f8609f2a560187fe30053d78d648
Instruction Fuzzy Hash: FA31E0B59012099FDB10CF9AD884ADEFBF5FB48320F24842AE819A7310D775A944CFA0

Function 090375D0 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 09037660

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e01aded99c8063c66acd8acb34dae7171e9629168be9c1e65b165aff4256d5e6
Instruction ID: d42f2643dffb5c921deb40edb5b2a01ff80f4399ea8b8849841b557421929893
Opcode Fuzzy Hash: e01aded99c8063c66acd8acb34dae7171e9629168be9c1e65b165aff4256d5e6
Instruction Fuzzy Hash: 0B212AB19003499FDB10CFAAC885BDEBBF5FF48310F50882AE919A7240C7789540DBA4

Function 056345F8 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 0563468F

Memory Dump Source

Source File: 00000000.00000002.1764346896.0000000005630000.00000040.00000800.00020000.00000000.sdmp, Offset: 05630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5630000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 5683f32a1cc53d6a7f705388aaa3ca2ea2844eb412f480dae1aca0b560492f9e
Instruction ID: fa7b64abf8a6becccb17de875edd200d2f219d9ee8966dd2dcd8606d69d5f3e5
Opcode Fuzzy Hash: 5683f32a1cc53d6a7f705388aaa3ca2ea2844eb412f480dae1aca0b560492f9e
Instruction Fuzzy Hash: 8221C0B59002099FDB10CF9AD884A9EFBF5BB48320F24842AE819A7710D775A944CFA0

Function 09039E81 Relevance: 1.6, APIs: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 09039EE5

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a8407e73aa72586dc5eb6c6c36183807bb3f01732275e9d93d6f20604b47a9a1
Instruction ID: 55b9bd91f346266d541cfbf4e2ca7a1ca4581db804fb63b80a95aeb0d1acb786
Opcode Fuzzy Hash: a8407e73aa72586dc5eb6c6c36183807bb3f01732275e9d93d6f20604b47a9a1
Instruction Fuzzy Hash: A1217AB6800349CEDB20CF9AD584BDEFFF8EB48324F24880AD558A3600C375A584CFA1

Function 09037430 Relevance: 1.6, APIs: 1, Instructions: 68threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 090374B6

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ef1a848375c9f70cc30dca68cf007097ead4dd5bcaac195e25383eed9221072a
Instruction ID: 6a718b94f5bf884b8bbeb5a2bd318a04e80cfa941aa1a87672e5884ce9a63bb7
Opcode Fuzzy Hash: ef1a848375c9f70cc30dca68cf007097ead4dd5bcaac195e25383eed9221072a
Instruction Fuzzy Hash: 792148B19003099FDB10DFAAC4817EEBFF9AF88324F54C42AD559A7241C778A945CFA1

Function 09037AC0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 09037B40

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: f51485c5cdae7ab802abf879c454f6603c736f7b6daf4a116b1e23799edf6cc6
Instruction ID: 18dc6a87c8d48bf509958131d7737ca18852c16213c0dcce156691451477b5c0
Opcode Fuzzy Hash: f51485c5cdae7ab802abf879c454f6603c736f7b6daf4a116b1e23799edf6cc6
Instruction Fuzzy Hash: 8B2116B18003499FDB10CFAAC881AEEFBF5FF48320F50842AE559A7240C7789540DBA5

Function 09037438 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 090374B6

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 130f375657fe33878e42dd0345e1f97020e4cc769c3842a337e19b98c7e8bd61
Instruction ID: cbabfd4508ec989d98eb9c0368f7bd2400433ee1693f2075420a89b0ce29d535
Opcode Fuzzy Hash: 130f375657fe33878e42dd0345e1f97020e4cc769c3842a337e19b98c7e8bd61
Instruction Fuzzy Hash: F92137B19003098FDB10DFAAC4857EEBFF9AF48324F54C42AD559A7240C778A944CFA1

Function 02EBD6F8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02EBD787

Memory Dump Source

Source File: 00000000.00000002.1761560734.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e3d397535f92c25319bb2589d8aaec0b1ee97ba3167eec5d31704639d79c51a3
Instruction ID: aa7a5a1bc2437c8b08d443c64c1026f4f61345009fb09555660f4895cbd8abd5
Opcode Fuzzy Hash: e3d397535f92c25319bb2589d8aaec0b1ee97ba3167eec5d31704639d79c51a3
Instruction Fuzzy Hash: 812103B5900209DFDB11CFAAD984AEEBFF4EF08320F14845AE958B7210C378A951CF60

Function 02EBD700 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02EBD787

Memory Dump Source

Source File: 00000000.00000002.1761560734.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2af8bc38e4b8abd34fbd7cd36678391ca2c4ff1040e3d778580a1f4731be558d
Instruction ID: 3ad7bc60e1ce046a4f6ad94d7ca5ad819b3d632330803afbb541ff2c3d0d5074
Opcode Fuzzy Hash: 2af8bc38e4b8abd34fbd7cd36678391ca2c4ff1040e3d778580a1f4731be558d
Instruction Fuzzy Hash: 1A21E4B59002089FDB10CF9AD984ADEBFF8EF48320F14841AE918A3310C378A950CFA0

Function 09037ABE Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 09037B40

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 41587e7cd511d3e23299d8b2ba75aa3472121ab1586116980f2d17aa56d218aa
Instruction ID: da0e6a7341bee39d92a67add1e5eabf87c30999ae1f8f90da3b16e290ee76113
Opcode Fuzzy Hash: 41587e7cd511d3e23299d8b2ba75aa3472121ab1586116980f2d17aa56d218aa
Instruction Fuzzy Hash: 1F2125B1D002499FDB10CFAAC981BEEFBF5FF48320F54882AE559A7250C7789940DB64

Function 09037509 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0903757E

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4acf55f54d0b49a4bb9ea7001c135e97edee3857310373a1cb0a4502db830c21
Instruction ID: cba5899fd85528f46e2d363626dbe05afa22d4f6fdfac4eb44558636373efbf4
Opcode Fuzzy Hash: 4acf55f54d0b49a4bb9ea7001c135e97edee3857310373a1cb0a4502db830c21
Instruction Fuzzy Hash: A51159B29002499FCB14CFAAC944ADFBFF9EF88320F24881AE519A7650C7759540CFA0

Function 07861228 Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,07865A6A,?,?,?,?,?), ref: 07865B0F

Memory Dump Source

Source File: 00000000.00000002.1766941378.0000000007860000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: true

Associated: 00000000.00000002.1766812398.0000000007850000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: c3435005cfa1f3f6b6dc112f2ee82852a8ea48eb421b29bc34e0fba2140f3532
Instruction ID: 16ef8cc53f6cdd0fa49f82c6b828ff17752f6efa708a34cd611f28a067b6e079
Opcode Fuzzy Hash: c3435005cfa1f3f6b6dc112f2ee82852a8ea48eb421b29bc34e0fba2140f3532
Instruction Fuzzy Hash: 871137B1900349AFDB10CF9AC885BEEBFF8EB58320F14841AE915A7250C375A954DFA4

Function 09037510 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0903757E

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8ee573736521373780a6798f1a990ecaa832fae5ff8297e06d22a45069711172
Instruction ID: 19c7412123aebd7e27be11117388d63692e5f723d53052a0554a9cf0f574109e
Opcode Fuzzy Hash: 8ee573736521373780a6798f1a990ecaa832fae5ff8297e06d22a45069711172
Instruction Fuzzy Hash: 5C116AB19003099FCB10CFAAC845ADFBFF9EF48320F148819E519A7250C7759540CFA1

Function 090376AF Relevance: 1.6, APIs: 1, Instructions: 53injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 09037660

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 03db186ec0b09e84418677a8ad5638e3fcd19dad91f44d4abf1d6210bdcfd07d
Instruction ID: c2a791fdaa11e3f0a754b3ff3f914e9bfe563fe3f3e805b1770e9cce1c36534c
Opcode Fuzzy Hash: 03db186ec0b09e84418677a8ad5638e3fcd19dad91f44d4abf1d6210bdcfd07d
Instruction Fuzzy Hash: 481166F2804205CFDB14CF6CD4687DDBBE8AF54368F64C81AD094EB292C7395442EBA1

Function 09036F49 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 09036FB2

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2099de7492c448a2a5492c25dc4d189519dbbcfe4865edf8f9ffd2dd6348bfc5
Instruction ID: 0678e37ee967512421ba570b456da72b35040088e8263cc5e65f1bcb1c0588a0
Opcode Fuzzy Hash: 2099de7492c448a2a5492c25dc4d189519dbbcfe4865edf8f9ffd2dd6348bfc5
Instruction Fuzzy Hash: D01158B19002498EDB20DFAAC5457EEFFF9AF98324F24881AD519A7340C7759545CFA0

Function 09036F50 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 09036FB2

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2a64766f0215b93aa4761c71f87033a40e884fcf869c3181bc4af0cd4dc3208a
Instruction ID: d491b51724e8db61790e2a6ea01c36d3ead49b68e88b6b40c1cdc27c2beb387c
Opcode Fuzzy Hash: 2a64766f0215b93aa4761c71f87033a40e884fcf869c3181bc4af0cd4dc3208a
Instruction Fuzzy Hash: A31128B19003498FDB20DFAAC4457DEFFF9AB98324F24881AD519A7240C775A544CBA5

Function 02EBB420 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02EBB486

Memory Dump Source

Source File: 00000000.00000002.1761560734.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7ce1e8473edef88f9e5004dd8926a1b89fde7351ec77d2ba4f09e7664d89a2de
Instruction ID: d3245dc525e1d72a3749eb65ecffd6c06fac9eea9ee462e707ab7bf3013a6735
Opcode Fuzzy Hash: 7ce1e8473edef88f9e5004dd8926a1b89fde7351ec77d2ba4f09e7664d89a2de
Instruction Fuzzy Hash: 4D11CDB5C002498EDB20CF9AC944ADEFBF8AF88328F14C45AD859A7610D379A545CFA1

Function 090376DC Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 09039EE5

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: eb3135ff9a55542cee8daa85f5c4c8a1f1f7ffea40327c6d2e0bf9c023085f3f
Instruction ID: 6f19ae749c6fe3cf1d2aedf95a4a815a1fc15b384edda47e8a05da9c66315f3d
Opcode Fuzzy Hash: eb3135ff9a55542cee8daa85f5c4c8a1f1f7ffea40327c6d2e0bf9c023085f3f
Instruction Fuzzy Hash: 71110AB5800349DFDB10CF9AC585BDEBBF8EB58320F20885AE955A7600C375A944CFA1

Function 0131D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760846955.000000000131D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_131d000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d75bfd3947ee71b2e1c0b8484ee107df5ce00f5c8dd47c0ab34f6cb67d5d600
Instruction ID: ec7410b75ae3dd20397107707be77382757960c46bfd8e8f0b7d60b49dca0416
Opcode Fuzzy Hash: 7d75bfd3947ee71b2e1c0b8484ee107df5ce00f5c8dd47c0ab34f6cb67d5d600
Instruction Fuzzy Hash: F8216DB1144204DFDB09DF44D5C4B56BF65FB88318F20C56DE90A1B25ACB36E446C7A1

Function 0132D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760888884.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_132d000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13a4680042ed7488eb9bc5e6a2e05a1433bed6ce4a60d06912ba042b4118314c
Instruction ID: bc8e9627c3e1dd5968a84b73133637c94799d6b94ed5e5fb19b31b6deb429fa8
Opcode Fuzzy Hash: 13a4680042ed7488eb9bc5e6a2e05a1433bed6ce4a60d06912ba042b4118314c
Instruction Fuzzy Hash: 822146B1504304EFDB05EF98D9C0B26BBA9FB85328F20C96DE9094B252C336D406CB61

Function 0132D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760888884.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_132d000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d9fdfbc8e6add992e4fe19b76db868398f06be7aaa15f9e064e9c11989f7134
Instruction ID: c42cde8d5683b0c0220f91c5975c75536f77cf435f9915aea30347c128c5a061
Opcode Fuzzy Hash: 1d9fdfbc8e6add992e4fe19b76db868398f06be7aaa15f9e064e9c11989f7134
Instruction Fuzzy Hash: C82134B1604244DFCB15EF58D9C0B26BF65FB84358F20C96DE90A4B2A6C33AD407CAA1

Function 0132D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760888884.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_132d000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 403895911c32f892d6bbbfeb733f0366157c495aa7e5b6e99ef153770775d13f
Instruction ID: ad5d38c6a597441934ab2f9a322f951461fc67e42d5bf6a36a57ff8179002d9c
Opcode Fuzzy Hash: 403895911c32f892d6bbbfeb733f0366157c495aa7e5b6e99ef153770775d13f
Instruction Fuzzy Hash: AD2180755083809FCB13DF64D994B11BF71EB46218F28C5DAD8498F2A7C33A985ACB62

Function 0131D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760846955.000000000131D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_131d000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction ID: c7546c8217342695ec36562a04f625e9103f6307b781b862e49dbb78a0e56cbf
Opcode Fuzzy Hash: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction Fuzzy Hash: 9C112672444240CFDB16CF44D5C4B56BF72FB84328F24C6A9D9090B65BC73AE45ACBA1

Function 0132D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760888884.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_132d000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction ID: a604d122d4cd01210d2180a006dd356421e1b879886997317738e875cac00ae6
Opcode Fuzzy Hash: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction Fuzzy Hash: BC11BB75504380DFDB12DF54D5C0B15BBB2FB85228F24C6AAD8494B696C33AD44ACB61

Non-executed Functions

Function 07854D3B Relevance: 1.0, Instructions: 975COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766812398.0000000007850000.00000004.08000000.00040000.00000000.sdmp, Offset: 07850000, based on PE: true

Associated: 00000000.00000002.1766941378.0000000007860000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7850000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5040a46358f2346cb87d89f51ae6deab5fd9d69999703b9c79b85ecd432504c
Instruction ID: 6d74f7046fe577564a28355b4d1f81e60cb91b6d6af71093f91dc9bf97df7fde
Opcode Fuzzy Hash: e5040a46358f2346cb87d89f51ae6deab5fd9d69999703b9c79b85ecd432504c
Instruction Fuzzy Hash: 80A2B27148E3C18FC7578B7088B55817FB0AE1322475E85EFD4C58E4A3E3AE585ACB62

Function 09034A88 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a889d1c758640b68200053c96994d71c049fcc87ca04a5147fef1ad6af52513
Instruction ID: 51f7de163a33735f952e29f00ac505e513a673a509832330698020f2daef8ec7
Opcode Fuzzy Hash: 9a889d1c758640b68200053c96994d71c049fcc87ca04a5147fef1ad6af52513
Instruction Fuzzy Hash: E5E10974E042598FCB14CFA9C5909AEBBB2FF89304F24D569E815AB365C734AD42CF60

Function 09034EE8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b3716e63379e812387daaba622ee2e138eb23a85b683565790dcb4ce9b5dd24
Instruction ID: 7eec12d79a14b02acf4b69569ae836b484b159aee9033ddf3758f34225df64d8
Opcode Fuzzy Hash: 0b3716e63379e812387daaba622ee2e138eb23a85b683565790dcb4ce9b5dd24
Instruction Fuzzy Hash: 96E1F874E001198FCB14CFA9C5809AEBBB2FF89304F64D569E819AB365D735A941CFA0

Function 09037000 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3329519fc9760042d08589653c9dd451a11a2f6b11f2f1697600632b61d3134e
Instruction ID: a942dcda0bde5c6e15eab7129d5894b906fce21173d45590db7043d5b35864a5
Opcode Fuzzy Hash: 3329519fc9760042d08589653c9dd451a11a2f6b11f2f1697600632b61d3134e
Instruction Fuzzy Hash: 91E105B4E001198FCB14CFA9C5809AEBBF6FF89304F24D569E815AB355D734A982CF60

Function 09035320 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99c557e7e8562241869285802bf80fc866addf1302e0b90edd13a29759f911a3
Instruction ID: f68e6373839e783c1b7293b7b03482995df683486e1c76f2d73477965cd7ba1f
Opcode Fuzzy Hash: 99c557e7e8562241869285802bf80fc866addf1302e0b90edd13a29759f911a3
Instruction Fuzzy Hash: 58E1F874E041198FCB14CFA9C5909AEBBF2FF89304F24D569E819AB355D734A982CF60

Function 09036728 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d3bed89fbbf8a9a8037cbd8e9c19db263d3f75a0d9045a06294601532da965
Instruction ID: 822cd721cf19a0350df456f678545d27daadf3f27c05c24cde82a3487c9046d1
Opcode Fuzzy Hash: 33d3bed89fbbf8a9a8037cbd8e9c19db263d3f75a0d9045a06294601532da965
Instruction Fuzzy Hash: DAE10774E005199FCB14CFA9C5819AEBBF2FF89304F24C669E815AB355C735A982CF60

Function 0563A8D8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1764346896.0000000005630000.00000040.00000800.00020000.00000000.sdmp, Offset: 05630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5630000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e53d0d673a7e68488963691a82827580c468446521c7cff22ed27ddb12959ce
Instruction ID: e46d57474f439ccb6a5cb59addd16955eeb3ca9f7c8f5352cd8b31e89963dd0f
Opcode Fuzzy Hash: 6e53d0d673a7e68488963691a82827580c468446521c7cff22ed27ddb12959ce
Instruction Fuzzy Hash: 6FD1F43582475ACACB10EF64D990699BBB1FF95300F60DB9AE00937225EF706AC4CF91

Function 02EBE06C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761560734.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d580ce3dfdd977936b9d26978db9510e2f4efc1c50e7b1e40434e9553a75fbf8
Instruction ID: 97f4b5be35cff2be04e677b61c1ecee0c3ee6c274a000f99aeb1a73e055819f4
Opcode Fuzzy Hash: d580ce3dfdd977936b9d26978db9510e2f4efc1c50e7b1e40434e9553a75fbf8
Instruction Fuzzy Hash: 37A14B32E402198FCF0ADFB5C8405DEB7B2FF85304B6595AAE805AB265DB31E915CF90

Function 0563A8E8 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1764346896.0000000005630000.00000040.00000800.00020000.00000000.sdmp, Offset: 05630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5630000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a69c52d0edb1e49d0503308b56bd94ca9d2cf2288049151eacb3b6f73fe61ac0
Instruction ID: 3afb587061b8053e4efbd568b7d97b513674cadfd104163e40c7af7147885866
Opcode Fuzzy Hash: a69c52d0edb1e49d0503308b56bd94ca9d2cf2288049151eacb3b6f73fe61ac0
Instruction Fuzzy Hash: FFD1E43182475ACACB14EF64D990699BBB1FF95300F60DB9AE00937225EF746AC4CF91

Function 09034ED9 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eb2c7eefc65f93b73fc9d4149aaf07ce6623bdd37481322e51ebca03d42a97c
Instruction ID: 869c936867c6586f3adb072221e2bff69ccff775c02eb58aadfc182900a69218
Opcode Fuzzy Hash: 4eb2c7eefc65f93b73fc9d4149aaf07ce6623bdd37481322e51ebca03d42a97c
Instruction Fuzzy Hash: 8051FA74E002198FCB14CFA9C9405AEBBF6FF89305F24C569E419AB265D7359A42CFA0

Function 09036718 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52c5bf7335a6fedd154dfbee8af0e2a385295ced67ac03c9233d018bdfc98994
Instruction ID: e9bb648e888d0fa3d0dff869c31295be4ca4e69ccb9657f50b09781ff95f98b7
Opcode Fuzzy Hash: 52c5bf7335a6fedd154dfbee8af0e2a385295ced67ac03c9233d018bdfc98994
Instruction Fuzzy Hash: 37511975E002198BCB14CFA9C5415AEFBF2BF89304F24C66AD419AB355D7359A42CFA0

Function 09035311 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2a5e1e494cbc87110509cc78f6e95adcdc67a1c79fb58b24bcbff7860d23de4
Instruction ID: 8d6a151c1398b80480092d36c0f13d384403a2abf668deb5778fc0fe265dd4e3
Opcode Fuzzy Hash: b2a5e1e494cbc87110509cc78f6e95adcdc67a1c79fb58b24bcbff7860d23de4
Instruction Fuzzy Hash: 6F512974E042198FCB14CFA9C9805AEFBF2FF89305F24C569E419AB255D7349A42CFA1

Function 09034AB0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cfb35f6d7046dce8ae1cccf5c42005a367081a4ff42ea57cf15250fe77af0f4
Instruction ID: 983160f62136d2a4b9d7b48966b8deb7dcfa63198dc2a29bb7f34ecbfcfd9d77
Opcode Fuzzy Hash: 7cfb35f6d7046dce8ae1cccf5c42005a367081a4ff42ea57cf15250fe77af0f4
Instruction Fuzzy Hash: 1F510874E002198BCB14CFAAC5805AEFBF6FF89304F24C569D819AB325D7349A42CF61

Function 09038D89 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768180515.0000000009030000.00000040.00000800.00020000.00000000.sdmp, Offset: 09030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9030000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63af1a44f689ba229dd9693eae7a612ce532625bbe7b78ad6113f7ce22654c01
Instruction ID: 072f399a667bc8e18b3f071c1bd6bc90fe69904687604dececed45563f3c23c8
Opcode Fuzzy Hash: 63af1a44f689ba229dd9693eae7a612ce532625bbe7b78ad6113f7ce22654c01
Instruction Fuzzy Hash: E521D771D056688BEB18CF6B98047DDBAF7BFC9301F04C5AAD90CA6255DB340A858E40

Function 02EBCA70 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761560734.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06218a6b67a74a3915561226b5d01fe4ff1763ea7cfae36db2ade9969f279b36
Instruction ID: 44449daa09f39c6391011ee29be90d414e568681211964364f96f87bd78ae9c3
Opcode Fuzzy Hash: 06218a6b67a74a3915561226b5d01fe4ff1763ea7cfae36db2ade9969f279b36
Instruction Fuzzy Hash: 2E010C66E193D08BE3D769B902360EB7FEACD9201939604D9EFC919333D50A4843D755

Analysis Process: PO-1BdyzarvrjUANe0.exePID: 1732, Parent PID: 4364COMMON

Execution Graph

Execution Coverage:	17.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.7%
Total number of Nodes:	60
Total number of Limit Nodes:	9

Executed Functions

Function 06C46A00 Relevance: 6.3, APIs: 1, Strings: 2, Instructions: 1095
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

s%, xrefs: 06C47082, 06C47087
+, xrefs: 06C470D5, 06C470DA

Memory Dump Source

Source File: 00000002.00000002.2010746580.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c40000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID: s%$+
API String ID: 0-4147541561
Opcode ID: 26098e0b63761febe67fe872e299a4b136c9da7f6a1da2b2c17a186a415d6a23
Instruction ID: 974362f14021c3b37b4d6ec38d378c2ba1e7bbe8bd8d3a30421ee9544c298ff7
Opcode Fuzzy Hash: 26098e0b63761febe67fe872e299a4b136c9da7f6a1da2b2c17a186a415d6a23
Instruction Fuzzy Hash: 4BC28E74A012299FCBA5EF28D998B9DB7B2FF49301F1085E9D80DA7254DB346E81CF50

Function 072157C0 Relevance: 5.5, Strings: 4, Instructions: 496
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 07215AE5
$dq, xrefs: 07215F59
$dq, xrefs: 07215BA9
$dq, xrefs: 07216026

Memory Dump Source

Source File: 00000002.00000002.2012820582.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7210000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq
API String ID: 0-185584874
Opcode ID: 253b17d383036af8a75cf1756b837040bd254a6096c9e85d5f3340a32a3139f6
Instruction ID: 43a80c3425c1dbaa241301a7908791e540467d31a5a292fa51a8a6d5c80e7cff
Opcode Fuzzy Hash: 253b17d383036af8a75cf1756b837040bd254a6096c9e85d5f3340a32a3139f6
Instruction Fuzzy Hash: A432A0B4E11229CFDB68DF65C990BDEB7B2BB89300F5081E9C509AB250DB359E81CF50

Function 06C48C68 Relevance: 2.9, Strings: 2, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

., xrefs: 06C48EE8
1, xrefs: 06C48F6D

Memory Dump Source

Source File: 00000002.00000002.2010746580.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c40000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: 7774bc66f54c0943306923c865f154bda3256fd37a6d01dd173a8d764585bf23
Instruction ID: 1aae38aa1967e3df256161106d5a3176e817fac52603212d02e0f090b06d92ac
Opcode Fuzzy Hash: 7774bc66f54c0943306923c865f154bda3256fd37a6d01dd173a8d764585bf23
Instruction Fuzzy Hash: 0EF1CD74E01329CFDB68DF65C984B9DBBB2FF89301F1081A9D50AA7254DB359A81CF50

Function 06C45738 Relevance: 1.4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

+#, xrefs: 06C45925, 06C4592A

Memory Dump Source

Source File: 00000002.00000002.2010746580.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c40000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID: +#
API String ID: 0-807803015
Opcode ID: 927378772cf1d1e5a6aa5284c2702af3a5a45149a176ee4ab9cb71556d60e308
Instruction ID: 29514e3e73363ea5865f174c063eaf3f60d4d012db8b22f489b58b540b6c1b37
Opcode Fuzzy Hash: 927378772cf1d1e5a6aa5284c2702af3a5a45149a176ee4ab9cb71556d60e308
Instruction Fuzzy Hash: 5991E374D01228CFDB64EFA9C984B9DBBB2FF49300F5081A9D409A7351EB31AA85CF51

Function 06C45AA0 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2010746580.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c40000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef8ff0554bd24b4558792a556a7502df7d0d47792f7fe9ba931f96a0c323797a
Instruction ID: fc66eede1a3a51633c0b371e397f8a733e42b6a6781ba2adc1ea80547b7b04dc
Opcode Fuzzy Hash: ef8ff0554bd24b4558792a556a7502df7d0d47792f7fe9ba931f96a0c323797a
Instruction Fuzzy Hash: B2229E74D012298FDBA4DF69C994BD9B7B2BF49300F5081EAD549A7250EB30AEC5CF80

Function 014BD0A8 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 014BD136
GetCurrentThread.KERNEL32 ref: 014BD173
GetCurrentProcess.KERNEL32 ref: 014BD1B0
GetCurrentThreadId.KERNEL32 ref: 014BD209

Memory Dump Source

Source File: 00000002.00000002.1990091550.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_14b0000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: dfa974fb05ad2e33705be12b4dc148b26d2daeb5d57e608feb661dac287ed0e4
Instruction ID: bb45d3e5b4f941c207fe2e94f8dc1e35211fc575dd05a57f099e32af4a168f8d
Opcode Fuzzy Hash: dfa974fb05ad2e33705be12b4dc148b26d2daeb5d57e608feb661dac287ed0e4
Instruction Fuzzy Hash: 2F5159B09002498FDB14CFA9E988BDEBFF1AF48314F24845AE119A73A0DB745944CB65

Function 014BD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 014BD136
GetCurrentThread.KERNEL32 ref: 014BD173
GetCurrentProcess.KERNEL32 ref: 014BD1B0
GetCurrentThreadId.KERNEL32 ref: 014BD209

Memory Dump Source

Source File: 00000002.00000002.1990091550.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_14b0000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7ed353467d2a2010dba20543c5759693ceed97ac86c79845ee70221aa0c272d8
Instruction ID: e31ef8b012931cf745eaa21f6545a011599a6be7e034b7b98414999d79033b07
Opcode Fuzzy Hash: 7ed353467d2a2010dba20543c5759693ceed97ac86c79845ee70221aa0c272d8
Instruction Fuzzy Hash: 285157B09002098FDB14CFAAE988BDEFFF1AF48314F24845AE109A73A0DB745944CB65

Function 014BAE30 Relevance: 1.7, APIs: 1, Instructions: 197COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 014BB086

Memory Dump Source

Source File: 00000002.00000002.1990091550.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_14b0000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8579b61f6fbd4067e1f04ccf0177260d1a1aaa6072dd56c1e22a16f3f9f33ee0
Instruction ID: 087cc2416b5d285a983e294ddae8d015fa843b049d8139df5979fbf7a4927701
Opcode Fuzzy Hash: 8579b61f6fbd4067e1f04ccf0177260d1a1aaa6072dd56c1e22a16f3f9f33ee0
Instruction Fuzzy Hash: FD7127B0A00B058FD724DF2AD49479BBBF1FF48214F10892ED58A97B50D775E845CBA1

Function 014B4248 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 014B59F1

Memory Dump Source

Source File: 00000002.00000002.1990091550.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_14b0000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 06b7fa910b1c8525b1b462c912942d48c80796ad53a42f9ec72bcf731a51a202
Instruction ID: a6146ed0faf88ea19177f090efa7f8827fe3f329ff9ed630f57fd72e82e975fb
Opcode Fuzzy Hash: 06b7fa910b1c8525b1b462c912942d48c80796ad53a42f9ec72bcf731a51a202
Instruction Fuzzy Hash: 5241AEB0D00719CADB24DFA9C984B9EFBB5FF49304F20806AD509BB251DBB56945CFA0

Function 014B5935 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 014B59F1

Memory Dump Source

Source File: 00000002.00000002.1990091550.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_14b0000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 6b5680aec360f5233feff8938e968b567520092b1c3a12929f9474ab0f89ba03
Instruction ID: f0ee31bb81fc98bea6a576046cfb0f9885bcc5df8ced4fbffac6230de5aa0b27
Opcode Fuzzy Hash: 6b5680aec360f5233feff8938e968b567520092b1c3a12929f9474ab0f89ba03
Instruction Fuzzy Hash: B441CEB0D00619CADB24DFA9C984B8EBBB5FF48304F24806AD418BB261DB756945CFA0

Function 014BD300 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 014BD387

Memory Dump Source

Source File: 00000002.00000002.1990091550.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_14b0000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0bced5f75e9b65cde2febb24875e6610c4b073769c3f0685ebf315a3062bb54d
Instruction ID: 99c55cace757de00364c112391d28581bb3bb4c4b85103de513380d05675df6d
Opcode Fuzzy Hash: 0bced5f75e9b65cde2febb24875e6610c4b073769c3f0685ebf315a3062bb54d
Instruction Fuzzy Hash: 4021E4B5D01208DFDB10CF9AD984ADEBFF8EB48320F14801AE918A3310C379A944CFA0

Function 014BD2F9 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 014BD387

Memory Dump Source

Source File: 00000002.00000002.1990091550.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_14b0000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 893bc26333d1bfa1fd51ee21330b3c22ae02cc415daed228ebf3cf49bf175ab0
Instruction ID: 7b848a6e07ca0e50d1bc0944235bc6a22da71ba0bbfd5f21d8509d233f29eb4a
Opcode Fuzzy Hash: 893bc26333d1bfa1fd51ee21330b3c22ae02cc415daed228ebf3cf49bf175ab0
Instruction Fuzzy Hash: 9821E4B5D01249DFDB10CFAAD585ADEBFF5EB48314F24845AE918A3310C378A944CF64

Function 06C4E710 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,06C4E676), ref: 06C4E77E

Memory Dump Source

Source File: 00000002.00000002.2010746580.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c40000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 82b4c12b5fc1f8d352f45154ee724368b7deb1945ebb66c1f275c3f8f5428667
Instruction ID: feb621884c4e81c597b45cce9428212892af6462510deeb502049c70b04c086f
Opcode Fuzzy Hash: 82b4c12b5fc1f8d352f45154ee724368b7deb1945ebb66c1f275c3f8f5428667
Instruction Fuzzy Hash: 4A1123B6D002098FDB10CF9AC4407DEFBF1FF88224F24842AC429A7610C379A506CFA0

Function 06C4E318 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,06C4E676), ref: 06C4E77E

Memory Dump Source

Source File: 00000002.00000002.2010746580.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c40000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3ebcd3a8f120e06381f6f4cb1deaa6942ffd9802707ebc722d7b611972f1654e
Instruction ID: 9101f74d60f9349b0d47b440a90d2733591f4a48b87691c29fecd8778461e67a
Opcode Fuzzy Hash: 3ebcd3a8f120e06381f6f4cb1deaa6942ffd9802707ebc722d7b611972f1654e
Instruction Fuzzy Hash: CC1112B5D043098BDB20DF9AC844A9EFBF5EF88324F15841AD419A7211D379A545CFA1

Function 014BB020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 014BB086

Memory Dump Source

Source File: 00000002.00000002.1990091550.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_14b0000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d33a8f07fe0b26d6249dd0d73da55ce3cf8c897c6925065848f3f53ec499049f
Instruction ID: ce78a714762ddc8576729a09429c50ca8d73908042d673db3ce67742dd5e901f
Opcode Fuzzy Hash: d33a8f07fe0b26d6249dd0d73da55ce3cf8c897c6925065848f3f53ec499049f
Instruction Fuzzy Hash: 5B11CDB5C003498ADB24DF9AD884ADEFBF4EB88224F14841AD569B7610C379A549CFA1

Function 07213568 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07216F85

Memory Dump Source

Source File: 00000002.00000002.2012820582.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7210000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 660e296238b2d15bce75fe338992bf1edd7ca75b4bd6a0210a5c681b16f6478a
Instruction ID: 3db35e9aa231ead09db102f2960197bc0c5f31f59b559571b8c1f2588df5de52
Opcode Fuzzy Hash: 660e296238b2d15bce75fe338992bf1edd7ca75b4bd6a0210a5c681b16f6478a
Instruction Fuzzy Hash: A611F2B5810349DFCB10DF9AD885BDEBBF8FB58320F20845AE519A7200C3B5A944CFA1

Function 07216F21 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07216F85

Memory Dump Source

Source File: 00000002.00000002.2012820582.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7210000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 4036b2e311bfcae9153c55449b90ef4d0a3f90abe5c4f0d9393651b958ba6617
Instruction ID: 6185727921393f78dc39a1875f7b9daa53b6579c6b4b1a7011e8c5cb1d528396
Opcode Fuzzy Hash: 4036b2e311bfcae9153c55449b90ef4d0a3f90abe5c4f0d9393651b958ba6617
Instruction Fuzzy Hash: E311F2B58002499FCB10CF9AD885BDEFFF8EB58320F20845AE559A7600C375A944CFA1

Function 013BD654 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1989806800.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13bd000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f62a6c7698424ac9d17f6653bd49b4c442092a6f58ec5b55e40635c076be9da3
Instruction ID: 0167559c9495c9cca140c4f959c0989d2f5cdb109cf5a4e39a5424df29b233da
Opcode Fuzzy Hash: f62a6c7698424ac9d17f6653bd49b4c442092a6f58ec5b55e40635c076be9da3
Instruction Fuzzy Hash: C32138B5504244DFCB05CF54D8C0F66BF65FB8832CF24C669EA090BA46D336D416CB61

Function 013BD1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1989806800.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13bd000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 352525b4691293cafe5ea12b9c47f305d1551cf20ff486252204c8ff3972767c
Instruction ID: bf4715f7521d013806d6b681fa9752071b829c16aa9cd7d69a5cbafe5d87833e
Opcode Fuzzy Hash: 352525b4691293cafe5ea12b9c47f305d1551cf20ff486252204c8ff3972767c
Instruction Fuzzy Hash: 3421F4B1504284DFDB05DF98D9C0B66BF65FB88328F24C569EE090EA46D336D416CBA1

Function 013BD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1989806800.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13bd000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72c7c59152597b6f8163e8232181c1e57126931918bfb9f058551a766de63372
Instruction ID: ebd1974f54181232cf0d32e47203c30ea2a9a51e67989f0a211fd40e0964bd44
Opcode Fuzzy Hash: 72c7c59152597b6f8163e8232181c1e57126931918bfb9f058551a766de63372
Instruction Fuzzy Hash: 87216DB1504204DFDB05DF44D5C0B96BF65FB8431CF20C56DDA091BA56D73AE446C7A1

Function 013CD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1989852904.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13cd000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 076ff2114f07d243483a68ff133d474538b5a28b52b714e8cb8f0ccaf5551d71
Instruction ID: 057afe14d72717ebd06cc6a3eb848c8905fd2555fcf44498209a997d76d355aa
Opcode Fuzzy Hash: 076ff2114f07d243483a68ff133d474538b5a28b52b714e8cb8f0ccaf5551d71
Instruction Fuzzy Hash: C62100B1604204EFCB15DF58D9C0B26BBA5FB84758F20C97DE90A4B646C33AD807CBA1

Function 013CD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1989852904.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13cd000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2676b7e24e738f9a5789ba5c243f75b58ce7d93283fa82016744abd648ddd57
Instruction ID: 3050224182ea8d4933628c048e46cc5f9fb28743525299cef5a76698ae23fbf4
Opcode Fuzzy Hash: d2676b7e24e738f9a5789ba5c243f75b58ce7d93283fa82016744abd648ddd57
Instruction Fuzzy Hash: FD2195755083809FCB03CF58D994711BF71EB46214F24C5EAD8498F2A7C33AD846CBA2

Function 013BD64F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1989806800.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13bd000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2dec59e3151889acede25dbdc09f1e0996748c90a37620c8196c664727292b
Instruction ID: ab1dc2d90323bbf6c0029b2b7d630edb701f9effb8d3728a760ff83f54b41cc4
Opcode Fuzzy Hash: ad2dec59e3151889acede25dbdc09f1e0996748c90a37620c8196c664727292b
Instruction Fuzzy Hash: 9721DF76504280DFCB16CF44D9C4B96BF72FB88318F2482A9DA480B657C33AD426CB91

Function 013BD1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1989806800.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13bd000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0198dffcca54c8a327979ca184e18e1179e26769679eb7287e54d642110c921c
Instruction ID: 56063ba58c8fb14e24e289c889c359f0815ff882e368ec876a0caa56ad6e4d08
Opcode Fuzzy Hash: 0198dffcca54c8a327979ca184e18e1179e26769679eb7287e54d642110c921c
Instruction Fuzzy Hash: 8021CD76404280DFDB06CF44D9C4B56BF62FB84328F24C1A9DD080A656C33AD42ACBA1

Function 013BD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1989806800.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13bd000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction ID: 6510958404fdc95f4d9f992fec5d0362d4132df06587a0e75c1f79406824c00a
Opcode Fuzzy Hash: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction Fuzzy Hash: EC112672404240CFDB12CF44D5C0B96BF72FB84328F24C6A9D9090B657C33AE45ACBA2

Function 013BDA15 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1989806800.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13bd000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3141d8012716d95ebb8ab04afae2f32f9b523c8cfaf6f68a72ab09962f0dda09
Instruction ID: 731c48e81f50a57f13deecf90930017611a23ec959906b4bc93000e93bd1c3fb
Opcode Fuzzy Hash: 3141d8012716d95ebb8ab04afae2f32f9b523c8cfaf6f68a72ab09962f0dda09
Instruction Fuzzy Hash: FE01F7B140C3449AF7108A99C8C07A6BFACDF4132CF08C41AEF094AA82D6799840C6B1

Function 013BDA14 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1989806800.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13bd000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e976a2533e0fb43b3249a51b1789e5a5336dc583f3610ac76dc22bb3131e0262
Instruction ID: 0fbfe204f83b81e94aa9f4702178ce8d08ab055343f52b9068478f238ba699c5
Opcode Fuzzy Hash: e976a2533e0fb43b3249a51b1789e5a5336dc583f3610ac76dc22bb3131e0262
Instruction Fuzzy Hash: 54F0C271408340AEF7108E09C8C4B62FF98EB41328F18C05AEE084B682D2799844CAB0

Non-executed Functions

Function 07214D99 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2012820582.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7210000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9f39fdd16a66d4568fefdb369700d62815abbff44f250777f56aa7a91b7ba1c
Instruction ID: 22c4d3509510a4b16a8d9ce9c202f986d1329e946c2c33935d769bdd49448f59
Opcode Fuzzy Hash: e9f39fdd16a66d4568fefdb369700d62815abbff44f250777f56aa7a91b7ba1c
Instruction Fuzzy Hash: 62E09AB0D7614ECAEF10AFA1C111BFFF6B07BA6300F606445880973288CBB086448FA5

Function 06C43955 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2010746580.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c40000_PO-1BdyzarvrjUANe0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db19110d789815f717bda473993dc34a9960e0930ca4b222c48ecd1f8e0fac3e
Instruction ID: 60f9697743d0715f072a6da1dde7414ae030b28758b9d5db0afe33248daf1bb2
Opcode Fuzzy Hash: db19110d789815f717bda473993dc34a9960e0930ca4b222c48ecd1f8e0fac3e
Instruction Fuzzy Hash: C9F0ED30C45259CFEB64EF52D849BBEBB74BF96315F105459D00A73194CB754684CF84

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO-1BdyzarvrjUANe0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO-1BdyzarvrjUANe0.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

Windows Analysis Report
PO-1BdyzarvrjUANe0.exe

Function 078611E0 Relevance: 6.9, Strings: 5, Instructions: 618
COMMON

Function 02EBD4A8 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Function 02EBD4B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 09037C58 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 02EBB230 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Function 02EB4610 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 02EB5E24 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 056345B2 Relevance: 1.6, APIs: 1, Instructions: 77
COMMON